FPGA-Accelerated Context-Aware Intrusion Detection System Using Decision Transformer and LightGBM for Automotive CAN Networks

Modern cars are equipped with a wide variety of sensors generating continually growing amounts of data. This data is transmitted via bus systems such as Controller Area Network (CAN) inside of the vehicle to the microcontroller-based Electronic Control Units. By connecting the vehicle to its surroundings using wireless interfaces, this data becomes accessible to the vehicle manufacturer from a distance. Through the opening to the outside, cyber attacks can exploit these interfaces and introduce major risks to the privacy and safety of vehicle users. Hence, suitable methods for vehicle security monitoring such as intrusion detection and logging are needed. In this work, we focus on the logging of network data, since this data is useful for the development of security updates, countermeasures and incident signatures. On this account, we propose a new method to aggregate the data of the CAN bus. The method combines CAN frames into so-called flows. Each flow contains a set of packets that share a certain common attribute (e.g.: frame type and identifier). To integrate security monitoring of vehicle fleets seamlessly into backend server systems, the gathered CAN flow data is stored in an industry standard data format. Additionally, the payload data is included in the flow format using a compression algorithm to leverage deep-packet inspection. The evaluation results with realworld vehicle data indicate that in our case about 40 % reduction of the overall data size is possible with our method compared to industry-standard formats for storing CAN frames. On this account, we propose a new method to aggregate the data of the CAN bus. The method combines CAN frames into so-called flows. Each flow contains a set of packets that share a certain common attribute (e.g.: frame type and identifier). To integrate security monitoring of vehicle fleets seamlessly into backend server systems, the gathered CAN flow data is stored in an industry standard data format. Additionally, the payload data is included in the flow format using a compression algorithm to leverage deep-packet inspection. The evaluation results with realworld vehicle data indicate that in our case about 40 % reduction of the overall data size is possible with our method compared to industry-standard formats for storing CAN frames.

This system is designed to test automotive CAN (Controller Area Network) controlled devices or entire network. This system not only can display CAN frames (CAN 2.0A/B) received from or sent onto CAN bus, but also can record data on log files for off-line evaluation. Users can configure several monitoring modes and CAN channel features of the system with PC application. Furthermore the USB technology adopted in the system make it a more practical and convenient CAN bus testing system.

<div class="section abstract"><div class="htmlview paragraph">The amount of data communicated in automotive networks is increasing rapidly, leading to more complex systems alongside the rising number of Electronic Control Units (ECUs) in modern vehicles. As the number of ECUs has risen, Controller Area Network (CAN) communication bandwidth has been pushed to its limit. Existing solutions - such as using multiple CAN buses, sending multiple CAN frames or switching to another protocol - require a significant system-design effort and replacement of hardware and software. This has paved the way for CAN Flexible Data-rate (CAN FD), which extends the CAN standard and permits significantly higher data rates, enabling faster firmware upgrades. However, some changes must be made like: exchange the classical CAN microcontroller with a CAN FD microcontroller and also a CAN FD transceiver must be used.</div><div class="htmlview paragraph">This article will explore the benefits of CAN FD, how it compares with the classical CAN protocol, requirements for systems and how to introduce CAN FD into existing CAN networks.</div></div>

The increasing cyber-physical integration in connected and autonomous vehicles (CAVs) has amplified the need for robust intrusion detection systems (IDS) to secure controller area network (CAN) communications. Existing deep learning approaches, such as CNNs and LSTMs, have demonstrated strong potential but often struggle to detect stealthy and sophisticated attacks, primarily due to inadequate temporal modeling and the use of datasets with limited fidelity that do not reflect real-world attack complexities. To address these limitations, we propose an optimized hybrid IDS model that integrates one-dimensional convolutional neural networks (1D-CNN) with bidirectional long short-term memory (BiLSTM) layers. The architecture is specifically designed to extract spatio-temporal features from CAN traffic with minimal complexity, enabling efficient detection of subtle attack patterns. Our model incorporates a time-aware design that allows it to detect attacks as they evolve, even when they occur in localized segments of the payload. It was trained and evaluated using the high-fidelity ORNL ROAD dataset, which includes physically validated fuzzing and targeted CAN ID attacks. The proposed model achieved an accuracy of 99.73%, a Matthews Correlation Coefficient (MCC) of 0.9401, and maintained average low false positive of (≤ 0.00045) and false negative of (≤ 0.00047) rates. It also demonstrated a low average prediction latency of 0.535 milliseconds per CAN frame, highlighting its architectural efficiency. This performance reflects a deliberate design balance between lightweight complexity and high detection accuracy, advancing the development of practical and robust deep learning-based IDS solutions for modern vehicular networks.

