PaperlayerView exact revision on arXiv

Source-linked AI summary

Digital Twin-Based Intrusion Detection for Vehicle Powertrain CAN Bus Systems

Araf Rahman, M Sabbir Salek, Mashrur Chowdhury

arXiv:2608.17093v1cs.CRcs.LG

TL;DR

Whether digital twins can directly detect stealthy CAN attacks remains largely unexplored. This paper detects attacks by comparing predicted and observed vehicle behavior, and its detector outperformed the baseline across all evaluated attack types.

  • Problem

    Prior process-monitoring approaches detect deviations in individual signals or payload streams without learning coupled physical dynamics, leaving direct digital-twin detection of stealthy CAN attacks largely unexplored.

    Source: INTRODUCTION · p. 4

  • Method

    The study presents a digital-twin intrusion detector that learns joint physical dynamics among decoded powertrain signals and identifies attacks through mismatches between predicted and observed behavior.

    Source: INTRODUCTION · p. 4

  • Results

    The digital-twin detector outperformed the baseline by a wide margin across all four evaluated attack types.

    Source: RESULTS AND DISCUSSION · p. 12

  • Takeaways & Limitations

    Modeling coupled dynamics among decoded vehicle signals provides an effective approach for detecting stealthy payload manipulation without relying on message timing or protocol-level features.

    Source: CONCLUSIONS · p. 15

    The twin can remain in closed-loop mode after an attack region, contributing to a high overall false-positive rate.

    Source: RESULTS AND DISCUSSION · p. 13

Abstract

from arXiv · show

Existing automotive intrusion detection systems (IDSs) for the Controller Area Network (CAN) largely target discrepancies in message timing, frequency, or sequencing and cannot detect attacks that preserve these properties while manipulating the payload. Digital twins (DTs) have been used to emulate CAN traffic and generate attack scenarios for IDS evaluation, but their use for intrusion detection remains unexplored. This study develops a DT-based IDS that jointly models physical relationships among decoded powertrain signals and identifies attacks through residuals between predicted and observed behavior. A shared-encoder LSTM DT was trained on 17 decoded signals from a real Hyundai/Kia CAN log to jointly predict seven numeric and two categorical gear signals over a 24-step window. A timestep is flagged when a residual exceeds a calibrated threshold, while adaptive rollout protects the twin's input history from sustained contamination. Four attacks (plateau, continuous drift, masquerade, and gear masquerade) were evaluated against the twin and a range-and-plausibility baseline. The DT outperformed the baseline across all attacks, achieving detection rates of 94.6% for continuous drift and 89.2% for masquerade, while the baseline detected almost none of the fabricated payload attacks. These results demonstrate that learning coupled vehicle dynamics enables detection of stealthy payload manipulations that preserve normal CAN communication patterns. False positive rates reached 39.6%, highlighting the need for improved robustness under sustained attacks. The DT-based IDS shows promise for detecting stealthy payload-level CAN attacks that preserve normal communication patterns, supporting behavior-based cybersecurity for connected and automated vehicles.

INTRODUCTION

The paper introduces a digital-twin intrusion detector that predicts coupled decoded powertrain signals and flags deviations between predicted and observed behavior. It addresses the gap between CAN IDSs that monitor communication patterns or payloads without modeling coupled vehicle dynamics and digital twins previously used to evaluate IDSs rather than detect intrusions.

INTRODUCTION

  • Legacy CAN provides no native message authentication, encryption, or sender verification, allowing any node with bus access to inject or alter messages accepted as authentic.Bus access may be physical or gained remotely through a compromised infotainment or telematics unit.Source: INTRODUCTION · p. 3
  • Existing IDSs can miss carefully crafted attacks that preserve normal communication patterns or manipulate payloads while remaining protocol compliant.The paper argues that timing or ordering alone is insufficient for detecting attacks that require reasoning about message contents.Source: INTRODUCTION · p. 3
  • Prior anomaly-detection methods do not learn a predictive model of coupled physical dynamics across multiple vehicle signals.The approaches reviewed include reconstruction and prediction methods, correlation-based masquerade detection, and process monitoring of individual signals or payload streams.Source: INTRODUCTION · pp. 3–4
  • The proposed digital-twin IDS learns joint physical dynamics among decoded powertrain signals and detects stealthy payload manipulations through prediction residuals.It is evaluated on real-world driving data against stealthy CAN attacks and representative anomaly-detection baselines.Source: INTRODUCTION · p. 4
  • Earlier automotive CAN digital twins reproduced ECU interactions and generated attack scenarios for IDS evaluation, but did not themselves perform intrusion detection.The study addresses whether a learned twin can identify stealthy attacks by predicting the physically consistent evolution of decoded ECU signals.Source: INTRODUCTION · p. 4

