Pith. sign in

REVIEW 3 major objections 5 minor 48 references

Assessing the Resilience of Automotive Intrusion Detection Systems to Adversarial Manipulation

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Gradient-based evasion attacks can cut the true positive rate of automotive intrusion detection systems by up to 60% on one dataset and 85% on another, with effectiveness depending on attacker knowledge, dataset, and detector architecture.

desk verdict Solid, well-scoped extension of the authors' prior work; the black-box realism claim is strained by same-vehicle simulation, but the central finding holds. read the letter →

arxiv 2506.10620 v1 pith:W4FGKPQF submitted 2025-06-12 cs.CR cs.LG

Stefano Longari , Paolo Cerracchio , Michele Carminati , Stefano Zanero This is my paper
classification cs.CRcs.LG
keywords CANbusautomotiveintrusiondetectionadversarialevasionattacksDeepFooltransferabilityblack-boxpayload-basedIDSvehiclesecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tests whether an attacker who has gained a foothold on a car's controller area network (CAN bus) can tweak the packets of a malicious injection so that machine-learning intrusion detection systems (IDSs) no longer flag them. The central claim is that such evasion is feasible but highly uneven: with full knowledge of the detector, the true positive rate drops by up to 60% on the ReCAN dataset and 85% on the CarHacking dataset, while grey- and black-box attackers still achieve drops up to 39% and 43%. The paper argues that the outcome depends on dataset quality, the target IDS architecture, and the attacker's degree of knowledge, and that the attempt can sometimes backfire by making attacks more conspicuous. A sympathetic reader would care because CAN-bus IDSs are a main defense against cyberattacks on modern vehicles, and this work maps when that defense silently fails.

What carries the argument

The load-bearing mechanism is the adaptation of gradient-based perturbation algorithms—two variants of the Basic Iterative Method (a step-decay and an L2-normalized version) and DeepFool—to payload-based CAN IDSs. The attacker starts from a recorded attack sequence and iteratively adjusts the physical signals in the packets, restricted to normalized ranges and rounded back to bit-level values, so the perturbed packet stays a valid CAN frame. A tamper mask restricts perturbations to the injected packets within a sliding window, and in black-box settings the gradients come from a surrogate oracle rather than the target model. A second mechanism is the signal-semantic preprocessing based on the READ heuristic, which identifies which bit ranges are physical values, counters, binaries, or CRCs, so perturbations act on meaningful fields. The paper also uses an aggregate perturbation metric and a precomputation experiment that finds reinjection points by matching preambles in the traffic.

What would settle it

Train the same six IDS architectures on CAN traffic from one vehicle and the surrogate oracle on traffic from a different vehicle of the same model, then run the DeepFool black-box attack; if the true positive rate drop falls substantially below the reported 43%, the paper's black-box numbers overstate the realistic threat.

Watch

Extended reading notes

Core claim

The paper's central discovery is that gradient-based adversarial evasion transfers from computer vision to the automotive domain, but with strong conditioning on the setting. White-box attacks are the most effective, with DeepFool alone producing detection-rate losses exceeding 50% on the ReCAN dataset and up to 85% on CarHacking, while the BIM variants are largely ineffective on CarHacking. In grey- and black-box scenarios, where the attacker uses a surrogate model trained on the same or a separate dataset, the average recall drop falls to roughly 10% or less, yet certain combinations still reach 39-43%. Autoencoder-based detectors, especially CANdito, prove the most resistant and the worst oracles; predictor-based models are the best oracles. The paper also finds that successful evasion sometimes destroys the attack's semantic goal by pulling the signal toward normal behavior, and that fully evasive sequences can often be precomputed and reinjected at matching points in the bus traffic.

Load-bearing premise

The black-box threat model assumes that a surrogate model trained on a disjoint slice of the same dataset behaves like a surrogate trained on data from a different but similar vehicle, so the 43% black-box figure rests on within-dataset transferability holding across vehicles.

