{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,17]],"date-time":"2026-04-17T04:30:13Z","timestamp":1776400213130,"version":"3.51.2"},"reference-count":42,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2025,5,1]],"date-time":"2025-05-01T00:00:00Z","timestamp":1746057600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,5,1]],"date-time":"2025-05-01T00:00:00Z","timestamp":1746057600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61872164"],"award-info":[{"award-number":["61872164"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Program of Science and Technology Development Plan of Jilin Province of China","award":["20220201147GX"],"award-info":[{"award-number":["20220201147GX"]}]},{"name":"Program of Science and Technology Development Plan of Jilin Province of China","award":["20240101374JC"],"award-info":[{"award-number":["20240101374JC"]}]},{"name":"Shenzhen Technology R&D Program","award":["JCYJ20230807150300001"],"award-info":[{"award-number":["JCYJ20230807150300001"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>The modern vehicle employs the Controller Area Network (CAN) to facilitate communication among its electronic control units (ECUs). However, the absence of encryption and authentication renders the CAN vulnerable to various attacks. Existing deep learning-based CAN intrusion detection systems face several challenges. Firstly, traditional deep learning models are inadequate in capturing long-range dependencies in message sequences. Secondly, due to privacy concerns, it is challenging to aggregate large datasets centrally for training. At the same time, the data from individual providers often exhibit imbalance and a scarcity of anomalous samples, leading to suboptimal model performance when using a single dataset. To address these issues, this paper proposes a two-stage federated learning-based intrusion detection system for CAN which employs an Encoder-only Transformer network with a multi-head self-attention mechanism. The initial stage comprises a single-class classifier, which is specifically designed for intrusion detection. The subsequent stage is a multi-class classifier, which is employed for the classification of attack types. The entire architecture is based on an Encoder-only Transformer network with a multi-head self-attention mechanism. To protect data privacy, generic models are trained by federated learning to cover various driving scenarios and vehicle states, and to address the non-independent-identical-distribution (non-iid) problem of crowdsourced data. Experiments on two public datasets demonstrate that our approach outperforms existing methods in both detection performance and speed.<\/jats:p>","DOI":"10.1186\/s42400-024-00329-2","type":"journal-article","created":{"date-parts":[[2025,4,30]],"date-time":"2025-04-30T23:02:02Z","timestamp":1746054122000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":15,"title":["Federated two-stage transformer-based network for intrusion detection in non-IID data of controller area networks"],"prefix":"10.1186","volume":"8","author":[{"given":"Yuan","family":"Zhang","sequence":"first","affiliation":[]},{"given":"Jiaru","family":"Song","sequence":"additional","affiliation":[]},{"given":"Yongxiong","family":"Sun","sequence":"additional","affiliation":[]},{"given":"Zhanheng","family":"Gao","sequence":"additional","affiliation":[]},{"given":"Zhe","family":"Hu","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1809-8187","authenticated-orcid":false,"given":"Minghui","family":"Sun","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,5,1]]},"reference":[{"key":"329_CR1","doi-asserted-by":"crossref","unstructured":"Briggs