Deep Defence on Wheels: A Dual Intrusion Detection System Architecture for Comprehensive In-Vehicle Network Security

Shashwat Khandelwal; Shanker Shreejith

cs.CROct 5, 2026

Deep Defence on Wheels: A Dual Intrusion Detection System Architecture for Comprehensive In-Vehicle Network Security

Authors: Shashwat Khandelwal, Shanker Shreejith

Organizations: Trinity College Dublin, Ireland

Abstract

Increasing connectivity to the outside world and the lack of inbuilt security mechanisms have made legacy intra-vehicular networks vulnerable to cyberattacks. Initial research focused on maximising detection accuracy for known and unknown attacks, often using large, full-precision machine learning models. However, embedding IDSs into vehicular electronic systems also requires low detection latency, energy efficiency and minimal electronic control unit (ECU) resource overhead to process about 2,000 CAN frames/s. Lightweight models must balance accuracy with these deployment constraints. We propose a dual IDS framework comprising supervised and unsupervised learning-based solutions, each optimised for real-time, resource-constrained automotive platforms. A quantised LSTM-based IDS (QLSTM-IDS) achieves over 99.9% detection accuracy for DoS/Flooding, Fuzzing and Spoofing/Malfunction attacks using a single model architecture evaluated on two widely used datasets. The model is trained using the Brevitas quantisation-aware training library, transformed into a dataflow accelerator with custom blocks compatible with AMD's FINN toolchain, and synthesised using Vitis HLS. Complementing this, an 8-bit quantised convolutional autoencoder-based IDS (QCAE-IDS), quantised using AMD's Vitis-AI toolchain, detects previously unseen anomalies that alter CAN-ID sequence patterns with over 99% accuracy. An integration architecture enables both models to operate on a single FPGA, bridging the network interface IP and processing system to minimise software overhead. QLSTM-IDS achieves 0.25 ms inference latency and 0.8 mJ energy consumption per message, while QCAE-IDS achieves 0.42 ms and 1.1 mJ per block. Both solutions are deployed and evaluated on the ZCU104 SoC (XCZU7EV FPGA), demonstrating a flexible hardware/software co-design for real-time detection of known and unknown attacks on high-speed CAN buses.

Figures & tables

Figure 1 . Frame format of an extended frame CAN message. In case of a standard CAN message, the ID field contains the 29-bit identifier.

Figure 2 . The figure shows the network architecture of the proposed LSTM-IDS. The CAN input is packed into 20 uint4 values as the input to the LSTM layer. The classified outputs are packed into a byte-wide data.

Panel of Figure 3 — Figure 3 . The figure illustrates the average training and validation loss curves for the QLSTM-IDS during its training for different activation precisions using the car hacking dataset. To better highlight the differences, the figure provides a magnified view of epochs 5 to 50.

Panel of Figure 4 — Figure 4 . The figure illustrates the average training and validation loss curves for the QLSTM-IDS during its training on the four attack datasets from the car hacking and survival analysis (SA) datasets.

Figure 5 . The proposed convolutional autoencoder model architecture for CAN-ID sequence anomaly detection IDS. ‘n’ denotes the window size of the input feature used for attack detection. The proposed model uses

n=100

in this paper.

Figure 6 . Floating-point CAE threshold calibration and test-set sensitivity for the Sonata subset. (a) Correctly classified benign calibration blocks out of 150, with a selected threshold of 68. (b) Correctly classified blocks across thresholds for the Flooding, Fuzzing, and Malfunction test sequences. The dashed line marks the threshold determined exclusively from benign calibration data; test-set results did not inform its selection. Zero calibration false positives do not constitute an independent test result.

Figure 7 . Floating-point CAE threshold calibration and test-set sensitivity for the Spark subset. (a) Correctly classified benign calibration blocks out of 150, with a selected threshold of 49. (b) Correctly classified blocks across thresholds for the Flooding, Fuzzing, and Malfunction test sequences, containing 1,000, 650, and 790 blocks, respectively. The dashed line marks the threshold determined exclusively from benign calibration data; test-set results did not inform its selection. Zero calibration false positives do not constitute an independent test result.

