[Paper Review] CANShield: Deep Learning-Based Intrusion Detection Framework for Controller Area Networks at the Signal-Level

Md Hasan Shahriar, Yang Xiao+3 more|arXiv (Cornell University)|May 3, 2022

Vehicular Ad Hoc Networks (VANETs)4 citations

TL;DR

CANShield is a deep learning-based intrusion detection framework that analyzes CAN bus traffic at the signal level using multiple convolutional autoencoders (CAEs) across different temporal scales. By fusing reconstruction losses through a three-step analysis and ensemble decision-making, it achieves 6.40% higher AUROC than conventional methods, significantly improving detection of advanced, stealthy attacks like masquerade and suppression attacks on high-fidelity datasets.

ABSTRACT

Modern vehicles rely on a fleet of electronic control units (ECUs) connected through controller area network (CAN) buses for critical vehicular control. With the expansion of advanced connectivity features in automobiles and the elevated risks of internal system exposure, the CAN bus is increasingly prone to intrusions and injection attacks. As ordinary injection attacks disrupt the typical timing properties of the CAN data stream, rule-based intrusion detection systems (IDS) can easily detect them. However, advanced attackers can inject false data to the signal/semantic level, while looking innocuous by the pattern/frequency of the CAN messages. The rule-based IDS, as well as the anomaly-based IDS, are built merely on the sequence of CAN messages IDs or just the binary payload data and are less effective in detecting such attacks. Therefore, to detect such intelligent attacks, we propose CANShield, a deep learning-based signal-level intrusion detection framework for the CAN bus. CANShield consists of three modules: a data preprocessing module that handles the high-dimensional CAN data stream at the signal level and parses them into time series suitable for a deep learning model; a data analyzer module consisting of multiple deep autoencoder (AE) networks, each analyzing the time-series data from a different temporal scale and granularity, and finally an attack detection module that uses an ensemble method to make the final decision. Evaluation results on two high-fidelity signal-based CAN attack datasets show the high accuracy and responsiveness of CANShield in detecting advanced intrusion attacks.

Motivation & Objective

• Address the growing vulnerability of CAN buses to advanced, stealthy cyberattacks that evade traditional rule-based and anomaly-based IDSs.
• Overcome the limitations of existing IDSs that analyze CAN messages solely by ID or payload, ignoring semantic and temporal signal correlations.
• Develop a scalable, signal-level intrusion detection system capable of detecting sophisticated attacks such as masquerade, fabrication, and suspension attacks.
• Improve detection accuracy and responsiveness by leveraging multi-scale temporal analysis and ensemble fusion of reconstruction errors.
• Provide a practical, efficient solution suitable for real-world vehicles with high-dimensional, complex CAN signal streams.

Proposed method

• Preprocess raw CAN data by parsing high-dimensional message streams into time-series signal representations at the signal level, extracting meaningful sensor values.
• Train multiple convolutional autoencoders (CAEs) on different temporal scales and granularities to model normal signal behavior across diverse time windows.
• Perform a three-step structural analysis of reconstruction losses from each CAE to detect subtle anomalies that deviate from normal signal patterns.
• Aggregate individual anomaly scores using an ensemble method that combines multi-scale reconstructions to improve robustness and reduce inference variance.
• Use a final decision module that computes a unified anomaly score based on the fused reconstruction errors, enabling real-time detection of advanced attacks.
• Leverage signal-level correlations across ECUs rather than treating CAN IDs in isolation, enabling detection of coordinated or correlated attacks.

Experimental results

Research questions

• RQ1 Can a signal-level deep learning-based IDS detect advanced attacks that manipulate payload values while preserving normal message ID frequency and timing?
• RQ2 How does multi-scale temporal analysis of signal-level data improve detection performance compared to single-scale models?
• RQ3 To what extent does a three-step reconstruction loss analysis outperform conventional mean-average aggregation in identifying subtle anomalies?
• RQ4 Can an ensemble of CAEs trained on different temporal granularities reduce variance and improve AUROC in intrusion detection on real-world CAN datasets?
• RQ5 How does CANShield perform against practical, sophisticated attacks such as fabrication, suspension, and masquerade attacks compared to state-of-the-art baselines?

Key findings

• CANShield achieves a 6.40% improvement in AUROC over conventional mean-average reconstruction loss aggregation methods through its three-step structural analysis of reconstruction errors.
• The integration of multi-scale signal representations reduces inference variance and increases AUROC by at least 2.19% compared to any single-scale CAE-based framework.
• CANShield outperforms all evaluated baselines in detecting fabrication and suspension attacks, which are particularly challenging due to their subtle, protocol-compliant behavior.
• The framework demonstrates strong performance on two high-fidelity signal-based CAN attack datasets—SynCAN and ROAD—confirming its robustness and responsiveness in real-world scenarios.
• By modeling signal-level correlations across ECUs, CANShield successfully detects coordinated attacks that single-ID or payload-only models fail to identify.
• The ensemble-based decision mechanism enables high detection accuracy while maintaining scalability for vehicles with numerous CAN IDs and complex signal interactions.