{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,16]],"date-time":"2026-06-16T18:34:01Z","timestamp":1781634841984,"version":"3.54.5"},"reference-count":68,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2023,1,31]],"date-time":"2023-01-31T00:00:00Z","timestamp":1675123200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100000038","name":"Natural Science and Engineering Research Council of Canada","doi-asserted-by":"crossref","award":["RGPIN-2018-05668"],"award-info":[{"award-number":["RGPIN-2018-05668"]}],"id":[{"id":"10.13039\/501100000038","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Cyber-Phys. Syst."],"published-print":{"date-parts":[[2023,1,31]]},"abstract":"<jats:p>The controller area network (CAN) protocol, used in many modern vehicles for real-time inter-device communications, is known to have cybersecurity vulnerabilities, putting passengers at risk for data exfiltration and control system sabotage. To address this issue, researchers have proposed to utilize security measures based on cryptography and message authentication; unfortunately, such approaches are often too computationally expensive to be deployed in real time on CAN devices. Additionally, they have developed machine learning (ML) techniques to detect anomalies in CAN traffic and thereby prevent attacks. The main disadvantage of existing ML-based techniques is that they either depend on additional computational hardware or they heuristically assume that all communication anomalies are malicious.<\/jats:p>\n          <jats:p>In this article, we show that tree-based learning ensembles outperform anomaly-based techniques like AutoRegressive Integrated Moving Average (ARIMA) and Z-Score when used to detect attacks that result in increased bus utilization. We evaluated the detection capacity of three tree-based ensembles, Adaboost, gradient boosting, and random forests, and collectively refer to these as DT-DS. We conclude that the decision tree ensemble with Adaboost performs best with an area under curve (AUC) score of 0.999, closely followed by gradient boosting and random forests with 0.997 and 0.991 AUC scores, respectively, when trained using message profiles. We observe that with an increase in the observation window, the DT-DS models present an average AUC score of 0.999, and offer a nearly perfect detection of attacks, at the cost of increased latency in detection of attacked messages. We evaluate the performance of the IDS for Aeronautical Radio, Incorporated\u2013 (ARINC) encoded CAN communication traffic in avionic systems, generated using an aerospace testbench, ARINC-825TBv2. The IDS has been evaluated against the active attacks of a state-of-the-art predictive attacker model. Additionally, we observed that the performance of IDS approaches such as ARIMA and Z-Score degrade considerably with a decrease in the size of the observation time window. In contrast, the performance of DT-DS models is consistent, with only an average drop of 0.005 in the AUC score.<\/jats:p>","DOI":"10.1145\/3566132","type":"journal-article","created":{"date-parts":[[2023,1,21]],"date-time":"2023-01-21T11:44:14Z","timestamp":1674301454000},"page":"1-27","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":6,"title":["DT-DS: CAN Intrusion Detection with Decision Tree Ensembles"],"prefix":"10.1145","volume":"7","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2240-6178","authenticated-orcid":false,"given":"Jarul","family":"Mehta","sequence":"first","affiliation":[{"name":"McGill University, Montreal, Quebec, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9393-3664","authenticated-orcid":false,"given":"Guillaume","family":"Richard","sequence":"additional","affiliation":[{"name":"McGill University, Montreal, Quebec, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5024-8667","authenticated-orcid":false,"given":"Loren","family":"Lugosch","sequence":"additional","affiliation":[{"name":"McGill University, Montreal, Quebec, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7150-4631","authenticated-orcid":false,"given":"Derek","family":"Yu","sequence":"additional","affiliation":[{"name":"McGill University, Montreal, Quebec, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6650-3298","authenticated-orcid":false,"given":"Brett H.","family":"Meyer","sequence":"additional","affiliation":[{"name":"McGill University, Montreal, Quebec, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,3,22]]},"reference":[{"key":"e_1_3_1_2_2","volume-title":"ARINC Specification 825","unstructured":"ARINC Specification 825. Standard. ARINC."},{"key":"e_1_3_1_3_2","unstructured":"FlightGear Flight Simulator. Retrieved from https:\/\/www.flightgear.org\/about\/."},{"key":"e_1_3_1_4_2","unstructured":"2018. White paper using CAN bus serial communications in space flight applications."