CANGuard: A Spatio-Temporal CNN-GRU-Attention Hybrid Architecture for Intrusion Detection in In-Vehicle CAN Networks

• URL: http://arxiv.org/abs/2603.25763v1
• Date: Thu, 26 Mar 2026 03:49:04 GMT
• Title: CANGuard: A Spatio-Temporal CNN-GRU-Attention Hybrid Architecture for Intrusion Detection in In-Vehicle CAN Networks
• Abstract summary: Internet of Vehicles (IoV) has become an essential component of smart transportation systems, enabling seamless interaction among vehicles and infrastructure.<n>This paper presents CANGuard, a deep learning architecture that combines Convolutional Neural Networks (CNN), Gated novel Recurrent Units (RUG) and an attention mechanism to effectively identify such attacks.<n>The proposed approach demonstrates strong potential for practical and scalable security enhancements in modern IoV environments.
• Score: 0.7919969809015935
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: The Internet of Vehicles (IoV) has become an essential component of smart transportation systems, enabling seamless interaction among vehicles and infrastructure. In recent years, it has played a progressively significant role in enhancing mobility, safety, and transportation efficiency. However, this connectivity introduces severe security vulnerabilities, particularly Denial-of-Service (DoS) and spoofing attacks targeting the Controller Area Network (CAN) bus, which could severely inhibit communication between the critical components of a vehicle, leading to system malfunctions, loss of control, or even endangering passengers' safety. To address this problem, this paper presents CANGuard, a novel spatio-temporal deep learning architecture that combines Convolutional Neural Networks (CNN), Gated Recurrent Units (GRU), and an attention mechanism to effectively identify such attacks. The model is trained and evaluated on the CICIoV2024 dataset, achieving competitive performance across accuracy, precision, recall, and F1-score and outperforming existing state-of-the-art methods. A comprehensive ablation study confirms the individual and combined contributions of the CNN, GRU, and attention components. Additionally, a SHAP analysis is conducted to interpret the decision-making process of the model and determine which features have the most significant impact on intrusion detection. The proposed approach demonstrates strong potential for practical and scalable security enhancements in modern IoV environments, thereby ensuring safer and more secure CAN bus communications.