LITERATURE REVIEW

Research has progressed from lightweight CAN stream-pattern defenses to payload-oriented learning methods, but prior approaches do not explicitly model joint physical dynamics across decoded vehicle signals. This study’s digital twin learns those relationships and detects departures from physically consistent behavior.

LITERATURE REVIEW

  • CAN vulnerabilities were demonstrated across vehicle systems, including remote exploitation of production vehicles, establishing security as a practical concern before defensive measures emerged.Early work also classified attacks such as denial-of-service, fabrication, and unauthorized actuation.Source: LITERATURE REVIEW · p. 4
  • Lightweight protocol-pattern defenses detect timing, frequency, or sequencing disruptions, but cannot detect payload changes that preserve those patterns.Earlier work includes physical-layer fingerprinting, entropy and statistical monitoring, identifier-sequence similarity, and frequency-based detection; these methods are fast, lightweight, and interpretable for resource-constrained deployment.Source: LITERATURE REVIEW · pp. 4–5
  • Machine- and deep-learning CAN IDSs extend detection to payloads through sequence, convolutional, generative, transformer, graph, and hybrid models, but often require representative training data and greater computation.Most are evaluated on fabrication-style benchmarks where injected messages disrupt per-ID timing statistics.Source: LITERATURE REVIEW · p. 5
  • Predictive and reconstructive methods detect anomalies without relying on timing disruption, but differ from this twin in their modeled signals or relationships.CANnolo reconstructs traffic sequences; CANShield reconstructs decoded signal values from sliding windows; Moriano et al. (2022) compare signal-correlation clustering; Novikova et al. (2020) train subgroup autoencoders; Cobilean et al. (2023) predict raw CAN sequences; MIDS (Q. Liu et al. 2026) reconstructs joint identifier-payload semantics; Duan et al. (2023) target local data-field anomalies; and CASAD detects departures in payload-byte streams.Source: LITERATURE REVIEW · pp. 5–6
  • Prior studies demonstrate reconstruction-, prediction-, and departure-based detection, but none explicitly model joint physical dynamics across decoded vehicle signals; this twin learns that coupling to detect physically inconsistent behavior.It combines cross-signal reasoning with autoregressive prediction in a shared model of physically meaningful vehicle signals.Source: LITERATURE REVIEW · p. 6

METHODS

The IDS uses a shared-encoder LSTM digital twin to detect deviations between predicted and observed CAN signals, with adaptive rollout to limit sustained attack contamination. It was developed from a decoded Hyundai/Kia CAN log aligned on a shared time base, with signal selection guided by physical relationships and redundancy.

IDS framework

  • The twin flags per-timestep numeric residuals above calibrated thresholds or categorical misclassifications, and adaptive rollout replaces repeatedly violated observations with predictions.A conservative restoration condition and periodic anchoring limit substitution drift and restore trust in observed CAN values.Source: METHODS · p. 6, Figure 1 · p. 7

Dataset, Signal Decoding, and Signal Selection

  • Four Hyundai/Kia CAN messages were decoded and aligned to a shared 50-ms grid using each signal’s most recently observed value, avoiding look-ahead.The grid interval reflected the representative update interval observed across the CAN traffic; boundary cases were handled with forward/backward fill.Source: METHODS · pp. 6–7
  • The final model used 17 inputs, retaining CurrentGear and GearSwitch as classification targets while dropping near-redundant TQI_ACOR and SelectorPosition.Joint modeling was motivated by correlations including TQI with TPS (Pearson r = 0.88) and N with InputShaftSpeed (Pearson r = 0.83); TEMP_ENG was retained only as a conditioning input, and BAT_Alt_FR_Duty was excluded from anomaly detection.Source: METHODS · pp. 7–8, Table 1 · p. 8

Partitioning

The study defined a usable driving session, distributed it across train, calibration, and attack-substrate partitions, and trained a shared LSTM twin using train-only normalization and calibration-based checkpoint selection.