Editorial extensions

If this is right

  • A white-box attacker can degrade an IDS's true positive rate by up to 60 percentage points on ReCAN and 85 percentage points on CarHacking, so any deployment that assumes a fully knowledgeable insider is brittle.
  • DeepFool is the most effective and transferable algorithm; BIM-style attacks are dataset-dependent and largely fail on the CarHacking dataset.
  • Autoencoder IDSs such as CANdito are more resistant to evasion and less useful as attack oracles, suggesting architecture choice matters more than dataset choice for robustness.
  • Grey- and black-box evasion is possible but weaker, with success strongly dependent on the surrogate's training data, so defenders should treat data leakage as a first-order risk.
  • Fully evasive sequences can be precomputed and reinjected at many later points for slowly varying signals, meaning real-time computation may not be a barrier.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The black-box scenario is simulated by splitting one dataset; if surrogate and target are trained on genuinely different vehicles, transferability may be materially worse, which would lower the realistic ceiling below the reported 43%.
  • Because the paper shows that perturbations sometimes push signals back toward normal behavior, evasion success should not be equated with attack impact; a natural next experiment is to measure physical effect on a hardware-in-the-loop bench.
  • The reported resistance of CANdito suggests a concrete design rule for defenders: prefer window-reconstruction autoencoders over single-packet or predictor models, and treat predictor-based oracles as the strongest attack engine.
  • The precomputation results imply that defenders should consider input smoothing or adversarial training, but also that such defenses may raise false positives in safety-critical settings, so their deployment needs a tolerance study.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies evasion attacks against payload-based automotive intrusion detection systems under white-box, grey-box, and black-box attacker models. It adapts BIM and DeepFool gradient-based algorithms to the CAN domain, evaluates six IDS architectures (FFNN, CANdito, short/long LSTM, short/long GRU) on the ReCAN and CarHacking datasets, and reports true-positive-rate degradation plus an aggregate perturbation metric. It also provides a qualitative analysis of attack-intent preservation and a precomputation study for real-time injection. The central claim is that evasion effectiveness depends strongly on dataset quality, the target IDS, and the attacker's degree of knowledge, with white-box attacks being the most effective.

Significance. If the results hold, the paper provides a useful systematic comparison of adversarial evasion in automotive IDSs, covering three attacker knowledge levels, six model architectures, and two public datasets. Strengths include the use of public real-world CAN traces, a wide evaluation matrix, and the explicit treatment of domain constraints such as bit-level rounding and temporal coherence. The finding that autoencoder-based detectors (especially CANdito) are more resistant and that predictor models are better oracles is interesting and practically relevant. However, the novelty is centered on the black-box scenario, and that scenario is currently simulated with same-vehicle data splits, which materially limits the generality of the headline numbers; the absence of uncertainty quantification further weakens comparative claims.