Figure 8 . The figure illustrates the ECU architecture modelled on a Zynq Ultrascale+ hybrid SoC and the path of a CAN message upon reception in this architecture. In this architecture, the processing system (PS) functions as the ECU, executing automotive applications. The blue arrows indicate the path taken by the CAN message from the CAN bus to the software tasks on the PS. The IDS processing is integrated within the programmable logic (PL) section of the XCZU7EV device. The IDSs can receive the CAN message directly from the controller (at the same instance as it is read by the PS) or forwarded by the PS. We use a multiplexer to control this at run-time, with the select line connected to an external peripheral on the board.

Attack	Model	Precision	Recall	F1	FNR
Attack	Model	(%)	(%)	(%)	(%)
DoS	DCNN ( Song et al., 2020 )	100	99.89	99.95	0.13
	NovelADS ( Agrawal et al., 2022 )	99.97	99.91	99.94	-
	TCAN-IDS ( Cheng et al., 2022 )	100	99.97	99.98	-
	GRU ( Ma et al., 2022 )	99.93	99.91	99.92	-
	BIDS ( Rangsikunpum et al., 2024 )	99.50	97.73	98.63	-

Table 2 . Accuracy metric comparison (%) of our QLSTM-IDS accelerator against the reported literature on the DoS, Fuzzing & Spoofing (RPM & Gear) attacks for car hacking dataset.

Panel of Figure 9 — Figure 9 . Confusion matrices for QLSTM-IDS classification results on the car hacking and survival analysis datasets. (Sonata, Soul, and Spark models)

Model Prec. Recall F1 XGBoost ( Anjum et al., 2022 ) 100 90 94.74 RF ( Santa Barletta et al., 2024 ) 100 100 100 G-IDCS ( Park et al., 2023 ) 99.73 99.72 99.72 LSTM ( Hossain et al., 2020 ) - 100 100 QLSTM-IDS 100 100 100 (a) Sonata - Flooding	Model Prec. Recall F1 XGBoost ( Anjum et al., 2022 ) 100 90 94.74 RF ( Santa Barletta et al., 2024 ) 100 100 100 LSTM ( Hossain et al., 2020 ) - 100 100 G-IDCS ( Park et al., 2023 ) 96.92 99.74 98.31 QLSTM-IDS 100 100 100 (b) Soul - Flooding	Model Prec. Recall F1 XGBoost ( Anjum et al., 2022 ) 100 90 94.74 RF ( Santa Barletta et al., 2024 ) 100 100 100 LSTM ( Hossain et al., 2020 ) - 100 100 G-IDCS ( Park et al., 2023 ) 99.65 100 99.83 QLSTM-IDS 100 100 100 (c) Spark - Flooding
Model Prec. Recall F1 XGBoost ( Anjum et al., 2022 ) 99.98 99.08 99.53 RF ( Santa Barletta et al., 2024 ) 99.79 99.93 99.86 G-IDCS ( Park et al., 2023 ) 100 100 100 LSTM ( Hossain et al., 2020 ) - 99.95 99.96 QLSTM-IDS 99.87 99.98 99.93 (d) Sonata - Fuzzing	Model Prec. Recall F1 XGBoost ( Anjum et al., 2022 ) 99.99 99.58 99.78 RF ( Santa Barletta et al., 2024 ) 99.79 99.93 99.86 LSTM ( Hossain et al., 2020 ) - 94.69 97.01 G-IDCS ( Park et al., 2023 ) 100 99.84 99.92 QLSTM-IDS 99.21 100 99.60 (e) Soul - Fuzzing	Model Prec. Recall F1 XGBoost ( Anjum et al., 2022 ) 97.34 92 94.6 RF ( Santa Barletta et al., 2024 ) 99.79 99.93 99.86 LSTM ( Hossain et al., 2020 ) - 98.23 98.31 G-IDCS ( Park et al., 2023 ) 98.92 100 99.46 QLSTM-IDS 98.24 92.20 95.13 (f) Spark - Fuzzing
Model Prec. Recall F1 XGBoost ( Anjum et al., 2022 ) 99.92 100 99.96 RF ( Santa Barletta et al., 2024 ) 99.90 99.98 99.94 G-IDCS ( Park et al., 2023 ) 100 99.64 99.82 LSTM ( Hossain et al., 2020 ) - 100 100 QLSTM-IDS 100 100 100 (g) Sonata - Malfunction	Model Prec. Recall F1 XGBoost ( Anjum et al., 2022 ) 100 93.22 96.49 RF ( Santa Barletta et al., 2024 ) 99.90 99.98 99.94 LSTM ( Hossain et al., 2020 ) - 96.97 90.87 G-IDCS ( Park et al., 2023 ) 95.92 99.03 97.45 QLSTM-IDS 100 100 100 (h) Soul - Malfunction	Model Prec. Recall F1 XGBoost ( Anjum et al., 2022 ) 99.80 100 99.90 RF ( Santa Barletta et al., 2024 ) 99.90 99.98 99.94 LSTM ( Hossain et al., 2020 ) - 100 100 G-IDCS ( Park et al., 2023 ) 99.36 100 99.68 QLSTM-IDS 100 100 100 (i) Spark - Malfunction