Partitioning

  • The 7,777-row driving session was split across 10 blocks into 4,660 training, 1,160 calibration, and 1,957 attack-substrate rows, with normalization statistics fit only on training data.The session ran from sustained engagement of gear 1 to sustained engagement of reverse; proportional sampling across blocks avoided concentrating partitions in particular driving periods.Source: Partitioning · pp. 8–9

DT Architecture

  • The twin used a shared 128-unit LSTM over 24-step, 1.2-second windows of 17 features to predict seven numeric targets and classify CurrentGear and GearSwitch.The window exceeded the measured short-timescale coupling and spanned typical gear changes or throttle transitions.Source: Partitioning · p. 9
  • Training summed Huber regression, CurrentGear cross-entropy, and class-weighted GearSwitch cross-entropy losses equally, and evaluation used the checkpoint with the lowest calibration loss.Training ran for 50 epochs with Adam at a 1e-3 learning rate and batch size 64.Source: Partitioning · p. 9

EVALUATION

The evaluation defines four message-substitution attacks against powertrain signals to test the DT’s detection logic and assess feasibility with real-time CAN hardware.

Attack Models

  • Three SynCAN-aligned attacks target EMS11 signals N, TQI, and VS with plateaus, constant-rate drift, or earlier genuine values.They use a held-out attack-substrate partition of 1,957 rows (25% of the usable session); the setup assumes fabricated messages replace a silenced legitimate ECU, a capability demonstrated by Bloom 2021.Source: EVALUATION · p. 9
  • The three attacks begin at each block’s midpoint, last 40% of its length (about 78 steps or 3.9 seconds), and set drift rates from training-partition mean absolute step changes.The duration was selected to remain just under SynCAN’s documented 2–4-second attack interval.Source: EVALUATION · pp. 9–10
  • A fourth playback attack replaces InputShaftSpeed, CurrentGear, and GearSwitch together using one earlier donor window, preserving gear-cluster coherence while conflicting with the vehicle’s actual state.This gear-signal attack falls outside SynCAN’s continuous-signal-only taxonomy.Source: EVALUATION · p. 10

Evaluation

  • All four attacks were evaluated across ten attack-substrate blocks, and the evaluation included detection logic and a real-time CAN-hardware feasibility test.The DT was modified to handle different attack types.Source: EVALUATION · pp. 9–10

Range and Plausibility Baseline

The study uses two per-signal, non-learned sensors as a baseline: one checks DBC-defined ranges, and the other checks changes against training-partition maxima. Both assess each newly observed sample independently.

Range and Plausibility Baseline

  • The Range Sensor flags decoded values outside DBC-defined bounds, while the Plausibility Sensor flags per-step changes above the largest training-partition change for that signal.The sensors adapt two anomaly detectors proposed by Müter et al. (2010) to a setting without documented physical rate limits.Source: Range and Plausibility Baseline · p. 10
  • Both sensors monitor signals independently and evaluate each newly observed sample, matching the twin’s per-signal scope and detection metric.The baseline implements two of eight sensors proposed by Müter et al. (2010); six are omitted because some are inapplicable to preserved frame structure and timing, while others require multiple bus systems or redundant sensors.Source: Range and Plausibility Baseline · p. 10

Attack Detection and Adaptive Rollout Mechanisms

The IDS flags per-timestep prediction residuals using calibrated, signal-specific rules, while adaptive rollout protects autoregressive inputs by replacing observations with prior predictions during sustained violations.

Attack Detection

  • For six numeric targets (excluding BAT_Alt_FR_Duty), a timestep is flagged when absolute residual exceeds 3 times that signal’s calibration-partition standard deviation of absolute residuals.Thresholds are calibrated separately from training and attack construction.Source: Attack Detection and Adaptive Rollout… · p. 10
  • CurrentGear and GearSwitch are flagged whenever predicted and observed classes differ, using a fixed misclassification threshold.Source: Attack Detection and Adaptive Rollout… · p. 10

Adaptive Rollout

  • Adaptive rollout switches an affected signal to closed-loop after violations exceed 60% in a trailing 20-timestep window, then reacquires passive input at or below 10% over 40 timesteps.A shared anchor window re-admits raw data for 10 timesteps every 200 during closed-loop mode, limiting indefinite drift while sometimes reintroducing corrupted data; parameters were set by preliminary experimentation and held constant across scenarios.Source: Attack Detection and Adaptive Rollout… · p. 11

Real-Time Hardware Testbed

The twin-based IDS was run in real time on a small CAN hardware-in-the-loop testbed replaying recorded traffic and attacker messages. Evaluation used representative blocks from all four attack scenarios and included real-time latency and processing-time metrics.