},{"key":"e_1_3_1_5_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2011.07.024"},{"key":"e_1_3_1_6_2","doi-asserted-by":"publisher","DOI":"10.1109\/DFT.2015.7315168"},{"key":"e_1_3_1_7_2","doi-asserted-by":"publisher","DOI":"10.1109\/WIFS.2017.8267643"},{"key":"e_1_3_1_8_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2016.7511098"},{"key":"e_1_3_1_9_2","doi-asserted-by":"publisher","DOI":"10.3390\/s20082364"},{"key":"e_1_3_1_10_2","doi-asserted-by":"publisher","DOI":"10.1109\/STA.2017.8314877"},{"key":"e_1_3_1_11_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3045367"},{"key":"e_1_3_1_12_2","doi-asserted-by":"publisher","DOI":"10.5555\/2028067.2028073"},{"key":"e_1_3_1_13_2","doi-asserted-by":"publisher","DOI":"10.1109\/BigDataSecurity.2017.56"},{"key":"e_1_3_1_14_2","unstructured":"Lilly Cheng. 2019. Basic Ensemble Learning (Random Forest AdaBoost Gradient Boosting): Step by Step Explained. Retrieved from https:\/\/towardsdatascience.com\/basic-ensemble-learning-random-forest-adaboost-gradient-boosting-step-by-step-explained-95d49d1e2725."},{"key":"e_1_3_1_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978302"},{"key":"e_1_3_1_16_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2812149"},{"key":"e_1_3_1_17_2","doi-asserted-by":"publisher","DOI":"10.1515\/popets-2015-0029"},{"key":"e_1_3_1_18_2","unstructured":"Cyrus Farivar. 2015. FBI: Researcher Admitted to Hacking Plane In-flight Causing it to \u201cClimb.\u201d Retrieved from https:\/\/arstechnica.com\/information-technology\/2015\/05\/fbi-researcher-admitted-to-hacking-plane-in-flight-causing-it-to-climb\/."},{"key":"e_1_3_1_19_2","doi-asserted-by":"publisher","DOI":"10.1006\/jcss.1997.1504"},{"key":"e_1_3_1_20_2","doi-asserted-by":"publisher","DOI":"10.1109\/STA.2016.7952095"},{"key":"e_1_3_1_21_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2869351"},{"key":"e_1_3_1_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/3056506"},{"key":"e_1_3_1_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/NAECON.2018.8556747"},{"key":"e_1_3_1_24_2","unstructured":"CAN in Automation. 1999. CANopen application layer and communication profile."},{"key":"e_1_3_1_25_2","unstructured":"Kvaser Inc.CAN Bus Error Handling. Retrieved from https:\/\/www.kvaser.com\/about-can\/the-can-protocol\/can-error-handling\/."},{"key":"e_1_3_1_26_2","unstructured":"Kvaser Inc.An Overview of ARINC. Retrieved fromhttps:\/\/www.kvaser.com\/arinc\/."},{"key":"e_1_3_1_27_2","volume-title":"Controller Area Network (CAN) Overview","author":"Instruments National","unstructured":"National Instruments. Controller Area Network (CAN) Overview. Technical Report."},{"key":"e_1_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.1109\/ANCS.2017.25"},{"key":"e_1_3_1_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/VTCSpring.2016.7504089"},{"key":"e_1_3_1_30_2","unstructured":"Patrick Kiley. 2019. Investigating CAN Bus Network Integrity in Avionics Systems. Retrieved fromhttps:\/\/www.rapid7.com\/research\/report\/investigating-can-bus-network-integrity-in-avionics-systems\/."},{"key":"e_1_3_1_31_2","unstructured":"Ralph Knueppel. 2012. Standardization of CAN networks for airborne use through ARINC 825."},{"key":"e_1_3_1_32_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.34"},{"key":"e_1_3_1_33_2","unstructured":"Vipin Kumar Kukkala Sooryaa Vignesh Thiruloga and Sudeep Pasricha. 2020. INDRA: Intrusion detection using recurrent autoencoders in automotive embedded systems. arxiv:cs.CR\/2007.08795. Retrieved from https:\/\/arxiv.org\/abs\/2007.08795."},{"key":"e_1_3_1_34_2","article-title":"Evaluation metrics for intrusion detection systems\u2014A study","author":"Kumar Gulshan","year":"2014","unstructured":"Gulshan Kumar. 2014. Evaluation metrics for intrusion detection systems\u2014A study. Int. J. Comput. Sci. Mobile Appl. (2014).","journal-title":"Int. J. Comput. Sci. Mobile Appl."},{"key":"e_1_3_1_35_2","doi-asserted-by":"publisher","DOI":"10.2197\/ipsjjip.26.306"},{"key":"e_1_3_1_36_2","doi-asserted-by":"publisher","DOI":"10.3390\/sym9080152"},{"key":"e_1_3_1_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2008.4621263"},{"key":"e_1_3_1_38_2","doi-asserted-by":"publisher","DOI":"10.1109\/CyberSecurity.2012.7"},{"key":"e_1_3_1_39_2","doi-asserted-by":"publisher","DOI":"10.2991\/citcs.2012.161"},{"key":"e_1_3_1_40_2","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2020.3038991"},{"key":"e_1_3_1_41_2","doi-asserted-by":"publisher","DOI":"10.1145\/2997465.2997478"},{"key":"e_1_3_1_42_2","doi-asserted-by":"publisher","DOI":"10.1109\/RTSS46320.2019.00019"},{"key":"e_1_3_1_43_2","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2017.7995934"},{"key":"e_1_3_1_44_2","doi-asserted-by":"publisher","DOI":"10.1145\/382912.382923"},{"key":"e_1_3_1_45_2","volume-title":"A Survey of Remote Automotive Attack Surfaces","author":"Miller Charlie","unstructured":"Charlie Miller and Chris Valasek. A Survey of Remote Automotive Attack Surfaces. Technical Report."