Source-linked AI summary
Digital Twin-Based Intrusion Detection for Vehicle Powertrain CAN Bus Systems
Araf Rahman, M Sabbir Salek, Mashrur Chowdhury
TL;DR
Existing CAN intrusion detectors do not model coupled vehicle dynamics, limiting detection of payload attacks that preserve communication patterns. This paper develops a digital-twin IDS that compares predicted and observed powertrain behavior, outperforming a range-based baseline across four attacks but exhibiting high false-positive rates.
Problem
Existing CAN intrusion detectors do not learn predictive models of coupled physical dynamics among multiple vehicle signals, leaving stealthy payload attacks insufficiently addressed.
Method
A shared-encoder LSTM digital twin predicts decoded powertrain signals from historical windows and flags residual or categorical mismatches using adaptive rollout.
Results
The digital-twin detector outperformed the baseline across all four evaluated attack types, especially continuous drift and masquerade scenarios violating learned physical relationships.
Takeaways & Limitations
Modeling coupled decoded-vehicle dynamics can detect stealthy payload manipulation without relying on message timing or protocol-level features.
Takeaways & Limitations
The adaptive rollout can keep the twin in closed-loop mode after attacks, producing a high overall false-positive rate.
Abstract
from arXiv · showhide
Existing automotive intrusion detection systems (IDSs) for the Controller Area Network (CAN) largely target discrepancies in message timing, frequency, or sequencing and cannot detect attacks that preserve these properties while manipulating the payload. Digital twins (DTs) have been used to emulate CAN traffic and generate attack scenarios for IDS evaluation, but their use for intrusion detection remains unexplored. This study develops a DT-based IDS that jointly models physical relationships among decoded powertrain signals and identifies attacks through residuals between predicted and observed behavior. A shared-encoder LSTM DT was trained on 17 decoded signals from a real Hyundai/Kia CAN log to jointly predict seven numeric and two categorical gear signals over a 24-step window. A timestep is flagged when a residual exceeds a calibrated threshold, while adaptive rollout protects the twin's input history from sustained contamination. Four attacks (plateau, continuous drift, masquerade, and gear masquerade) were evaluated against the twin and a range-and-plausibility baseline. The DT outperformed the baseline across all attacks, achieving detection rates of 94.6% for continuous drift and 89.2% for masquerade, while the baseline detected almost none of the fabricated payload attacks. These results demonstrate that learning coupled vehicle dynamics enables detection of stealthy payload manipulations that preserve normal CAN communication patterns. False positive rates reached 39.6%, highlighting the need for improved robustness under sustained attacks. The DT-based IDS shows promise for detecting stealthy payload-level CAN attacks that preserve normal communication patterns, supporting behavior-based cybersecurity for connected and automated vehicles.
INTRODUCTION
Automotive CAN networks support safety-critical vehicle functions but retain legacy security limitations. This paper introduces a digital-twin IDS that learns joint physical dynamics among decoded powertrain signals to detect stealthy payload attacks through prediction residuals.
- Motivation: CAN connects numerous ECUs governing braking, steering, powertrain, and other safety-critical functions, despite limited evolution of its legacy broadcast protocol.
- Limitations of Existing IDSs: Existing automotive IDSs use signature-based or anomaly-based detection, but many approaches focus on communication patterns or individual signals rather than coupled physical behavior.
- Research Gap: Prior automotive digital twins have emulated ECU interactions and generated attack scenarios for IDS evaluation, but have not directly performed intrusion detection.
- Contribution: The proposed DT-based IDS learns joint physical dynamics governing multiple decoded vehicle powertrain signals and detects attacks through departures from physically consistent behavior.
- Method: A shared-encoder LSTM DT trained on attack-free driving data predicts monitored signals from fixed-length historical windows and compares expected with observed values at each timestep.
Partitioning
The usable driving session was extracted from gear engagement boundaries, yielding 7,777 rows that were divided across train, calibration, and attack-substrate partitions. The study also defined a specification-based range/plausibility baseline and adaptive rollout to limit contamination from sustained attacks.
- Driving-session partitioning: The session was divided into 10 adjacent blocks and partitioned 60/15/25 into train, calibration, and attack-substrate sets.Each partition drew proportionally across all blocks rather than from one contiguous span.
- Attack construction: A gear-switching attack targeted InputShaftSpeed, CurrentGear, and GearSwitch to probe the twin’s discrete/classification signals.The attack used the same playback/masquerade construction and fell outside SynCAN’s continuous-signal-only taxonomy.
- Range and plausibility baseline: The baseline used Müter et al.’s Range Sensor and Plausibility Sensor as lightweight, non-learned anomaly detectors.The Range Sensor flags decoded values outside bounds specified in the vehicle’s DBC definitions, such as N: 0-16383.75 rpm and VS: 0-254 km/h.
- Adaptive rollout: Adaptive rollout uses a per-signal passive/closed-loop state machine to protect the twin’s autoregressive input history from sustained attack contamination.A signal enters closed-loop when spot violations within a trailing 20-timestep window exceed the 60% reject-rate threshold.
Real-Time Hardware Testbed
The twin-based IDS was deployed on a small-scale hardware-in-the-loop CAN testbed that reproduced recorded message content, timing, and frequency. Real-time evaluation showed sub-millisecond mean detection latency, with a 4.5-ms maximum below the shortest observed message interval, while adaptive rollout contributed to elevated false positives.
- Testbed Deployment: The hardware-in-the-loop testbed used Arduino nodes with MCP2515 interfaces to replay EMS11, EMS12, EMS14, and TCU_Data messages at their original recorded timing.The replay reproduced the same stream content, message timing, and frequency as the offline test.
- Evaluation Metrics: The real-time evaluation used detection latency and per-message processing time to assess feasibility under attack conditions.Offline evaluation additionally used detection rate and false positive rate across ten attack-substrate blocks.
- Limitations: The adaptive rollout can keep the twin in closed-loop mode after attacks, because regaining trust in a signal is harder than losing it.This behavior contributes to a high overall false positive rate and can cause normal CAN payloads to be erroneously flagged when residuals are too high.
- Real-Time Performance: 4.5-ms maximum detection latency remained below the 5.046-ms minimum message interval, indicating sufficient computational speed to catch spoofed messages.The mean detection latency was below one millisecond, although latency varied substantially between messages.