CAN Intrusion Detection System Based on Data Augmentation and Improved Bi-LSTM

The Controller Area Network (CAN) protocol, as the core communication protocol for vehicular networks, is susceptible to various cyber attacks due to its openness and lack of security measures. Moreover, the severe imbalance between normal and abnormal (attack) data in vehicular communication, with a ratio of 13:1, makes detecting attack behaviors extremely challenging. First, to address the data imbalance issue, this paper proposes a data augmentation method using the Adaptive Synthetic Sampling (ADASYN) technique to enhance and balance the dataset. Then, to detect CAN bus intrusions, an improved Bi-LSTM model is proposed, which introduces a self-attention mechanism to capture critical information from CAN messages, enhancing the model's ability to detect intrusions in CAN messages. Finally, experimental results show that, compared to Recurrent Neural Network (RNN), Long Short-Term Memory (LSTM), ResNet, and EfficientNet, our method achieves an accuracy, precision, and F1 score of 0.9970, 0.9880, and 0.9888, respectively, with a model size of 2.6MB.