major comments (3)
  1. [§4, §7.2.1, §7.4.4] The black-box threat model is not faithfully implemented. Section 4 defines the black-box attacker as training a surrogate on 'a separate but compatible dataset, which could realistically be collected from a similar vehicle,' but Section 7.2.1 states that in black-box settings 'oracles and IDSs are trained on separate sequences' of the same ReCAN/CarHacking corpus. This means the surrogate and target share the same vehicle, the same recording session, and the same READ-based bit-field segmentation and normalization. Since adversarial transferability is known to be sensitive to distribution shift, the reported black-box TPR reductions (e.g., Table 6, Long LSTM DeepFool, -42.05%; Table 9, FFNN DeepFool, -85.02%) may substantially overestimate what an attacker with data from a genuinely different vehicle could achieve. A concrete test would be to train the surrogate on a different recording session or on data from a different vehicle and report the resulting transfer rate; in the absence of such a test, the paper should explicitly reframe the black-box results as same-vehicle transfer and soften the 'more realistic' claim.
  2. [§1, Tables 9 and 11] The headline results in the introduction are not consistent with the tables. Section 1 states that grey- and black-box attacks reduce TPR by up to 39% and 43%, respectively, but Table 9's black-box panel reports a DeepFool attack with an FFNN oracle reducing TPR by 85.02% on the CarHacking RPM spoofing attack, and Table 11 reports an average black-box DeepFool delta of only -10.41%. The 'up to' figures in Section 1 are not traceable to the reported tables; the authors should specify the exact scenario (dataset, attack, target IDS, oracle, and whether the value is a single cell or an average) for each headline number and correct the inconsistency.
  3. [§7.1–§7.4] All TPR values are point estimates averaged over CAN IDs, with no standard deviations, confidence intervals, or significance tests. Many grey/black-box deltas are fractions of a percent (e.g., entries like -0.12% and +0.07% in Tables 4–8), and even the larger differences may be within run-to-run variability. Without uncertainty quantification, the paper cannot support comparative statements such as the claim in Section 7.4.4 that 'the identical architecture does not appear to provide a noticeable increase in evasion capabilities' or the ordering of oracle effectiveness in Table 12. I recommend reporting per-ID variance or bootstrap intervals for at least the aggregate tables.
minor comments (5)
  1. [§6.1, Algorithms 1–3] The pseudocode applies the perturbation through a 'tamper_mask' variable that is never defined in the text or captions; please define what fields it masks and how it is constructed.
  2. [§7.5] Experiment 2 is described as a qualitative assessment based on a few plots; since one of the paper's contributions is evaluating the impact of perturbations on attack intent, consider adding a quantitative semantic-distance metric or explicitly restricting the claim to the qualitative cases shown.
  3. [Throughout] There are several typos and inconsistent spellings: 'incurrs' (Section 2), 'atptepts' (Section 6), 'effectivness' (Section 7.5), and inconsistent 'CARHacking'/'CarHacking' capitalization across the abstract and body.
  4. [§6.1, Eq. (1)] The notation 'clip_X' in Equation (1) uses X without a prior definition; clarify that X denotes the domain of valid samples.
  5. [Table 3 and §7.4.1] The table caption says 'Recall' while the text interchangeably uses 'TPR'; unify the terminology for consistency.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper reports empirical measurements; the black-box simulation uses a same-dataset split, which is a stated approximation, not a definitional or fitted reduction.

full rationale

The paper derives no formal results; it reports measurements of adversarial evasion on two public datasets. The central quantities (white-box TPR reduction up to 60% on ReCAN and 85% on CarHacking; grey- and black-box reductions up to 39% and 43%) are computed by running gradient-based attacks against independently trained IDS models and measuring TPR on a test set; no parameter is fitted to the reported outcome and no equation is defined in terms of the target result. The black-box threat model (Section 4) describes a surrogate trained on “a separate but compatible dataset, which could realistically be collected from a similar vehicle,” while Section 7.2.1 implements “this scenario … by splitting the dataset into two disjoint subsets.” This is a stated approximation and a potential overestimate of cross-vehicle transferability, and the paper explicitly acknowledges vehicle-level limitations in Section 8 (“lack of availability of a real test vehicle”), but it is not circular: the split still trains surrogate and target on disjoint data, and the transferability measurement is not forced by construction. The paper’s reliance on the authors’ earlier work [2] for the attack formulation and on their own ReCAN dataset [47] for evaluation is self-citation, but the algorithms are specified in full in Section 6 and the dataset is public and externally used, so the citations are ordinary evidence rather than load-bearing circularity. No step in the paper reduces by definition or by fitted-parameter renaming to its own input.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on a handful of domain assumptions (attacker node control, differentiable IDS score, transferability, correct signal classification) and on several unreported attack and threshold hyperparameters. No new entities are posited. The black-box simulation's use of same-vehicle data is the most consequential assumption.

