cs.CRMar 26, 2026

CANGuard: A Spatio-Temporal CNN-GRU-Attention Hybrid Architecture for Intrusion Detection in In-Vehicle CAN Networks

Authors: Rakib Hossain Sajib, Md. Rokon Mia, Prodip Kumar Sarker, Abdullah Al Noman, Md Arifur Rahman

Organizations: Department of Computer Science and Engineering, Begum Rokeya University, Rangpur, Rangpur, Bangladesh · Wilmington University, New Castle, Delaware, United States · Trine University, Angola, Indiana, United States

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

The Internet of Vehicles (IoV) has become an essential component of smart transportation systems, enabling seamless interaction among vehicles and infrastructure. In recent years, it has played a progressively significant role in enhancing mobility, safety, and transportation efficiency. However, this connectivity introduces severe security vulnerabilities, particularly Denial-of-Service (DoS) and spoofing attacks targeting the Controller Area Network (CAN) bus, which could severely inhibit communication between the critical components of a vehicle, leading to system malfunctions, loss of control, or even endangering passengers' safety. To address this problem, this paper presents CANGuard, a novel spatio-temporal deep learning architecture that combines Convolutional Neural Networks (CNN), Gated Recurrent Units (GRU), and an attention mechanism to effectively identify such attacks. The model is trained and evaluated on the CICIoV2024 dataset, achieving competitive performance across accuracy, precision, recall, and F1-score and outperforming existing state-of-the-art methods. A comprehensive ablation study confirms the individual and combined contributions of the CNN, GRU, and attention components. Additionally, a SHAP analysis is conducted to interpret the decision-making process of the model and determine which features have the most significant impact on intrusion detection. The proposed approach demonstrates strong potential for practical and scalable security enhancements in modern IoV environments, thereby ensuring safer and more secure CAN bus communications.

Figures & tables

Fig. 1: CNN-GRU-Attention architecture employs CNN layers to extract spatial features, GRU layers to model temporal dependencies, an attention mechanism to emphasize important features, and dense layers to perform the final classification.
 \displaystyle h_{\text{CNN}}=\Dropout(MaxPool(Conv1D3(\displaystyle\text{Dropout}\big(\text{MaxPool}\big(\text{Conv1D}_{3}( 
  Conv1D2(Conv1D1(Xseq))))\displaystyle\text{Conv1D}_{2}(\text{Conv1D}_{1}(X_{\text{seq}}))\big)\big) 
Algorithm 1 CNN-GRU-Attention Architecture
Fig. 2: Visual heatmap representation of the attention mechanism’s focus across time steps and features, with color intensity indicating the level of importance.
ParameterValue
OptimizerAdam with learning rate 0.001
Loss FunctionCategorical crossentropy
Batch Size64
Epochs50 with early stopping (patience = 10)
RegularizationDropout (0.3), L2 regularization ( λ\lambda = 0.001)
TABLE I: Training Configuration
ReferenceYearMethodDatasetAccuracy(%)Precision(%)Recall(%)F1-Score(%)
Neto et al. [ 7 ]2024Logistic RegressionCICIoV202489485049
  Deep Neural NetworkCICIoV202496768378
  AdaBoostCICIoV202492486651
Narkedimilli et al. [ 8 ]2025Adaptive Curriculum LearningCustom CAN Dataset981009797
Anargya et al. [ 9 ]2025Random ForestCustom IDS Dataset98.598.698.598.5
LaxmiLydia et al. [ 17 ]2025Deep LearningCICIDS201798.7798.7798.7798.76
TABLE II: Comparative Analysis with State-of-the-Art
Fig. 3: Performance comparison of models in the ablation study, evaluated across different key metrics.
No.CNNGRUAttn.AccuracyPrecisionRecallF1-Score
1✓  0.99330.99340.99330.9933
2 ✓ 0.99040.99860.99040.9943
3✓✓ 0.99860.99860.99860.9986
4✓✓✓0.99890.99890.99890.9989
TABLE III: Ablation Study Results with Component Indicators
Fig. 4: Bar plot of mean absolute SHAP values for DATA_0 to DATA_7 features, representing bytes of data transmitted over the CAN bus.
More in this topic

Network Intrusion Detection

Network intrusion detection identifies malicious or abnormal network activity to help protect computers, connected devices, and critical infrastructure.

See all 168 papers

Explore similar work

CardsList

  1. DAIRE: A lightweight AI model for real-time detection of Controller Area Network attacks in the Internet of Vehicles

    Apr 22, 2026Shahid Alam, Amina Jameel, Zahida Parveen +4Network Intrusion DetectionCybersecurity

    Department of Information Security, College of Computer Science and Engineering, University of Ha’il, Ha’il, Saudi Arabia · Department of Computer Engineering, Center of Excellence in Artificial Intelligence, Bahria University, Islamabad, Pakistan · Department of Artificial Intelligence, College of Computer Science and Engineering, University of Ha’il, Ha’il, Saudi Arabia +2

  2. Deep Defence on Wheels: A Dual Intrusion Detection System Architecture for Comprehensive In-Vehicle Network Security

    Oct 5, 2026Shashwat Khandelwal, Shanker ShreejithNetwork Intrusion DetectionUnsupervised Anomaly Detection

    Trinity College Dublin, Ireland

  3. MIDS: Detecting Stealthy Masquerade and Tampering Attacks on CAN Bus via Bidirectional Mamba

    Jun 17, 2026Qiqi Liu, Runhan Song, Lei Cui +3Network Intrusion Detection

    Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China · School of Cyber Security, University of Chinese Academy of Sciences, Beijing 100049, China · Zhongguancun Laboratory, Beijing, China