# MIDS: Detecting Stealthy Masquerade and Tampering Attacks on CAN Bus via Bidirectional Mamba

arXiv: https://arxiv.org/abs/2606.18599 · HTML: https://mlsanity.com/paper/2606.18599/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 10 of its 59 references that are in the map.
- First posted on arXiv 17 Jun 2026.

## Builds on (most cited first, 10 of 10)

- [Mamba: Linear-Time Sequence Modeling with Selective State Spaces](https://mlsanity.com/paper/2312.00752/) (2023)
- [Efficiently Modeling Long Sequences with Structured State Spaces](https://mlsanity.com/paper/2111.00396/) (2021)
- [GIDS: GAN based Intrusion Detection System for In-Vehicle Network](https://mlsanity.com/paper/1907.07377/) (2019)
- [CANet: An Unsupervised Intrusion Detection System for High Dimensional CAN Bus Data](https://mlsanity.com/paper/1906.02492/) (2019)
- [CANShield: Deep Learning-Based Intrusion Detection Framework for Controller Area Networks at the Signal-Level](https://mlsanity.com/paper/2205.01306/) (2022)
- [Detection of Message Injection Attacks onto the CAN Bus using Similarity of Successive Messages-Sequence Graphs](https://mlsanity.com/paper/2104.03763/) (2021)
- [Detecting In-vehicle Intrusion via Semi-supervised Learning-based Convolutional Adversarial Autoencoders](https://mlsanity.com/paper/2204.01193/) (2022)
- [Real-Time Zero-Day Intrusion Detection System for Automotive Controller Area Network on FPGAs](https://mlsanity.com/paper/2401.10724/) (2024)
- [Identifying ECUs Using Inimitable Characteristics of Signals in Controller Area Networks](https://mlsanity.com/paper/1607.00497/) (2016)
- [Performance comparison of timing-based anomaly detectors for Controller Area Network: a reproducible study](https://mlsanity.com/paper/2307.04561/) (2023)

## Abstract (arXiv)

The Controller Area Network (CAN) protocol is the primary communication standard for Electronic Control Units (ECUs) in modern vehicles, but its lack of encryption and authentication exposes it to a range of security threats. Existing intrusion detection systems are largely tuned to fabrication-style attacks (DoS, fuzzing, ID spoofing realised by frame injection), in which detection signals such as per-ID inter-arrival statistics are readily available. We instead address the harder masquerade setting~citeb37, in which an internal adversary substitutes a legitimate frame in-situ at its original transmission slot, preserving traffic periodicity and rendering traffic-statistic defences ineffective. We propose the Mamba Intrusion Detection System (MIDS), an innovative dual-stream framework that processes CAN identifiers and payloads in parallel and reconstructs their joint temporal semantics through bidirectional selective state-space modelling. To evaluate MIDS, we collected over 100 million CAN frames from a physical Tesla Model 3 across three driving regimes and synthesised 54 masquerade attack variants spanning ID-only, data-only, and combined modifications. MIDS attains an F1 of 96.94% on this dataset, exceeding the strongest reproducible baseline by more than 8 percentage points, while sustaining a 1.147~ms single-window inference latency -- ample headroom for real-time onboard deployment. To verify generalisation, we further evaluate MIDS on four public benchmarks (ROAD, CrySyS, OTIDS, CT&T) covering both masquerade and injection scenarios; MIDS attains F1 from 93.70% to 99.61%, outperforming the strongest of eight reproduced baselines by up to 13.94 percentage points under a unified 5-fold protocol.