free parameters (4)
  • Epsilon (step size) for BIM and DeepFool variants = Not reported
    Controls the magnitude of each perturbation step; chosen by hand in the pseudocode (Algorithms 1-3). Values are not given in the paper, and they directly affect the TPR deltas (larger epsilon yields larger perturbations and more evasion, with AP values up to 0.76).
  • Decay factor omega for step-decay BIM = Not reported
    Geometric decay of step size, introduced in Section 6.1; impacts convergence and evasion success, but no value is stated.
  • Max iterations for evasion algorithms = 50 (mentioned for DeepFool in Section 7.6)
    Number of optimization iterations; affects attack success and computation time.
  • IDS anomaly detection threshold = Not reported
    Each IDS classifies by comparing reconstruction or prediction error to a threshold from a non-anomalous set (Section 2). The chosen threshold controls baseline TPR and the difficulty of evasion; exact values are not given.
assumptions (5)
  • domain assumption The attacker controls a node on the CAN bus and can inject or remove packets.
    Section 4 states: 'we assume an attacker with control over a node in the network'. This is standard for CAN security research and is the precondition for all attacks.
  • domain assumption The target IDS anomaly score is differentiable and accessible via gradients.
    Section 6 uses backpropagation against the IDS model; for white-box this is exact, for grey- and black-box the surrogate must approximate it. If the real IDS were non-differentiable (e.g., tree-based), the gradient-based methods would not apply.
  • domain assumption Adversarial examples transfer from a surrogate to the target model.
    Sections 4 and 6 rely on the transferability property, citing Papernot et al. [30]. The black- and grey-box scenarios depend on transferability; the paper's own results show it holds partially.
  • domain assumption The READ-based signal classification correctly identifies physical and binary fields in CAN payloads.
    Preprocessing (Section 6, Table 2) retains only physical and binary fields; constant bits and CRCs are excluded. If this classification is wrong, the perturbation space and the semantics-preservation analysis (Experiment 2) are invalid.
  • domain assumption The threshold used by each IDS is fixed and known to the attacker in the white-box scenario, and approximated in grey- and black-box scenarios via the surrogate.
    The evasion optimization uses the threshold to define the decision boundary (Algorithms 1-3); the DeepFool variant explicitly shifts the anomaly score by the threshold value theta. The paper does not report the thresholds used.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Assessing the Resilience of Automotive Intrusion Detection Systems to Adversarial Manipulation." pith.science (2026). https://pith.science/paper/W4FGKPQF

@misc{pith2026250610620,
  author       = {Pith},
  title        = {Pith review of: Assessing the Resilience of Automotive Intrusion Detection Systems to Adversarial Manipulation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/W4FGKPQF}},
  note         = {Machine review of arXiv:2506.10620}
}
read the original abstract

The security of modern vehicles has become increasingly important, with the controller area network (CAN) bus serving as a critical communication backbone for various Electronic Control Units (ECUs). The absence of robust security measures in CAN, coupled with the increasing connectivity of vehicles, makes them susceptible to cyberattacks. While intrusion detection systems (IDSs) have been developed to counter such threats, they are not foolproof. Adversarial attacks, particularly evasion attacks, can manipulate inputs to bypass detection by IDSs. This paper extends our previous work by investigating the feasibility and impact of gradient-based adversarial attacks performed with different degrees of knowledge against automotive IDSs. We consider three scenarios: white-box (attacker with full system knowledge), grey-box (partial system knowledge), and the more realistic black-box (no knowledge of the IDS' internal workings or data). We evaluate the effectiveness of the proposed attacks against state-of-the-art IDSs on two publicly available datasets. Additionally, we study effect of the adversarial perturbation on the attack impact and evaluate real-time feasibility by precomputing evasive payloads for timed injection based on bus traffic. Our results demonstrate that, besides attacks being challenging due to the automotive domain constraints, their effectiveness is strongly dependent on the dataset quality, the target IDS, and the attacker's degree of knowledge.

Figures

Figures reproduced from arXiv: 2506.10620 by the authors.

