# can-train-and-test: A Curated CAN Dataset for Automotive Intrusion Detection

arXiv: https://arxiv.org/abs/2308.04972 · HTML: https://mlsanity.com/paper/2308.04972/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 Aug 2023.

## Built on by (most cited first, 6 of 6)

- [Evaluating lightweight unsupervised online IDS for masquerade attacks in CAN](https://mlsanity.com/paper/2406.13778/) (2024)
- [SecureBERT and LLAMA 2 Empowered Control Area Network Intrusion Detection and Classification](https://mlsanity.com/paper/2311.12074/) (2023)
- [AI-Driven Intrusion Detection Systems (IDS) on the ROAD Dataset: A Comparative Analysis for Automotive Controller Area Network (CAN)](https://mlsanity.com/paper/2408.17235/) (2024)
- [KD-GAT: Combining Knowledge Distillation and Graph Attention Transformer for a Controller Area Network Intrusion Detection System](https://mlsanity.com/paper/2507.19686/) (2025)
- [Multi-Stage Knowledge-Distilled VGAE and GAT for Robust Controller-Area-Network Intrusion Detection](https://mlsanity.com/paper/2508.04845/) (2025)
- [Behavioral Residualization for Unsupervised Intrusion Detection in Automotive CAN Networks](https://mlsanity.com/paper/2608.05548/) (2026)

## Abstract (arXiv)

When it comes to in-vehicle networks (IVNs), the controller area network -- CAN -- bus dominates the market; automobiles manufactured and sold around the world depend on the CAN bus for safety-critical communications between various components of the vehicle (e.g., the engine, the transmission, the steering column). Unfortunately, the CAN bus is inherently insecure; in fact, it completely lacks controls such as authentication, authorization, and confidentiality (i.e., encryption). Therefore, researchers have travailed to develop automotive security enhancements. The automotive intrusion detection system (IDS) is especially popular in the literature -- due to its relatively low cost in terms of money, resource utilization, and implementation effort. That said, developing and evaluating an automotive IDS is often challenging; if researchers do not have access to a test vehicle, then they are forced to depend on publicly available CAN data -- which is not without limitations. Lack of access to adequate CAN data, then, becomes a barrier to entry into automotive security research. We seek to lower that barrier to entry by introducing a new CAN dataset to facilitate the development and evaluation of automotive IDSs. Our dataset, dubbed can-train-and-test, provides CAN data from four different vehicles produced by two different manufacturers. The attack captures for each vehicle model are equivalent, enabling researchers to assess the ability of a given IDS to generalize to different vehicle models and even different vehicle manufacturers. Our dataset contains replayable .log files as well as labeled and unlabeled .csv files, thereby meeting a variety of development and evaluation needs. Furthermore, can-train-and-test offers nine unique attacks, ranging from denial of service (DoS) to gear spoofing to standstill...