Table 3 . Performance metric comparison of QLSTM-IDS across different attacks for Sonata (left), Soul (middle), and Spark (right) datasets.

Subset	Attack	Model	Precision	Recall	F1
Sonata	Flooding	Pre-Q	100	99.28	99.64
	Flooding	QCAE-SA	100	99.28	99.64
	Fuzzy	Pre-Q	100	99.5	99.75
	Fuzzy	QCAE-SA	100	99.5	99.75
	Malfunction	Pre-Q	100	96.8	98.37
	Malfunction	QCAE-SA	100	94.24	97.04

Table 4 . Accuracy metric comparison (%) of our QCAE-IDS accelerator pre- and post-quantisation on the Sonata and Spark subsets of the SA dataset.

Attack	Message Type	Pred. N	Pred. A
Flooding	True N	585	0
Flooding	True A	3	412
Fuzzy	True N	606	0
Fuzzy	True A	2	392
Malfunction	True N	594	0
Malfunction	True A	24	393

Table 5 . Confusion matrix capturing the classification results of the QCAE-SA on the Flooding, Fuzzing, and Malfunction attacks for the SA dataset (Sonata & Spark). (Note the model is trained only on benign messages and does not see any attack message during the training phase.)

Table 14

Models	Latency	Frames	Platform
GRU ( Ma et al., 2022 )	890 ms	5000 CAN frames	Jetson Xavier NX
MLIDS ( Desta et al., 2020 )	275 ms	per CAN frame	GTX Titan X
NovelADS ( Agrawal et al., 2022 )	128.7 ms	100 CAN frames	Jetson Nano
TAN-IDS ( Nguyen et al., 2023 )	11.6 ms	128 CAN frames	-
DCNN ( Song et al., 2020 )	5 ms	29 CAN frames	Tesla K80
TCAN-IDS ( Cheng et al., 2022 )	3.4 ms	64 CAN frames	Jetson AGX

Table 8 . Detection latency comparison of the proposed IDS against other state-of-the-art IDSs reported in literature.