Figure 1
Figure 1. Scheme of the attacker’s approach. The attacker controls a node with bus access. Either in real-time or [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Example plots of attack events in various scenarios. In each plot the green line shows the untampered [PITH_FULL_IMAGE:figures/full_fig_p021_2.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

48 extracted references · 36 canonical work pages

  1. [1]

    Malik Avatefipour. [n. d.]. State-of-the-Art Survey on In-Vehicle Network Communication “CAN-Bus” Security and Vulnerabilities. ([n. d.])

    work page

  2. [2]

    Paolo Cerracchio, Stefano Longari, Michele Carminati, Stefano Zanero, et al. 2024. Investigating the Impact of Evasion Attacks Against Automotive Intrusion Detection Systems. InSymposium on Vehicles Security and Privacy (VehicleSec)

    work page 2024

  3. [3]

    Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay. 2018. Adver- sarial Attacks and Defences: A Survey. arXiv:1810.00069 [cs.LG]

    arXiv 2018

  4. [4]

    Zhaomin Chen, Chai Kiat Yeo, Bu Sung Lee, and Chiew Tong Lau. 2018. Autoencoder-based network anomaly detection. In2018 Wireless Telecommunications Symposium (WTS). 1–5. https://doi.org/10.1109/WTS.2018.8363930

    work page arXiv 2018

  5. [5]

    Valliappa Chockalingam, Ian Larson, Daniel Lin, and Spencer Nofzinger. 2016. Detecting attacks on the CAN protocol with machine learning.Annu EECS558, 7 (2016)

    work page 2016

  6. [6]

    Cia. [n. d.].CAN data link layers in some detail. https://www.can-cia.org/can-knowledge/can/can-data-link-layers/

    work page

  7. [7]

    Alvise de Faveri Tron, Stefano Longari, Michele Carminati, Mario Polino, and Stefano Zanero. 2022. CANflict: Exploiting Peripheral Conflicts for Data-Link Layer Attacks on Automotive Networks. InProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS 2022, Los Angeles, CA, USA, November 7-11, 2022, Heng Yin, Angelos Stav...

    arXiv 2022

  8. [8]

    Dorothy E. Denning. 1987. An Intrusion-Detection Model.IEEE Trans. Software Eng.13, 2 (1987), 222–232. https: //doi.org/10.1109/TSE.1987.232894

    work page arXiv 1987

Show all 48 references
  1. [9]

    Eric Evenchick. [n. d.]. CANtact: Open Source Car Tool. https://cantact.io/. Accessed: 2025-03-21

    2025

  2. [11]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. In 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, Yoshua Bengio and Yann LeCu...

    2015 arXiv

  3. [12]

    Chuan Guo, Mayank Rana, Moustapha Cissé, and Laurens van der Maaten. 2017. Countering Adversarial Images using Input Transformations.CoRRabs/1711.00117 (2017). arXiv:1711.00117 http://arxiv.org/abs/1711.00117

    2017 arXiv

  4. [13]

    Markus Hanselmann, Thilo Strauss, Katharina Dormann, and Holger Ulmer. 2020. CANet: An unsupervised intrusion detection system for high dimensional CAN bus data.Ieee Access8 (2020), 58194–58205

    2020

  5. [14]

    Md Delwar Hossain, Hiroyuki Inoue, Hideya Ochiai, Doudou Fall, and Youki Kadobayashi. 2020. An effective in- vehicle CAN bus intrusion detection system using CNN deep learning approach. InGLOBECOM 2020-2020 IEEE Global Communications Conference. IEEE, 1–6

    2020

  6. [15]

    Texas Instruments. 2002. Introductionto the ControllerAreaNetwork(CAN). (2002)

    2002

  7. [16]

    Min-Joo Kang and Je-Won Kang. 2016. Intrusion detection system using deep neural network for in-vehicle network security.PloS one11, 6 (2016), e0155781

    2016

  8. [17]

    Zadid Khan, Mashrur Chowdhury, Mhafuzul Islam, Chin-Ya Huang, and Mizanur Rahman. 2019. Long short-term memory neural networks for false information attack detection in software-defined in-vehicle network.arXiv preprint arXiv:1906.10203(2019)

    2019 arXiv

  9. [18]

    Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. 2018. Adversarial examples in the physical world. InArtificial intelligence safety and security. Chapman and Hall/CRC, 99–112. From 2016 preprint. J. ACM, Vol. 37, No. 4, Article 111. Publication date: August 2018. Assessing t...