Related papers

• Security and Resilience in Autonomous Vehicles: A Proactive Design Approach [1.5675763601034223]
  Autonomous vehicles (AVs) promise efficient, clean and cost-effective transportation systems.<n>Their reliance on sensors, wireless communications, and decision-making systems makes them vulnerable to cyberattacks and physical threats.<n>This chapter presents novel design techniques to strengthen the security and resilience of AVs.
  arXiv  Detail & Related papers  (2026-04-14T07:45:16Z)
• Leveraging the Power of Ensemble Learning for Secure Low Altitude Economy [64.39232788946173]
  Low Altitude Economy (LAE) holds immense promise for enhancing societal well-being and driving economic growth.<n>This paper investigates ensemble learning for secure LAE, covering research focuses, solutions, and a case study.
  arXiv  Detail & Related papers  (2026-02-07T23:15:58Z)
• Evaluating False Alarm and Missing Attacks in CAN IDS [0.7734726150561088]
  We present a systematic adversarial evaluation of CAN IDS using the ROAD dataset.<n>We compare four shallow learning models with a deep neural network-based detector.<n>Our results demonstrate that adversarial manipulation can simultaneously trigger false alarms and evade detection.
  arXiv  Detail & Related papers  (2026-02-02T20:38:01Z)
• Evaluating Vulnerabilities of Connected Vehicles Under Cyber Attacks by Attack-Defense Tree [1.9483189922830135]
  We present an attack-tree based methodology for evaluating cyber security vulnerabilities in CAVs.<n>We also define a measure of vulnerabilities, which is based on existing cyber security threats and corresponding defensive countermeasures.
  arXiv  Detail & Related papers  (2025-12-09T03:28:31Z)
• OS-Sentinel: Towards Safety-Enhanced Mobile GUI Agents via Hybrid Validation in Realistic Workflows [77.95511352806261]
  Computer-using agents powered by Vision-Language Models (VLMs) have demonstrated human-like capabilities in operating digital environments like mobile platforms.<n>We propose OS-Sentinel, a novel hybrid safety detection framework that combines a Formal Verifier for detecting explicit system-level violations with a Contextual Judge for assessing contextual risks and agent actions.
  arXiv  Detail & Related papers  (2025-10-28T13:22:39Z)
• End-to-End Co-Simulation Testbed for Cybersecurity Research and Development in Intelligent Transportation Systems [5.804791448287085]
  This chapter discusses an integrated co-simulation testbed that links CARLA for 3D environment and sensor modeling, SUMO for microscopic traffic simulation and control, and OMNeT++ for V2X communication simulation.<n>The co-simulation testbed enables end-to-end experimentation, vulnerability identification, and mitigation benchmarking.<n>To illustrate its capabilities, the chapter incorporates a case study on a C-V2X proactive safety alert system enhanced with post-quantum cryptography.
  arXiv  Detail & Related papers  (2025-09-20T01:21:54Z)
• CANDoSA: A Hardware Performance Counter-Based Intrusion Detection System for DoS Attacks on Automotive CAN bus [45.24207460381396]
  This paper presents a novel Intrusion Detection System (IDS) designed for the Controller Area Network (CAN) environment.<n>A RISC-V-based CAN receiver is simulated using the gem5 simulator, processing CAN frame payloads with AES-128 encryption as FreeRTOS tasks.<n>Results indicate that this approach could significantly improve CAN security and address emerging challenges in automotive cybersecurity.
  arXiv  Detail & Related papers  (2025-07-19T20:09:52Z)
• CANEDERLI: On The Impact of Adversarial Training and Transferability on CAN Intrusion Detection Systems [17.351539765989433]
  A growing integration of vehicles with external networks has led to a surge in attacks targeting their Controller Area Network (CAN) internal bus. As a countermeasure, various Intrusion Detection Systems (IDSs) have been suggested in the literature to prevent and mitigate these threats. Most of these systems rely on data-driven approaches such as Machine Learning (ML) and Deep Learning (DL) models. In this paper, we present CANEDERLI, a novel framework for securing CAN-based IDSs.
  arXiv  Detail & Related papers  (2024-04-06T14:54:11Z)
• Differentiated Security Architecture for Secure and Efficient Infotainment Data Communication in IoV Networks [55.340315838742015]
  Negligence on the security of infotainment data communication in IoV networks can unintentionally open an easy access point for social engineering attacks. In particular, we first classify data communication in the IoV network, examine the security focus of each data communication, and then develop a differentiated security architecture to provide security protection on a file-to-file basis.
  arXiv  Detail & Related papers  (2024-03-29T12:01:31Z)
• SISSA: Real-time Monitoring of Hardware Functional Safety and Cybersecurity with In-vehicle SOME/IP Ethernet Traffic [49.549771439609046]
  We propose SISSA, a SOME/IP communication traffic-based approach for modeling and analyzing in-vehicle functional safety and cyber security. Specifically, SISSA models hardware failures with the Weibull distribution and addresses five potential attacks on SOME/IP communication. Extensive experimental results show the effectiveness and efficiency of SISSA.
  arXiv  Detail & Related papers  (2024-02-21T03:31:40Z)
• GCNIDS: Graph Convolutional Network-Based Intrusion Detection System for CAN Bus [0.0]
  We present an innovative approach to intruder detection within the CAN bus, leveraging Graph Convolutional Network (GCN) techniques. Our experimental findings substantiate that the proposed GCN-based method surpasses existing IDSs in terms of accuracy, precision, and recall. Our proposed approach holds significant potential in fortifying the security and safety of modern vehicles.
  arXiv  Detail & Related papers  (2023-09-18T21:42:09Z)
• CAN-LOC: Spoofing Detection and Physical Intrusion Localization on an In-Vehicle CAN Bus Based on Deep Features of Voltage Signals [48.813942331065206]
  We propose a security hardening system for in-vehicle networks. The proposed system includes two mechanisms that process deep features extracted from voltage signals measured on the CAN bus.
  arXiv  Detail & Related papers  (2021-06-15T06:12:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.