Lightweight neural network distillation for real-time CAN bus intrusion detection in vehicles
Citations
Altmetric:
Other Names
Location
Time Period
Advisors
Original Date
Digitization Date
Issue Date
2026-06-16
Type
Conference paper
Genre
Keywords
Automotive security,CAN bus,Decision trees,Intrusion detection system,Neural networks
Subjects (LCSH)
Citation
A. Pourmiri, A. Eslami and S. S. Monroy, "Lightweight Neural Network Distillation for Real-Time CAN Bus Intrusion Detection in Vehicles," 2026 IEEE Wireless Communications and Networking Conference (WCNC), Kuala Lumpur, Malaysia, 2026, pp. 1-6, doi: 10.1109/WCNC65185.2026.11555325.
Abstract
The Controller Area Network (CAN) bus is widely used for communication between vehicle components but has no built-in encryption or authentication. This makes it easy for attackers to carry out spoofing or denial-of-service attacks. In this paper, we present a lightweight Intrusion Detection System (IDS) that can run on a small Electronic Control Unit (ECU) built with a Raspberry Pi. Our system listens to CAN traffic and classifies frames using machine learning models such as Convolutional Neural Networks (CNN), Artificial Neural Networks (ANN), and Long Short-Term Memory (LSTM). The models are trained on labeled datasets stored in HDF format for efficiency. To make the models easier to understand and deploy, they are converted into decision trees using the Trustee framework and run in C++ for real-time use. Tests on a simulated CAN bus with Arduino boards show that the IDS can detect attacks with high accuracy: 93LSTM, and overall more than 99.9using only 0.5Source code is available at:: //github.com/AmirmasoudPourmiri/Resource-Constrained-Machine-Learning-BasedIntrusion-Detection-for-CAN-Communication
Table of Contents
Description
Click on the DOI link to access this article at the publishers website (may not be free).
Publisher
Institute of Electrical and Electronics Engineers
Journal
Book Title
Series
Digital Collection
Finding Aid URL
Use and Reproduction
Archival Collection
PubMed ID
DOI
ISSN
15253511