# CANet: An Unsupervised Intrusion Detection System for High Dimensional CAN Bus Data

arXiv: https://arxiv.org/abs/1906.02492 · HTML: https://mlsanity.com/paper/1906.02492/

## Key facts

- Cited by 29 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Jun 2019.

## Built on by (most cited first, 29 of 29)

- [CAN-BERT do it? Controller Area Network Intrusion Detection System based on BERT Language Model](https://mlsanity.com/paper/2210.09439/) (2022)
- [LATTE: LSTM Self-Attention based Anomaly Detection in Embedded Automotive Platforms](https://mlsanity.com/paper/2107.05561/) (2021)
- [CANShield: Deep Learning-Based Intrusion Detection Framework for Controller Area Networks at the Signal-Level](https://mlsanity.com/paper/2205.01306/) (2022)
- [Time-Based CAN Intrusion Detection Benchmark](https://mlsanity.com/paper/2101.05781/) (2021)
- [TENET: Temporal CNN with Attention for Anomaly Detection in Automotive Cyber-Physical Systems](https://mlsanity.com/paper/2109.04565/) (2021)
- [Detecting CAN Masquerade Attacks with Signal Clustering Similarity](https://mlsanity.com/paper/2201.02665/) (2022)
- [Evaluating lightweight unsupervised online IDS for masquerade attacks in CAN](https://mlsanity.com/paper/2406.13778/) (2024)
- [DAM-Seg: Anatomically accurate cardiac segmentation using Dense Associative Networks](https://mlsanity.com/paper/2502.15128/) (2025)
- [A Survey of Anomaly Detection in In-Vehicle Networks](https://mlsanity.com/paper/2409.07505/) (2024)
- [Adaptive Anomaly Detection for Identifying Attacks in Cyber-Physical Systems: A Systematic Literature Review](https://mlsanity.com/paper/2411.14278/) (2024)
- [RX-ADS: Interpretable Anomaly Detection using Adversarial ML for Electric Vehicle CAN data](https://mlsanity.com/paper/2209.02052/) (2022)
- [Detecting Masquerade Attacks in Controller Area Networks Using Graph Machine Learning](https://mlsanity.com/paper/2408.05427/) (2024)
- [Characterization of Neural Networks Automatically Mapped on Automotive-grade Microcontrollers](https://mlsanity.com/paper/2103.00201/) (2021)
- [Detecting message modification attacks on the CAN bus with Temporal Convolutional Networks](https://mlsanity.com/paper/2106.08692/) (2021)
- [STATGRAPH: Effective In-vehicle Intrusion Detection via Multi-view Statistical Graph Learning](https://mlsanity.com/paper/2311.07056/) (2023)
- [LiPar: A Lightweight Parallel Learning Model for Practical In-Vehicle Network Intrusion Detection](https://mlsanity.com/paper/2311.08000/) (2023)
- [Deep Learning-based Embedded Intrusion Detection System for Automotive CAN](https://mlsanity.com/paper/2401.10674/) (2024)
- [MKF-ADS: Multi-Knowledge Fusion Based Self-supervised Anomaly Detection System for Control Area Network](https://mlsanity.com/paper/2403.04293/) (2024)
- [CARACAS: vehiCular ArchitectuRe for detAiled Can Attacks Simulation](https://mlsanity.com/paper/2406.07125/) (2024)
- [A Survey of Learning-Based Intrusion Detection Systems for In-Vehicle Network](https://mlsanity.com/paper/2505.11551/) (2025)
- [Assessing the Resilience of Automotive Intrusion Detection Systems to Adversarial Manipulation](https://mlsanity.com/paper/2506.10620/) (2025)
- [TWLR: Text-Guided Weakly-Supervised Lesion Localization and Severity Regression for Explainable Diabetic Retinopathy Grading](https://mlsanity.com/paper/2512.13008/) (2025)
- [Foundation CAN LM: A Pretrained Language Model For Automotive CAN Data](https://mlsanity.com/paper/2602.00866/) (2026)
- [Contour-Guided Query-Based Feature Fusion for Boundary-Aware and Generalizable Cardiac Ultrasound Segmentation](https://mlsanity.com/paper/2603.28110/) (2026)
- [DAIRE: A lightweight AI model for real-time detection of Controller Area Network attacks in the Internet of Vehicles](https://mlsanity.com/paper/2604.20771/) (2026)
- [MIDS: Detecting Stealthy Masquerade and Tampering Attacks on CAN Bus via Bidirectional Mamba](https://mlsanity.com/paper/2606.18599/) (2026)
- [CAN We Trust Your Results? A Cross-Dataset Study of Automotive IDS Evaluation](https://mlsanity.com/paper/2606.30430/) (2026)
- [Behavioral Residualization for Unsupervised Intrusion Detection in Automotive CAN Networks](https://mlsanity.com/paper/2608.05548/) (2026)
- [Temporal transformer CAN encoder with federated lightweight heads for anomaly detection](https://mlsanity.com/paper/2610.10613/) (2026)

## Abstract (arXiv)

We propose a novel neural network architecture for detecting intrusions on the CAN bus. The Controller Area Network (CAN) is the standard communication method between the Electronic Control Units (ECUs) of automobiles. However, CAN lacks security mechanisms and it has recently been shown that it can be attacked remotely. Hence, it is desirable to monitor CAN traffic to detect intrusions. In order to detect both, known and unknown intrusion scenarios, we consider a novel unsupervised learning approach which we call CANet. To our knowledge, this is the first deep learning based intrusion detection system (IDS) that takes individual CAN messages with different IDs and evaluates them in the moment they are received. This is a significant advancement because messages with different IDs are typically sent at different times and with different frequencies. Our method is evaluated on real and synthetic CAN data. For reproducibility of the method, our synthetic data is publicly available. A comparison with previous machine learning based methods shows that CANet outperforms them by a significant margin.