Real-Time Hardware Testbed

  • An Arduino-based hardware-in-the-loop CAN testbed replayed recorded EMS11, EMS12, EMS14, and TCU_Data traffic while a third node sent attacker messages.The legitimate engine and transmission nodes stopped broadcasting during attacks, and a desktop computer ran the IDS through a USB-CAN FD interface.Source: Real-Time Hardware Testbed · p. 11
  • Real-time evaluation used one representative block from each of the four attack scenarios, with incoming messages aligned to a 50-ms grid and passed into a 24-step input window.The online setup used the same detection procedure as the offline version.Source: Real-Time Hardware Testbed · p. 11
  • Offline performance across ten blocks was assessed primarily using detection rate and false positive rate.Because block-to-block variation was substantial, these metrics were reported as mean ± standard deviation rather than bare means.Source: Real-Time Hardware Testbed · p. 12
  • Real-time feasibility metrics included detection latency and per-message processing time.Detection latency measures the time from receipt of a spoofed message to the IDS flagging it.Source: Real-Time Hardware Testbed · p. 12

RESULTS AND DISCUSSION

The twin-based detector outperformed the range-and-plausibility baseline across all four attacks, but performance varied by attack and false positives were frequent. Testbed measurements indicate sub-millisecond mean detection latency.

RESULTS AND DISCUSSION

  • False positive rates ranged from 17.5% to 39.6%, as residuals could flag normal payloads and adaptive rollout could keep the twin in closed-loop mode after attacks.The rollout logic makes regaining trust in a signal harder than losing it, contributing to elevated overall false positives.Source: RESULTS AND DISCUSSION · pp. 12–13
  • Plateau detection missed positives during normal near-constant stretches, while gear masquerade was hardest to detect when the substituted gear splice matched normal data.Masquerade reliability also dropped where attacked signals approached or intersected attack-free values; detections fell in those regions.Source: RESULTS AND DISCUSSION · p. 12, Figure 2 · p. 13, Figure 3 · p. 14
  • Mean detection latency was below 1 ms, and maximum latency was 4.5 ms, below the 5.046-ms minimum message interval observed for the listed CAN messages.Mean model inference time was also below 1 ms; its 4.40-ms maximum remained below the established 50-ms time grid.Source: RESULTS AND DISCUSSION · p. 13, Table 5 · p. 14
  • The DT detector outperformed the baseline across all four attacks, performing best on drift, followed by masquerade and plateau, and worst on gear masquerade.The baseline performed poorly because the fabricated values and step-to-step changes were designed to remain within typical CAN ranges. DT performance was most consistent on drift and less consistent across blocks for the other attacks.Source: RESULTS AND DISCUSSION · p. 12, Table 4 · p. 13

CONCLUSIONS

The digital-twin IDS outperformed baseline methods across evaluated powertrain CAN attacks, especially continuous drift and masquerade, by modeling coupled vehicle-signal dynamics. Plateau and gear-masquerade attacks remained more challenging when malicious values were locally plausible.

CONCLUSIONS

  • The digital twin outperformed baseline methods overall, with particularly strong detection of continuous-drift and masquerade attacks, but less consistent performance on plateau and gear-masquerade attacks.The latter attacks were harder when manipulated values remained locally plausible.Source: CONCLUSIONS · p. 15
  • Modeling coupled dynamics among decoded vehicle signals detects stealthy payload manipulation without relying on message timing or protocol-level features.Source: CONCLUSIONS · p. 15
  • Future work will extend the twin to additional vehicle subsystems, explore temporal models for greater robustness, and generalize detection to sophisticated emerging attacks.Source: CONCLUSIONS · p. 15
Loading 2608.17093v1…