C, Fan Z, Andras P (2020) Federated learning with hierarchical clustering of local updates to improve training on non-iid data. In: 2020 international joint conference on neural networks (IJCNN). IEEE, pp 1\u20139","DOI":"10.1109\/IJCNN48605.2020.9207469"},{"key":"329_CR2","doi-asserted-by":"crossref","unstructured":"Cao J, Di X, Liu X, Li J, Li Z, Zhao L, Hawbani A, Guizani M (2024) Anomaly detection for in-vehicle network using self-supervised learning with vehicle-cloud collaboration update. IEEE Trans Intell Transp Syst","DOI":"10.1109\/TITS.2024.3351438"},{"key":"329_CR3","volume":"35","author":"AK Desta","year":"2022","unstructured":"Desta AK, Ohira S, Arai I, Fujikawa K (2022) Rec-cnn: in-vehicle networks intrusion detection using convolutional neural networks trained on recurrence plots. Veh Commun 35:100470","journal-title":"Veh Commun"},{"key":"329_CR4","doi-asserted-by":"crossref","unstructured":"Du L, Gu Z, Wang Y, Gao C (2024) Open world intrusion detection: An open set recognition method for can bus in intelligent connected vehicles. IEEE Netw 38(3):76\u201382","DOI":"10.1109\/MNET.2024.3367303"},{"key":"329_CR5","doi-asserted-by":"crossref","unstructured":"Fan C, Cui J, Jin H, Zhong H, Bolodurina I, He D (2024) Auto-updating intru-sion detection system for vehicular network: a deep learning approach based on cloud-edge-vehicle collaboration. IEEE Trans Veh Technol 73(10):15372\u201315384","DOI":"10.1109\/TVT.2024.3399219"},{"key":"329_CR6","first-page":"52","volume":"14","author":"ML Han","year":"2018","unstructured":"Han ML, Kwak BI, Kim HK (2018) Anomaly intrusion detection method for vehicular networks based on survival analysis. Veh Commun 14:52\u201363","journal-title":"Veh Commun"},{"key":"329_CR7","unstructured":"Hochreiter S, Bengio Y, Frasconi P, Schmidhuber J et al (2001) Gradient flow in recurrent nets: the difficulty of learning long-term dependencies. A field guide to dynamical recurrent neural networks. IEEE (in press)"},{"key":"329_CR8","doi-asserted-by":"publisher","first-page":"185489","DOI":"10.1109\/ACCESS.2020.3029307","volume":"8","author":"MD Hossain","year":"2020","unstructured":"Hossain MD, Inoue H, Ochiai H, Fall D, Kadobayashi Y (2020) Lstm-based intrusion detection system for in-vehicle can bus communications. IEEE Access 8:185489\u2013185502","journal-title":"IEEE Access"},{"issue":"2","key":"329_CR9","doi-asserted-by":"publisher","first-page":"1456","DOI":"10.1109\/TNSE.2021.3059881","volume":"8","author":"AR Javed","year":"2021","unstructured":"Javed AR, Ur Rehman S, Khan MU, Alazab M, Reddy T (2021) Canintelliids: detecting in-vehicle intrusion attacks on a controller area network using cnn and attention-based gru. IEEE Trans Netw Sci Eng 8(2):1456\u20131466","journal-title":"IEEE Trans Netw Sci Eng"},{"key":"329_CR10","doi-asserted-by":"crossref","unstructured":"Jiang J, Wang C, Chattopadhyay S, Zhang W (2020) Road context-aware intrusion detection system for autonomous cars. In: Information and communications security: 21st international conference, ICICS 2019, Beijing, China, December 15\u201317, 2019, Revised Selected Papers 21. Springer, pp 124\u2013142","DOI":"10.1007\/978-3-030-41579-2_8"},{"key":"329_CR11","doi-asserted-by":"crossref","unstructured":"Jin S, Chung J-G, Xu Y (2021) Signature-based intrusion detection system (ids) for in-vehicle can bus network. In: 2021 IEEE international symposium on circuits and systems (ISCAS). IEEE, pp 1\u20135","DOI":"10.1109\/ISCAS51556.2021.9401087"},{"issue":"1","key":"329_CR12","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s42400-019-0038-7","volume":"2","author":"A