},{"key":"e_1_3_1_46_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-72253-0_42"},{"key":"e_1_3_1_47_2","doi-asserted-by":"publisher","DOI":"10.1145\/3064814.3064816"},{"key":"e_1_3_1_48_2","doi-asserted-by":"crossref","first-page":"23","DOI":"10.1007\/978-3-319-49806-5_2","volume-title":"Information Systems Security","author":"Mukherjee Subhojeet","year":"2016","unstructured":"Subhojeet Mukherjee, Hossein Shirazi, Indrakshi Ray, Jeremy Daily, and Rose Gamble. 2016. Practical DoS attacks on embedded networks in commercial vehicles. In Information Systems Security, Indrajit Ray, Manoj Singh Gaur, Mauro Conti, Dheeraj Sanghi, and V. Kamakoti (Eds.). Springer International Publishing, Cham, 23\u201342."},{"key":"e_1_3_1_49_2","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2011.5940552"},{"key":"e_1_3_1_50_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.eij.2013.10.003"},{"key":"e_1_3_1_51_2","doi-asserted-by":"publisher","DOI":"10.1109\/VETECF.2008.259"},{"key":"e_1_3_1_52_2","doi-asserted-by":"publisher","DOI":"10.5555\/1953048.2078195"},{"key":"e_1_3_1_53_2","doi-asserted-by":"publisher","DOI":"10.1145\/381677.381696"},{"key":"e_1_3_1_54_2","article-title":"Evaluation: From precision, recall and F-factor to ROC, informedness, markedness & correlation","volume":"2","author":"Powers David","year":"2008","unstructured":"David Powers. 2008. Evaluation: From precision, recall and F-factor to ROC, informedness, markedness & correlation. Mach. Learn. Technol. 2 (012008).","journal-title":"Mach. Learn. Technol."},{"key":"e_1_3_1_55_2","doi-asserted-by":"publisher","DOI":"10.1145\/2593069.2593211"},{"key":"e_1_3_1_56_2","doi-asserted-by":"publisher","DOI":"10.5772\/intechopen.92653"},{"key":"e_1_3_1_57_2","series-title":"Lecture Notes in Computer Science","volume-title":"Cryptographic Hardware and Embedded Systems","author":"Shoukry Y.","year":"2013","unstructured":"Y. Shoukry, P. Martin, P. Tabuada, and M. Srivastava. 2013. Non-invasive spoofing attacks for anti-lock braking systems. In Cryptographic Hardware and Embedded Systems. Lecture Notes in Computer Science, Vol. 8086. Springer, Berlin."},{"key":"e_1_3_1_58_2","unstructured":"Taylor G. Smith et\u00a0al. 2017\u2013. pmdarima: ARIMA estimators for Python. Retrieved fromhttp:\/\/www.alkaline-ml.com\/pmdarima."},{"key":"e_1_3_1_59_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICOIN.2016.7427089"},{"key":"e_1_3_1_60_2","unstructured":"Jason Staggs. 2013. How to Hack Your Mini Cooper: Reverse Engineering Controller Area Network CAN Messages on Passenger Automobiles. Retrieved May 13 2021 from https:\/\/doi.org\/10.5446\/38934"},{"key":"e_1_3_1_61_2","doi-asserted-by":"publisher","DOI":"10.1109\/DSNW.2013.6615528"},{"key":"e_1_3_1_62_2","unstructured":"Stock Flight Systems. CANaerospace. Retrieved from https:\/\/www.stockflightsystems.com\/canaerospace.html."},{"key":"e_1_3_1_63_2","doi-asserted-by":"publisher","DOI":"10.1109\/WCICSS.2015.7420322"},{"key":"e_1_3_1_64_2","unstructured":"Texas Instruments 2016. Introduction to the Controller Area Network(CAN). Retrieved fromhttps:\/\/www.ti.com\/lit\/an\/sloa101b\/sloa101b.pdf."},{"key":"e_1_3_1_65_2","doi-asserted-by":"publisher","DOI":"10.1109\/DSN-W.2018.00069"},{"key":"e_1_3_1_66_2","doi-asserted-by":"publisher","DOI":"10.1145\/3309171.3309179"},{"key":"e_1_3_1_67_2","doi-asserted-by":"publisher","DOI":"10.1109\/MDAT.2019.2899062"},{"key":"e_1_3_1_68_2","doi-asserted-by":"publisher","DOI":"10.1145\/3339985.3358489"},{"key":"e_1_3_1_69_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2006.255127"}],"container-title":["ACM Transactions on Cyber-Physical Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3566132","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3566132","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:51:31Z","timestamp":1750182691000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3566132"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,1,31]]},"references-count":68,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2023,1,31]]}},"alternative-id":["10.1145\/3566132"],"URL":"https:\/\/doi.org\/10.1145\/3566132","relation":{},"ISSN":["2378-962X","2378-9638"],"issn-type":[{"value":"2378-962X","type":"print"},{"value":"2378-9638","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,1,31]]},"assertion":[{"value":"2021-07-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-09-14","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-03-22","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}