The response time distributions of the frames sent on a Controller Area Network (CAN) bus are of prime interest to dimension and validate automotive electronic architectures. However, the existing work on the timing behaviour of the CAN network does not take into account that all the data exchanges between the Electronic Control Units (ECUs) are driven by different and independent clocks which are subject to clock drifts. This paper proposes a model for clock drifts and describes their impact on the CAN frame response time distributions. By implementing the clock drifts in a CAN simulation tool, we show experimentally that the response time distributions converge, for drift values chosen randomly within the same range on all ECUs, whatever the initial phasings between the sending nodes. Furthermore, we show that, as a result of the clock drifts, the situations leading to the worst case response times are transient.

Vehicles today comprise intelligent systems like connected autonomous driving and advanced driving assistance systems (ADAS) to enhance the driving experience, which is enabled through increased connectivity to infrastructure and fusion of information from different sensing modes. However, the rising connectivity coupled with the legacy network architecture within vehicles can be exploited for launching active and passive attacks on critical vehicle systems and directly affecting the safety of passengers. Machine learning-based intrusion detection models have been shown to successfully detect multiple targeted attack vectors in recent literature, whose deployments are enabled through quantised neural networks targeting low-power platforms. Multiple models are often required to simultaneously detect multiple attack vectors, increasing the area, (resource) cost, and energy consumption. In this paper, we present a case for utilising custom-quantised MLP's (CQMLP) as a multi-class classification model, capable of detecting multiple attacks from the benign flow of controller area network (CAN) messages. The specific quantisation and neural architecture are determined through a joint design space exploration, resulting in our choice of the 2-bit precision and the n-layer MLP. Our 2-bit version is trained using Brevitas and optimised as a dataflow hardware model through the FINN toolflow from AMD/Xilinx, targeting an XCZU7EV device. We show that the 2-bit CQMLP model, when integrated as the IDS, can detect malicious attack messages (DoS, fuzzing, and spoofing attack) with a very high accuracy of 99.9%, on par with the state-of-the-art methods in the literature. Furthermore, the dataflow model can perform line rate detection at a latency of 0.11 ms from message reception while consuming 0.23 mJ/inference, making it ideally suited for integration with an ECU in critical CAN networks.

<span lang="EN-US">Real-time communication is important in control network. In real-time communication, message need to be delivered from source to destination within specification. Embedded Ethernet and Controller Area Network (CAN) protocol can be used in control network to achieve hard real-time communication. For embedded Ethernet protocol, Carrier Sense Multiple Access with Collision Detection (CSMA/CD) is the media access control (MAC) used to control data transmission between nodes in network. Back-off algorithm in CSMA/CD is used to handle packet collisions and retransmission. For CAN protocol, it is communication protocol developed mainly for automotive application. It has priority arbitration to handle collisions and retransmission. In this project, embedded Ethernet network models and CAN network models are developed and simulated in MATLAB Simulink software. Several back-off algorithms, which are Binary Exponential Backoff (BEB), Linear Back-off Algorithm, Exponential-Linear back-off Algorithm and Logarithm Back-off Algorithm are proposed and implemented into Embedded Ethernet network model to evaluate the performance. Both embedded Ethernet and CAN network models are extended to 3 nodes, 10 nodes, and 15 nodes to evaluate performance at different network condition. The performance criteria evaluated and discussed are average delay and jitter of packets. The results show that in network with high number of nodes, Linear Back-off Algorithm and Exponential-Linear back-off Algorithm shows improvement in packets delay and jitter. For CAN network, the packet jitter is relatively low.</span>

The Controller Area Network (CAN) dominates in-vehicle networking systems in modern vehicles. CAN was designed with low-latency and reliability as key features. Authenticity of a CAN frame was not considered in the design, thus, most in-vehicle network nodes inherently trust received messages as coming from a legitimate source. As a result, it is trivial to program (or hack) a network node to spoof traffic. Authentication is challenging for CAN and related protocols, such as SAE J1939, due to limited frame sizes and high bus utilization. Adding a message authentication code (MAC) as a separate message can unduly stress the real-time delivery of safety-critical messages. Although this stressor is well-known, the impact of authentication protocols on real-time message delivery in CAN has not yet been thoroughly examined. In this paper, we provide the first comprehensive analysis of realtime schedulability analysis applied to authentication schemes for CAN, CAN Flexible Data-rate (CAN FD), and CAN extra long payload (CAN XL). We formulate the response time analysis for addition of MACs and periodic transmission of MACs, and we examine their impact on two case studies and through evaluation with randomized schedulability experiments over a wide range of message sets.

