{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,19]],"date-time":"2026-03-19T21:50:32Z","timestamp":1773957032300,"version":"3.50.1"},"reference-count":28,"publisher":"Public Library of Science (PLoS)","issue":"3","license":[{"start":{"date-parts":[[2026,3,19]],"date-time":"2026-03-19T00:00:00Z","timestamp":1773878400000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100023673","name":"Deanship of Scientific Research, Imam Mohammed Ibn Saud Islamic University","doi-asserted-by":"publisher","award":["NBU-FFR-2025-451-13"],"award-info":[{"award-number":["NBU-FFR-2025-451-13"]}],"id":[{"id":"10.13039\/501100023673","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["www.plosone.org"],"crossmark-restriction":false},"short-container-title":["PLoS One"],"abstract":"<jats:p>The emergence of Autonomous and Connected Autonomous Vehicles (CAVs) has transformed the automotive landscape drastically over the past few years by offering enhanced features in the vehicles for drivers\u2019 safety and convenience. These developments have introduced various features in AVs i.e., lane-keeping, cruise control, etc. These features are mainly powered by the Electronic Control Units (ECUs) that communicate using the Controller Area Network (CAN) bus protocol. The components in the AVs communicate with each other by sending and receiving messages via the CAN bus. However, despite increased connectivity, these vehicles have become vulnerable to cyber attacks, as malicious actors can exploit the CAN protocol to manipulate vehicle behavior, which can not only threaten the safety of the passengers but public as well. Hence, several Intrusion Detection Systems (IDS) have been proposed, however, these systems struggle with computational complexity, limited effectiveness against sophisticated attack types, and a lack of interpretability and transparency of detection mechanisms. To address challenges in the existing systems, this paper presents a novel hybrid Deep Learning (DL)-based IDS using DL components such as Convolutional layer and Long Short-Term Memory (LSTM) layers to capture complex patterns in the CAN messages. The proposed IDS uses a residual connection to enhance gradient flow and training stability. The system is evaluated on four common attack types, namely RPM Spoofing, Gear Spoofing, Fuzzy, and Denial of Service (DoS), achieving a detection accuracy of 99.99%. Finally, the outcomes of the proposed IDS are visually interpreted using the Explainable AI (XAI) technique called Local Interpretable Model-agnostic Explanations (LIME) to provide transparency into the model\u2019s decision-making process, thus increasing trust in the system\u2019s deployment in real-world AV environments.<\/jats:p>","DOI":"10.1371\/journal.pone.0338079","type":"journal-article","created":{"date-parts":[[2026,3,19]],"date-time":"2026-03-19T17:41:21Z","timestamp":1773942081000},"page":"e0338079","update-policy":"https:\/\/doi.org\/10.1371\/journal.pone.corrections_policy","source":"Crossref","is-referenced-by-count":0,"title":["A hybrid deep learning and residual connection-based architecture for intrusion detection in autonomous vehicles"],"prefix":"10.1371","volume":"21","author":[{"given":"Hareem","family":"Kibriya","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ayesha","family":"Siddiqa","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9179-8326","authenticated-orcid":true,"given":"Saad","family":"Alahmari","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0819-4236","authenticated-orcid":true,"given":"Wazir Zada","family":"Khan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Saad Nasser","family":"Altamimi","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Atta ur Rehman","family":"Khan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"340","published-online":{"date-parts":[[2026,3,19]]},"reference":[{"key":"pone.0338079.ref001","unstructured":"World Health Organization. Global Status Report on Road Safety 2023. 