Khraisat","year":"2019","unstructured":"Khraisat A, Gondal I, Vamplew P, Kamruzzaman J (2019) Survey of intrusion detection systems: techniques, datasets and challenges. Cybersecurity 2(1):1\u201322","journal-title":"Cybersecurity"},{"issue":"11","key":"329_CR13","doi-asserted-by":"publisher","first-page":"3698","DOI":"10.1109\/TCAD.2020.3012749","volume":"39","author":"VK Kukkala","year":"2020","unstructured":"Kukkala VK, Thiruloga SV, Pasricha S (2020) Indra: intrusion detection using recurrent autoencoders in automotive embedded systems. IEEE Trans Comput Aided Des Integr Circuits Syst 39(11):3698\u20133710","journal-title":"IEEE Trans Comput Aided Des Integr Circuits Syst"},{"issue":"5s","key":"329_CR14","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3476998","volume":"20","author":"VK Kukkala","year":"2021","unstructured":"Kukkala VK, Thiruloga SV, Pasricha S (2021) Latte: Lstm self-attention based anomaly detection in embedded automotive platforms. ACM Trans Embedded Comput Syst 20(5s):1\u201323","journal-title":"ACM Trans Embedded Comput Syst"},{"key":"329_CR15","doi-asserted-by":"crossref","unstructured":"Li Q, Diao Y, Chen Q, He B (2022) Federated learning on non-iid data silos: an experimental study. In: 2022 IEEE 38th international conference on data engineering (ICDE). IEEE, pp 965\u2013978","DOI":"10.1109\/ICDE53745.2022.00077"},{"key":"329_CR16","volume":"35","author":"W Lo","year":"2022","unstructured":"Lo W, Alqahtani H, Thakur K, Almadhor A, Chander S, Kumar G (2022) A hybrid deep learning based intrusion detection system using spatial-temporal representation of in-vehicle network traffic. Veh Commun 35:100471","journal-title":"Veh Commun"},{"issue":"2","key":"329_CR17","doi-asserted-by":"publisher","first-page":"1913","DOI":"10.1109\/TNSM.2020.3038991","volume":"18","author":"S Longari","year":"2020","unstructured":"Longari S, Valcarcel DHN, Zago M, Carminati M, Zanero S (2020) Cannolo: An anomaly detection system based on lstm autoencoders for controller area network. IEEE Trans Netw Serv Manage 18(2):1913\u20131924","journal-title":"IEEE Trans Netw Serv Manage"},{"key":"329_CR18","doi-asserted-by":"publisher","first-page":"3491","DOI":"10.1109\/ACCESS.2017.2782159","volume":"6","author":"G Loukas","year":"2017","unstructured":"Loukas G, Vuong T, Heartfield R, Sakellari G, Yoon Y, Gan D (2017) Cloud-based cyber-physical intrusion detection for vehicles using deep learning. IEEE Access 6:3491\u20133508","journal-title":"IEEE Access"},{"key":"329_CR19","unstructured":"McMahan B, Moore E, Ramage D, Hampson S, Arcas BA (2017) Communication-efficient learning of deep networks from decentralized data. In: Artificial intelligence and statistics. PMLR, pp 1273\u20131282"},{"key":"329_CR20","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2022.108768","volume":"121","author":"E Mushtaq","year":"2022","unstructured":"Mushtaq E, Zameer A, Umer M, Abbasi AA (2022) A two-stage intrusion detection system with auto-encoder and lstms. Appl Soft Comput 121:108768","journal-title":"Appl Soft Comput"},{"key":"329_CR21","doi-asserted-by":"publisher","first-page":"124931","DOI":"10.1109\/ACCESS.2021.3110524","volume":"9","author":"M Nam","year":"2021","unstructured":"Nam M, Park S, Kim DS (2021) Intrusion detection method using bi-directional gpt for in-vehicle controller area networks. IEEE Access 9:124931\u2013124944","journal-title":"IEEE Access"},{"key":"329_CR22","doi-asserted-by":"crossref","unstructured":"Nguyen TP, Nam H, Kim D (2023) Transformer-based attention network for in-vehicle intrusion detection. IEEE Access 