Function	LUTs (%)	FFs (%)	LUTRAM (%)	BRAMs (%)	DSPs (%)
QLSTM-IDS	40902 (17.75)	11234 (2.44)	4669 (4.59)	23.5 (7.53)	12 (0.69)
QCAE-IDS	39956 (17.34)	51957 (11.1)	-	50 (16.51)	125 (7.18)
CAN-NC	887 (0.38)	625 (0.14)	18 (0.02)	-	-
Overall	81745 (35.47)	63816 (13.68)	4687 (4.61)	73.5 (24.04)	137 (7.87)

Table 9 . The resource consumption overheads of QLSTM-IDS, the QCAE-IDS and the CAN Controller on the PL region of the Zynq XCZU7EV SoC.

Model	Latency (ms)	% Resource Utilisation					Power (W)
Model		LUT	FF	DSP	BRAM	URAM	Idle	Active
QCAE-CH (B4096)	0.43	27.17	25.03	40.74	35.42	47.92	4.36	4.89
QCAE-IDS (B512)	0.42	17.34	11.10	7.18	16.51	12.5	2.61	3.11

Table 10 . Performance comparison of the QCAE-CH & the proposed QCAE-IDS model based on per message latency (ms), resource (%), & power consumption (W).

Model	LUTs	FFs	BRAM (Mb)	Energy (mJ)	Misclassifications
QMLP ( Khandelwal and Shreejith, 2022a )	56,733 (24.6%)	72,147 (15.6%)	3.06	1.96	75/200,000
CQMLP ( Khandelwal and Shreejith, 2023a )	3999 (1.74%)	4524 (0.98%)	0.84	0.23	147/180,000
BIDS ( Rangsikunpum et al., 2024 )	23,256 (10.09%)	37,943 (8.2%)	4.07	0.35	70/187,062
QLSTM-IDS	40,902 (17.75%)	11,234 (2.44%)	0.82	0.8	11/620,200
QCAE-IDS	39,956 (17.34%)	51,957 (11.1%)	1.74	1.1	29/3011

Table 11 . This table compares the proposed QLSTM-IDS and QCAE-IDS with other QNN models from the research literature, evaluating them in terms of resource utilization, energy consumption, and overall misclassification rates as reported on the car hacking dataset. The accuracy number for the QCAE-IDS are reported on the Sonata subset of the survival analysis dataset.

Explore similar work

Apr 22, 2026cs.CR

DAIRE: A lightweight AI model for real-time detection of Controller Area Network attacks in the Internet of Vehicles

The Internet of Vehicles (IoV) is advancing modern transportation by improving safety, efficiency, and intelligence. However, the reliance on the Controller Area Network (CAN) introduces critical security risks, as CAN-based communication is highly vulnerable to cyberattacks. Addressing this challenge, we propose DAIRE (Detecting Attacks in IoV in REal-time), a lightweight machine learning framework designed for real-time detection and classification of CAN attacks. DAIRE is built on a lightweight artificial neural network (ANN) where each layer contains Ni = i x c neurons, with Ni representing the number of neurons in the ith layer and c corresponding to the total number of attack classes. Other hyperparameters are determined empirically to ensure real-time operation. To support the detection and classification of various IoV attacks, such as Denial-of-Service, Fuzzy, and Spoofing, DAIRE employs the sparse categorical cross-entropy loss function and root mean square propagation for loss minimization. In contrast to more resource-intensive architectures, DAIRE leverages a lightweight ANN to reduce computational demands while still delivering strong performance. Experimental results on the CICIoV2024 and Car-Hacking datasets demonstrate DAIRE's effectiveness, achieving an average detection rate of 99.88%, a false positive rate of 0.02%, and an overall accuracy of 99.96%. Furthermore, DAIRE significantly outperforms state-of-the-art approaches in inference speed, with a classification time of just 0.03 ms per sample. These results highlight DAIRE's effectiveness in detecting IoV cyberattacks and its practical suitability for real-time deployment in vehicular systems, underscoring its vital role in strengthening automotive cybersecurity.