2023. https:\/\/www.who.int\/publications\/i\/item\/9789240086517"},{"issue":"7","key":"pone.0338079.ref002","doi-asserted-by":"crossref","first-page":"6142","DOI":"10.1109\/TITS.2021.3083927","article-title":"A Survey of Driving Safety With Sensing, Vehicular Communications, and Artificial Intelligence-Based Collision Avoidance","volume":"23","author":"Y Fu","year":"2022","journal-title":"IEEE Trans Intell Transport Syst"},{"issue":"2","key":"pone.0338079.ref003","doi-asserted-by":"crossref","DOI":"10.1371\/journal.pone.0312752","article-title":"A hybrid approach for intrusion detection in vehicular networks using feature selection and dimensionality reduction with optimized deep learning","volume":"20","author":"F Hassan","year":"2025","journal-title":"PLoS One"},{"key":"pone.0338079.ref004","doi-asserted-by":"crossref","first-page":"100252","DOI":"10.1016\/j.treng.2024.100252","article-title":"Intelligent transportation systems for sustainable smart cities","volume":"16","author":"M Elassy","year":"2024","journal-title":"Transportation Engineering"},{"issue":"3","key":"pone.0338079.ref005","doi-asserted-by":"crossref","first-page":"1445","DOI":"10.1109\/COMST.2023.3264928","article-title":"A Survey on Controller Area Network Reverse Engineering","volume":"25","author":"A Buscemi","year":"2023","journal-title":"IEEE Commun Surv Tutorials"},{"key":"pone.0338079.ref006","doi-asserted-by":"crossref","first-page":"122181","DOI":"10.1016\/j.eswa.2023.122181","article-title":"Supervised contrastive ResNet and transfer learning for the in-vehicle intrusion detection system","volume":"238","author":"T-N Hoang","year":"2024","journal-title":"Expert Systems with Applications"},{"issue":"8","key":"pone.0338079.ref007","doi-asserted-by":"crossref","first-page":"5081","DOI":"10.1109\/TITS.2020.3046974","article-title":"CAN-Bus Attack Detection With Deep Learning","volume":"22","author":"F Amato","year":"2021","journal-title":"IEEE Trans Intell Transport Syst"},{"issue":"3","key":"pone.0338079.ref008","doi-asserted-by":"crossref","first-page":"1185","DOI":"10.1007\/s11948-019-00130-2","article-title":"The Future of Transportation: Ethical, Legal, Social and Economic Impacts of Self-driving Vehicles in the Year 2025","volume":"26","author":"M Ryan","year":"2020","journal-title":"Sci Eng Ethics"},{"issue":"2","key":"pone.0338079.ref009","doi-asserted-by":"crossref","first-page":"500","DOI":"10.26599\/BDMA.2023.9020027","article-title":"An Adaptive Scalable Data Pipeline for Multiclass Attack Classification in Large-Scale IoT Networks","volume":"7","author":"S Saravanan","year":"2024","journal-title":"Big Data Min Anal"},{"issue":"7","key":"pone.0338079.ref010","doi-asserted-by":"crossref","first-page":"4507","DOI":"10.1109\/TITS.2020.3017882","article-title":"Novel Deep Learning-Enabled LSTM Autoencoder Architecture for Discovering Anomalous Events From Intelligent Transportation Systems","volume":"22","author":"J Ashraf","year":"2021","journal-title":"IEEE Trans Intell Transport Syst"},{"issue":"14","key":"pone.0338079.ref011","doi-asserted-by":"crossref","first-page":"10257","DOI":"10.1007\/s00521-023-08233-5","article-title":"Transfer learning-based self-learning intrusion detection system for in-vehicle networks","volume":"35","author":"Y Wang","year":"2023","journal-title":"Neural Comput & Applic"},{"key":"pone.0338079.ref012","doi-asserted-by":"crossref","unstructured":"Yu T, Hua G, Wang H, Yang J, Hu J. Federated-LSTM based Network Intrusion Detection Method for Intelligent Connected Vehicles. In: ICC 2022 - IEEE International Conference on Communications, 2022. 4324\u20139. https:\/\/doi.org\/10.1109\/icc45855.2022.9838655","DOI":"10.1109\/ICC45855.2022.9838655"},{"issue":"1","key":"pone.0338079.ref013","doi-asserted-by":"crossref","first-page":"13820","DOI":"10.1038\/s41598-025-98433-x","article-title":"Securing the CAN bus using deep learning for intrusion detection in vehicles","volume":"15","author":"R Rai","year":"2025","journal-title":"Sci Rep"},{"key":"pone.0338079.ref014","article-title":"ATHENA: An In-vehicle CAN Intrusion Detection Framework Based on Physical Characteristics of Vehicle Systems","author":"K Wang","year":"2025"},{"key":"pone.0338079.ref015","doi-asserted-by":"crossref","unstructured":"Lee H, Jeong SH, Kim HK. OTIDS: A Novel Intrusion Detection System for In-vehicle Network by Using Remote Frame. In: 2017 15th Annual Conference on Privacy, Security and Trust (PST), 2017. 