On the Real-World Applicability of Automotive CAN Intrusion Detection Systems
summary
Analyzes five widely used CAN datasets, trains interpretable decision trees, and tests against an on-bus attacker that can observe, inject, replay, spoof, and fuzz frames. Finds many datasets use static attack patterns (e.g. CAN ID 000 with all-zero payload), incomplete benign coverage, severe class imbalance, and recording-boundary artifacts, so trees learn dataset shortcuts rather than semantics. Shows high F1 often reflects these artifacts, not robustness, and argues for per-frame binary detection extensions to signal/window-based, DBC-aware and multi-bus evaluations.
AI-written summary · about
chapters (7)
- 0:00CAN intrusion detection research
- 1:14Near-perfect detection rates in CAN IDS
- 3:00CAN intrusion datasets analysis
- 7:39Decision tree for attack detection
- 9:27Attacker model and practical limits
- 10:10Limitations and future research
- 11:35Conclusion on practical security
related talks
18mModels on the Move: Towards Feasible Embedded AI for Intrusion Detection on...
16mCANdid - An Open-Access Annotated Dataset of Vehicle CAN Bus Traffic
58mA Survey of Remote Automotive Attack Surfaces
41mIt's easier to break than to patch: a stealthy DoS attack on CAN
09mLightning Talk: On-Road Driver Identification Dataset with CyberAttack
30mFingerprinting Electronic Control Units for Vehicle Intrusion Detection
36mCar Hacking
11mWIP: Intrusion Detection and Localization for CAN by Extracting Propagation Delay..