Shahid Alam, Amina Jameel, Zahida Parveen +4

Department of Information Security, College of Computer Science and Engineering, University of Ha’il, Ha’il, Saudi Arabia · Department of Computer Engineering, Center of Excellence in Artificial Intelligence, Bahria University, Islamabad, Pakistan · Department of Artificial Intelligence, College of Computer Science and Engineering, University of Ha’il, Ha’il, Saudi Arabia +2

Automotive Detection Cybersecurity Cyberattacks

Ask PDF

Jun 17, 2026cs.CR

MIDS: Detecting Stealthy Masquerade and Tampering Attacks on CAN Bus via Bidirectional Mamba

The Controller Area Network (CAN) protocol is the primary communication standard for Electronic Control Units (ECUs) in modern vehicles, but its lack of encryption and authentication exposes it to a range of security threats. Existing intrusion detection systems are largely tuned to fabrication-style attacks (DoS, fuzzing, ID spoofing realised by frame injection), in which detection signals such as per-ID inter-arrival statistics are readily available. We instead address the harder \emph{masquerade} setting~\cite{b37}, in which an internal adversary substitutes a legitimate frame in-situ at its original transmission slot, preserving traffic periodicity and rendering traffic-statistic defences ineffective. We propose the Mamba Intrusion Detection System (MIDS), an innovative dual-stream framework that processes CAN identifiers and payloads in parallel and reconstructs their joint temporal semantics through bidirectional selective state-space modelling. To evaluate MIDS, we collected over 100 million CAN frames from a physical Tesla Model 3 across three driving regimes and synthesised 54 masquerade attack variants spanning ID-only, data-only, and combined modifications. MIDS attains an F1 of 96.94% on this dataset, exceeding the strongest reproducible baseline by more than 8 percentage points, while sustaining a 1.147~ms single-window inference latency -- ample headroom for real-time onboard deployment. To verify generalisation, we further evaluate MIDS on four public benchmarks (ROAD, CrySyS, OTIDS, CT&T) covering both masquerade and injection scenarios; MIDS attains F1 from 93.70% to 99.61%, outperforming the strongest of eight reproduced baselines by up to 13.94 percentage points under a unified 5-fold protocol.

Qiqi Liu, Runhan Song, Lei Cui +3

Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China · School of Cyber Security, University of Chinese Academy of Sciences, Beijing 100049, China · Zhongguancun Laboratory, Beijing, China

Intrusion Detection Mamba-Based Models Dual-Stream

Ask PDF

Aug 6, 2026cs.CR

Behavioral Residualization for Unsupervised Intrusion Detection in Automotive CAN Networks

Modern vehicles rely on the Controller Area Network (CAN) bus, whose design prioritizes low cost and real-time performance but provides no message authentication or encryption. An attacker with physical or remote access can therefore inject arbitrary frames, making intrusion detection an important defense-in-depth mechanism. Most published CAN intrusion detection systems rely on presence-based features, such as novel arbitration IDs, frozen payload bytes, or anomalous DLC values. These features perform well on public datasets containing easily separable attacks but fail when attackers reuse legitimate arbitration IDs. We present per-ID behavioral residualization, a CAN-specific representation that extracts fourteen temporal, protocol, and payload features from sliding windows and residualizes them against each arbitration ID's normal baseline. Our central claim is that this representation, rather than any individual detector, drives the performance gains. Across six unsupervised detectors and two datasets, residualization improves mean F1 in the majority of evaluations (21/24 on HCRL and 30/36 on ROAD across five seeds). On the more realistic ROAD dataset, where attacks reuse legitimate IDs, the representation achieves recall >= 0.99 with high ROC-AUC on targeted signal-manipulation attacks. Two limitations are explicitly quantified: novel-ID flooding (HCRL DoS, F1 = 0.02) and cross-ID fuzzing (ROAD, F1 = 0.27), defining the measured coverage boundary of the proposed representation.

Chandan Hegde, Mukundh R Reddy

Intrusion Detection LLM Defense Mechanisms Mechanics

Ask PDF