The paper addresses the security service infrastructure included in the controller area network (CAN) standard, proposing the incorporation of a confidentiality service for that kind of network. Regarding security, CAN currently supports only a special kind of data transfer service, namely safety, for error detection, signalling, and self checking. Nevertheless, as CAN has become more diverse, complex and integrated into other kinds of networks, it must provide higher security services, such as confidentiality, especially for its bus, which is the most attack-prone point on CAN. Taking into account, on one hand, the security services defined by ISO and, on the other hand, the security services defined by CAN, the paper proposes to incorporate a confidentiality service to CAN based on RC4, which is a lightweight symmetric stream cipher algorithm. The paper then presents the clock cycles required for encrypting different data sizes of the CAN frame in the 87C196CB, which is a microcontroller with integrated CAN 2.0 serial interface.

Controller Area Network (CAN) is a bus standard commonly used in the automotive industry. A large number of researches have been carried out on the identity authentication and intrusion detection technology of the in-vehicle network for attacks. This paper presents a method to extract the voltage of CAN bus terminal to obtain the equipment fingerprint. The method identifies different ECUs by measuring the voltage difference on the vehicle network, selects features only from the time domain and detects based on a single frame. This paper mainly focuses on the influence of temperature on the fingerprint of CAN bus terminal. By using a high and low temperature test chamber to simulate different temperature environments during vehicle operation, a large number of CAN frames have been collected for fingerprint extraction. By studying the relationship between temperature and CAN bus terminal fingerprint, the influence of temperature on fingerprint has been compensated. After temperature linear compensation, the recognition rate of voltage-based CAN bus terminal fingerprint extraction increases from 71.2% to 87.6% at 0–80 °C.

Recent years have seen an exponential rise in complex software-driven functionality in vehicles, leading to a rising number of electronic control units (ECUs), network capabilities, and interfaces. These expanded capabilities also bring-in new planes of vulnerabilities making intrusion detection and management a critical capability; however, this can often result in more ECUs and network elements due to the high computational overheads. In this paper, we present a consolidated ECU architecture incorporating an Intrusion Detection System (IDS) for Automotive Controller Area Network (CAN) along with traditional ECU functionality on an off-the-shelf hybrid FPGA device, with near-zero overhead for the ECU functionality. We propose two quantised multi-layer perceptrons (QMLP's) as isolated IDSs for detecting a range of attack vectors including Denial-of-Service, Fuzzing and Spoofing, which are accelerated using off-the-shelf deep-learning processing unit (DPU) IP block from Xilinx, operating fully transparently to the software on the ECU. The proposed models achieve the state-of-the-art classification accuracy for all the attacks, while we observed a 15x reduction in power consumption when compared against the GPU-based implementation of the same models quantised using Nvidia libraries. We also achieved a 2.3x speed up in per-message processing latency (at 0.24 ms from the arrival of a CAN message) to meet the strict end-to-end latency on critical CAN nodes and a 2.6x reduction in power consumption for inference when compared to the state-of-the-art IDS models on embedded IDS and loosely coupled IDS accelerators (GPUs) discussed in the literature.

Rec-CNN: In-vehicle networks intrusion detection using convolutional neural networks trained on recurrence plots

The Partial controller area network (CAN), which can partially turn on and off the operation of electronic control unit (ECU), is a low-power technology and can reduce the CO2 emissions and power consumption of an automobile compared with the existing automobile CAN. However, a problem arises in the application of the Partial CAN whereby the existing automobile CAN databases that contain all the CAN frames of the automobile have many period frames. The periodic frame wakes the ECU every constant cycle, so the power consumption and CO2 emissions savings of ECU are ineffective. To solve this problem, we proposed a new algorithm for applying the Partial CAN that can evade the period wake-up of the ECU. In this paper, we introduce a new algorithm for applying the Partial CAN and analyze the performance of the proposed algorithm by comparing with the existing algorithm.

Controller area network (CAN) data-reduction techniques have been developed to reduce CAN bus loads, which have increased due to the large number of electronic control units in modern automobiles. Automotive communication uses various in-vehicle network. These techniques make it possible that same information to be sent using less bandwidth. However, the existing CAN DR algorithms only consider the CAN network. Automotive communication uses various in-vehicle network (IVN) protocols such as CAN, FlexRay, and Ethernet. The use of DR techniques may cause compatibility issue in heterogenous IVNs. This paper proposes a gateway system for data-reduced communication between Ethernet and CAN systems with data-reduction. The proposed gateway system receives a compressed CAN message, decompresses it, and transmits it to the Ethernet network. Additionally, the gateway receives a normal Ethernet message, compresses it, and transmits it to the CAN protocol. An evaluation of the performance of the developed gateway system is also presented.

Reducing message-length variations in resource-constrained embedded systems implemented using the Controller Area Network (CAN) protocol