11:55389\u201355403","DOI":"10.1109\/ACCESS.2023.3282110"},{"issue":"1","key":"329_CR23","doi-asserted-by":"publisher","first-page":"468","DOI":"10.1109\/TDSC.2020.2990192","volume":"19","author":"L Othmane","year":"2020","unstructured":"Othmane L, Dhulipala L, Abdelkhalek M, Multari N, Govindarasu M (2020) On the performance of detecting injection of fabricated messages into the can bus. IEEE Trans Dependable Secure Comput 19(1):468\u2013481","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"329_CR24","doi-asserted-by":"crossref","unstructured":"Qin J, Xun Y, Liu J (2023) Cvmids: cloud-vehicle collaborative intrusion detection system for internet-of-vehicles. IEEE Internet Things J 11(1):321\u2013332","DOI":"10.1109\/JIOT.2023.3318181"},{"issue":"11","key":"329_CR25","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3570954","volume":"55","author":"S Rajapaksha","year":"2023","unstructured":"Rajapaksha S, Kalutarage H, Al-Kadri MO, Petrovski A, Madzudzo G, Cheah M (2023) Ai-based intrusion detection systems for in-vehicle networks: a survey. ACM Comput Surv 55(11):1\u201340","journal-title":"ACM Comput Surv"},{"key":"329_CR26","doi-asserted-by":"crossref","unstructured":"Seo E, Song H.M, Kim H.K (2018) Gids: Gan based intrusion detection system for in-vehicle network. In: 2018 16th annual conference on privacy, security and trust (PST). IEEE, pp 1\u20136","DOI":"10.1109\/PST.2018.8514157"},{"key":"329_CR27","doi-asserted-by":"crossref","unstructured":"Shibly KH, Hossain MD, Inoue H, Taenaka Y, Kadobayashi Y (2022) Personalized federated learning for automotive intrusion detection systems. In: 2022 IEEE future networks world forum (FNWF). IEEE, pp 544\u2013549","DOI":"10.1109\/FNWF55208.2022.00101"},{"key":"329_CR28","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.103847","volume":"142","author":"J Song","year":"2024","unstructured":"Song J, Qin G, Liang Y, Yan J, Sun M (2024) Sidildng: a similarity-based intrusion detection system using improved Levenshtein distance and n-gram for can. Comput Secur 142:103847","journal-title":"Comput Secur"},{"key":"329_CR29","unstructured":"Specification C (1991) Bosch. Robert Bosch GmbH, Postfach 50:15"},{"key":"329_CR30","unstructured":"Standard S (2013) J1939: Recommended practice for a serial control and communication vehicle network. J1939 201308:2-1"},{"issue":"1","key":"329_CR31","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1504\/IJES.2018.089430","volume":"10","author":"I Studnia","year":"2018","unstructured":"Studnia I, Alata E, Nicomette V, Ka\u00e2niche M, Laarouchi Y (2018) A language-based intrusion detection approach for automotive embedded networks. Int J Embedded Syst 10(1):1\u201312","journal-title":"Int J Embedded Syst"},{"issue":"1","key":"329_CR32","doi-asserted-by":"publisher","first-page":"4","DOI":"10.1186\/s42400-023-00195-4","volume":"7","author":"V Tanksale","year":"2024","unstructured":"Tanksale V (2024) Intrusion detection system for controller area network. Cybersecurity 7(1):4","journal-title":"Cybersecurity"},{"key":"329_CR33","doi-asserted-by":"crossref","unstructured":"Tan AZ, Yu H, Cui L, Yang Q (2022) Towards personalized federated learning.\nIEEE Trans Neural Netw Learn Syst 34(12):9587\u20139603","DOI":"10.1109\/TNNLS.2022.3160699"},{"issue":"1","key":"329_CR34","doi-asserted-by":"publisher","first-page":"190","DOI":"10.1016\/j.dcan.2023.03.008","volume":"10","author":"F Ullah","year":"2024","unstructured":"Ullah F, Ullah S, Srivastava G, Lin JC-W (2024) Ids-int: intrusion detection system using transformer-based transfer learning for imbalanced network traffic. Digital Commun Netw 10(1):190\u2013204","journal-title":"Digital Commun Netw"},{"key":"329_CR35","unstructured":"Vaswani A, Shazeer N, Parmar N, Uszkoreit J, Jones L, Gomez AN, Kaiser \u0141, Polosukhin I (2017) Attention is all you need. In: Guyon I, Luxburg U, Bengio S, Wallach H, Fergus R, Vishwanathan S, Garnett R (eds) Advances in neural information processing systems 30 (NIPS 2017), vol 30. 