    2018

  10. [19]

    Brooke Lampe and Weizhi Meng. 2023. A survey of deep learning-based intrusion detection in automotive applications. Expert Systems with Applications(2023), 119771

    2023

  11. [20]

    Yi Li, Jing Lin, and Kaiqi Xiong. 2021. An adversarial attack defending system for securing in-vehicle networks. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC). IEEE, 1–6

    2021

  12. [21]

    Stefano Longari, Alessandro Nichelini, Carlo Alberto Pozzoli, Michele Carminati, and Stefano Zanero. 2022. CANdito: Improving Payload-based Detection of Attacks on Controller Area Networks.arXiv preprint arXiv:2208.06628(2022)

    2022 arXiv

  13. [22]

    Stefano Longari, Francesco Noseda, Michele Carminati, and Stefano Zanero. 2023. Evaluating the Robustness of Automotive Intrusion Detection Systems Against Evasion Attacks. InInternational Symposium on Cyber Security, Cryptology, and Machine Learning. Springer, 337–352

    2023

  14. [23]

    Stefano Longari, Daniel Humberto Nova Valcarcel, Mattia Zago, Michele Carminati, and Stefano Zanero. 2020. CANnolo: An anomaly detection system based on LSTM autoencoders for controller area network.IEEE Transactions on Network and Service Management18, 2 (2020), 1913–1924

    2020

  15. [24]

    Mirco Marchetti and Dario Stabili. 2018. READ: Reverse Engineering of Automotive Data Frames.IEEE Transactions on Information Forensics and Security(09 2018). https://doi.org/10.1109/TIFS.2018.2870826

    2018

  16. [25]

    Charlie Miller and Chris Valasek. 2015. Remote exploitation of an unaltered passenger vehicle.Black Hat USA(2015)

    2015

  17. [26]

    Charlie Miller and Chris Valasek. 2016. CAN Message Injection. https://illmatics.com/can%20message%20injection.pdf [Online, accessed 1-Oct-2022]

    2016

  18. [27]

    Michael R Moore, Robert A Bridges, Frank L Combs, Michael S Starr, and Stacy J Prowell. 2017. Modeling inter-signal arrival times for accurate detection of can bus signal injection attacks: a data-driven approach to in-vehicle intrusion detection. InProceedings of the 12th Ann...

    2017

  19. [28]

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. 2016. Deepfool: a simple and accurate method to fool deep neural networks. InProceedings of the IEEE conference on computer vision and pattern recognition. 2574–2582

    2016

  20. [29]

    Alessandro Nichelini, Carlo Alberto Pozzoli, Stefano Longari, Michele Carminati, and Stefano Zanero. 2023. CANova: A hybrid intrusion detection framework based on automatic signal classification for CAN.Computers and Security128 (2023). https://doi.org/10.1016/j.cose.2023.103166

    2023

  21. [30]

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. 2017. Practical black-box attacks against machine learning. InProceedings of the 2017 ACM on Asia conference on computer and communications security. 506–519

    2017

  22. [31]

    Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. 2016. Distillation as a defense to adversarial perturbations against deep neural networks. In2016 IEEE symposium on security and privacy (SP). IEEE, 582–597

    2016

  23. [32]

    Sampath Rajapaksha, Harsha Kalutarage, M Omar Al-Kadri, Andrei Petrovski, Garikayi Madzudzo, and Madeline Cheah. 2023. Ai-based intrusion detection systems for in-vehicle networks: A survey.Comput. Surveys55, 11 (2023)

    2023

  24. [33]

    Rafi Ud Daula Refat, Abdulrahman Abu Elkhail, Azeem Hafeez, and Hafiz Malik. 2022. Detecting CAN bus intrusion by applying machine learning method to graph based features. InIntelligent Systems and Applications: Proceedings of the 2021 Intelligent Systems Conference (IntelliSy...

