# Detecting message modification attacks on the CAN bus with Temporal Convolutional Networks

arXiv: https://arxiv.org/abs/2106.08692 · HTML: https://mlsanity.com/paper/2106.08692/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 28 references that are in the map.
- First posted on arXiv 16 Jun 2021.

## Builds on (most cited first, 7 of 7)

- [WaveNet: A Generative Model for Raw Audio](https://mlsanity.com/paper/1609.03499/) (2016)
- [An Empirical Evaluation of Generic Convolutional and Recurrent Networks for Sequence Modeling](https://mlsanity.com/paper/1803.01271/) (2018)
- [CANet: An Unsupervised Intrusion Detection System for High Dimensional CAN Bus Data](https://mlsanity.com/paper/1906.02492/) (2019)
- [INDRA: Intrusion Detection using Recurrent Autoencoders in Automotive Embedded Systems](https://mlsanity.com/paper/2007.08795/) (2020)
- [Unsupervised Time Series Extraction from Controller Area Network Payloads](https://mlsanity.com/paper/1904.03078/) (2019)
- [Automatic Driver Identification from In-Vehicle Network Logs](https://mlsanity.com/paper/1911.09508/) (2019)
- [Extracting vehicle sensor signals from CAN logs for driver re-identification](https://mlsanity.com/paper/1902.08956/) (2019)

## Abstract (arXiv)

Multiple attacks have shown that in-vehicle networks have vulnerabilities which can be exploited. Securing the Controller Area Network (CAN) for modern vehicles has become a necessary task for car manufacturers. Some attacks inject potentially large amount of fake messages into the CAN network; however, such attacks are relatively easy to detect. In more sophisticated attacks, the original messages are modified, making the detection a more complex problem. In this paper, we present a novel machine learning based intrusion detection method for CAN networks. We focus on detecting message modification attacks, which do not change the timing patterns of communications. Our proposed temporal convolutional network-based solution can learn the normal behavior of CAN signals and differentiate them from malicious ones. The method is evaluated on multiple CAN-bus message IDs from two public datasets including different types of attacks. Performance results show that our lightweight approach compares favorably to the state-of-the-art unsupervised learning approach, achieving similar or better accuracy for a wide range of scenarios with a significantly lower false positive rate.