31st Annual Conference on Neural Information Processing Systems (NIPS), Long Beach, CA, DEC 04-09, 2017"},{"key":"329_CR36","unstructured":"Wasicek A, Pes\u00e9 M.D, Weimerskirch A, Burakova Y, Singh K (2017) Context-aware intrusion detection in automotive control systems. In: Proceedings of the 5th ESCAR USA conference, pp 21\u201322"},{"issue":"1","key":"329_CR37","doi-asserted-by":"publisher","first-page":"4","DOI":"10.1109\/TNNLS.2020.2978386","volume":"32","author":"Z Wu","year":"2020","unstructured":"Wu Z, Pan S, Chen F, Long G, Zhang C, Philip SY (2020) A comprehensive survey on graph neural networks. IEEE Trans Neural Netw Learn Syst 32(1):4\u201324","journal-title":"IEEE Trans Neural Netw Learn Syst"},{"key":"329_CR38","doi-asserted-by":"publisher","first-page":"64375","DOI":"10.1109\/ACCESS.2022.3182333","volume":"10","author":"Z Wu","year":"2022","unstructured":"Wu Z, Zhang H, Wang P, Sun Z (2022) Rtids: a robust transformer-based approach for intrusion detection system. IEEE Access 10:64375\u201364387","journal-title":"IEEE Access"},{"issue":"11","key":"329_CR39","doi-asserted-by":"publisher","first-page":"1388","DOI":"10.3390\/sym11111388","volume":"11","author":"J Xiao","year":"2019","unstructured":"Xiao J, Wu H, Li X (2019) Internet of things meets vehicles: sheltering in-vehicle network through lightweight machine learning. Symmetry 11(11):1388","journal-title":"Symmetry"},{"issue":"3","key":"329_CR40","doi-asserted-by":"publisher","first-page":"2124","DOI":"10.1109\/JIOT.2021.3090397","volume":"9","author":"Y Xun","year":"2021","unstructured":"Xun Y, Zhao Y, Liu J (2021) Vehicleeids: a novel external intrusion detection system based on vehicle voltage signals. IEEE Internet Things J 9(3):2124\u20132133","journal-title":"IEEE Internet Things J"},{"key":"329_CR41","doi-asserted-by":"publisher","first-page":"1566","DOI":"10.1109\/TIFS.2023.3240291","volume":"18","author":"H Zhang","year":"2023","unstructured":"Zhang H, Zeng K, Lin S (2023) Federated graph neural network for fast anomaly detection in controller area networks. IEEE Trans Inf Forensics Secur 18:1566\u20131579","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"329_CR42","unstructured":"Zhao J, Huang F, Lv J, Duan Y, Qin Z, Li G, Tian G (2020) Do rnn and lstm have long memory? In: International conference on machine learning. PMLR, pp 11365\u201311375"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00329-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-024-00329-2\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00329-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,4,30]],"date-time":"2025-04-30T23:02:20Z","timestamp":1746054140000},"score":1,"resource":{"primary":{"URL":"https:\/\/cybersecurity.springeropen.com\/articles\/10.1186\/s42400-024-00329-2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,5,1]]},"references-count":42,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,12]]}},"alternative-id":["329"],"URL":"https:\/\/doi.org\/10.1186\/s42400-024-00329-2","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,5,1]]},"assertion":[{"value":"26 July 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"16 October 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"1 May 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"29"}}