    2022

  25. [34]

    Kudzai Sauka, Gun-Yoo Shin, Dong-Wook Kim, and Myung-Mook Han. 2022. Adversarial robust and explainable network intrusion detection systems based on deep learning.Applied Sciences12, 13 (2022), 6451

    2022

  26. [35]

    Eunbi Seo, Hyun Min Song, and Huy Kang Kim. 2018. GIDS: GAN based intrusion detection system for in-vehicle network. In2018 16th Annual Conference on Privacy, Security and Trust (PST). IEEE, 1–6

    2018

  27. [36]

    Ram Shankar Siva Kumar, Magnus Nyström, John Lambert, Andrew Marshall, Mario Goertzel, Andi Comissoneru, Matt Swann, and Sharon Xia. 2020. Adversarial Machine Learning-Industry Perspectives. In2020 IEEE Security and Privacy Workshops (SPW). 69–75. https://doi.org/10.1109/SPW50...

    2020

  28. [37]

    Hyun Min Song, Jiyoung Woo, and Huy Kang Kim. 2020. In-vehicle network intrusion detection using deep convolu- tional neural network.Vehicular Communications21 (2020), 100198

    2020

  29. [38]

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus

  30. [39]

    Goodfellow, and Rob Fergus

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus

  31. [40]

    Vinayak Tanksale. 2020. Anomaly Detection for Controller Area Networks Using Long Short-Term Memory.IEEE Open Journal of Intelligent Transportation Systems1 (2020), 253–265. https://doi.org/10.1109/OJITS.2020.3043066

    2020

  32. [41]

    Adrian Taylor, Nathalie Japkowicz, and Sylvain Leblanc. 2015. Frequency-based anomaly detection for the automotive CAN bus. In2015 World Congress on Industrial Control Systems Security (WCICSS). 45–49. https://doi.org/10.1109/ WCICSS.2015.7420322 J. ACM, Vol. 37, No. 4, Articl...

    2015

  33. [42]

    Adrian Taylor, Sylvain Leblanc, and Nathalie Japkowicz. 2016. Anomaly detection in automobile control network data with long short-term memory networks. In2016 IEEE International Conference on Data Science and Advanced Analytics (DSAA). IEEE, 130–139

    2016

  34. [43]

    Andrew Tomlinson, Jeremy Bryans, Siraj Ahmed Shaikh, and Harsha Kumara Kalutarage. 2018. Detection of automotive CAN cyber-attacks by identifying packet timing anomalies in time windows. In2018 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks W...

    2018

  35. [44]

    Verma, Michael D

    Miki E. Verma, Michael D. Iannacone, Robert A. Bridges, Samuel C. Hollifield, Pablo Moriano, Bill Kay, and Frank L. Combs. 2022. Addressing the Lack of Comparability & Testing in CAN Intrusion Detection Research: A Comprehensive Guide to CAN IDS Data & Introduction of the ROAD...

    2022 arXiv

  36. [45]

    Zico Kolter

    Eric Wong, Leslie Rice, and J. Zico Kolter. 2020. Fast is better than free: Revisiting adversarial training. arXiv:2001.03994 [cs.LG]

    2020 arXiv

  37. [46]

    Kaichao You, Mingsheng Long, Jianmin Wang, and Michael I Jordan. 2019. How does learning rate decay help modern neural networks?arXiv preprint arXiv:1908.01878(2019)

    2019 arXiv

  38. [47]

    Mattia Zago, Stefano Longari, Andrea Tricarico, Michele Carminati, Manuel Gil Pérez, Gregorio Martìnez Pérez, and Stefano Zanero. 2020. ReCAN–dataset for reverse engineering of controller area networks.Data in brief29 (2020), 105149. Received 15 September 2024; revised 1 Febru...

    2020

  39. [2013]

    https://doi.org/10.48550/ARXIV.1312.6199

    Intriguing properties of neural networks. https://doi.org/10.48550/ARXIV.1312.6199

    doi arXiv

  40. [2014]

    In2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, Yoshua Bengio and Yann LeCun (Eds.)

    Intriguing properties of neural networks. In2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, Yoshua Bengio and Yann LeCun (Eds.). http://arxiv.org/abs/1312.6199

    2014 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.