57\u20135709. https:\/\/doi.org\/10.1109\/pst.2017.00017","DOI":"10.1109\/PST.2017.00017"},{"key":"pone.0338079.ref016","doi-asserted-by":"crossref","first-page":"104710","DOI":"10.1016\/j.imavis.2023.104710","article-title":"Detection of anomaly in surveillance videos using quantum convolutional neural networks","volume":"135","author":"J Amin","year":"2023","journal-title":"Image and Vision Computing"},{"issue":"10","key":"pone.0338079.ref017","doi-asserted-by":"crossref","first-page":"10426","DOI":"10.1109\/TVT.2022.3185111","article-title":"Analysis of ID Sequences Similarity Using DTW in Intrusion Detection for CAN Bus","volume":"71","author":"H Sun","year":"2022","journal-title":"IEEE Trans Veh Technol"},{"key":"pone.0338079.ref018","doi-asserted-by":"crossref","unstructured":"Tariq S, Lee S, Woo SS. CANTransfer: Transfer learning based intrusion detection on a controller area network using convolutional LSTM network. In: Proceedings of the 35th annual ACM symposium on applied computing, 2020. 1048\u201355.","DOI":"10.1145\/3341105.3373868"},{"issue":"2","key":"pone.0338079.ref019","doi-asserted-by":"crossref","first-page":"1456","DOI":"10.1109\/TNSE.2021.3059881","article-title":"CANintelliIDS: Detecting In-Vehicle Intrusion Attacks on a Controller Area Network Using CNN and Attention-Based GRU","volume":"8","author":"AR Javed","year":"2021","journal-title":"IEEE Trans Netw Sci Eng"},{"key":"pone.0338079.ref020","doi-asserted-by":"crossref","unstructured":"Wang S-L, Wu S-Y, Lin C-C, Boddupalli S, Chang P-J, Lin C-W, et al. Deep-Learning-Based Intrusion Detection for Autonomous Vehicle-Following Systems. In: 2021 IEEE International Intelligent Transportation Systems Conference (ITSC), 2021. 865\u201372. https:\/\/doi.org\/10.1109\/itsc48978.2021.9564677","DOI":"10.1109\/ITSC48978.2021.9564677"},{"issue":"1","key":"pone.0338079.ref021","doi-asserted-by":"crossref","DOI":"10.1186\/s13677-023-00564-x","article-title":"Security strategy for autonomous vehicle cyber-physical systems using transfer learning","volume":"12","author":"AA Alsulami","year":"2023","journal-title":"J Cloud Comp"},{"issue":"11","key":"pone.0338079.ref022","doi-asserted-by":"crossref","first-page":"6369","DOI":"10.3390\/app13116369","article-title":"CANPerFL: Improve In-Vehicle Intrusion Detection Performance by Sharing Knowledge","volume":"13","author":"T-N Hoang","year":"2023","journal-title":"Applied Sciences"},{"issue":"12","key":"pone.0338079.ref023","doi-asserted-by":"crossref","first-page":"14051","DOI":"10.1109\/TITS.2023.3294349","article-title":"RX-ADS: Interpretable Anomaly Detection Using Adversarial ML for Electric Vehicle CAN Data","volume":"24","author":"CS Wickramasinghe","year":"2023","journal-title":"IEEE Trans Intell Transport Syst"},{"issue":"12","key":"pone.0338079.ref024","doi-asserted-by":"crossref","first-page":"15866","DOI":"10.1109\/TITS.2023.3271768","article-title":"IIDS: Intelligent Intrusion Detection System for Sustainable Development in Autonomous Vehicles","volume":"24","author":"S Anbalagan","year":"2023","journal-title":"IEEE Trans Intell Transport Syst"},{"issue":"3","key":"pone.0338079.ref025","doi-asserted-by":"crossref","DOI":"10.1007\/s10922-023-09741-4","article-title":"SDNTruth: Innovative DDoS Detection Scheme for Software-Defined Networks (SDN)","volume":"31","author":"T Linhares","year":"2023","journal-title":"J Netw Syst Manage"},{"issue":"4","key":"pone.0338079.ref026","doi-asserted-by":"crossref","DOI":"10.1007\/s10207-025-01077-1","article-title":"MF2S-CID: A dynamic multi-model framework for scalable and interpretable intrusion detection","volume":"24","author":"S Farhat","year":"2025","journal-title":"Int J Inf Secur"},{"key":"pone.0338079.ref027","doi-asserted-by":"crossref","unstructured":"Seo E, Song HM, Kim HK. GIDS: GAN based intrusion detection system for in-vehicle network. In: 2018 16th annual conference on privacy, security and trust (PST), 2018. 1\u20136.","DOI":"10.1109\/PST.2018.8514157"},{"key":"pone.0338079.ref028","unstructured":"Hendrycks D, Gimpel K. Gaussian error linear units (gelus). In: 2016. https:\/\/arxiv.org\/abs\/1606.08415"}],"container-title":["PLOS One"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0338079","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,19]],"date-time":"2026-03-19T17:41:29Z","timestamp":1773942089000},"score":1,"resource":{"primary":{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0338079"}},"subtitle":[],"editor":[{"given":"Ayei Egu","family":"Ibor","sequence":"first","affiliation":[],"role":[{"role":"editor","vocabulary":"crossref"}]}],"short-title":[],"issued":{"date-parts":[[2026,3,19]]},"references-count":28,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2026,3,19]]}},"URL":"https:\/\/doi.org\/10.1371\/journal.pone.0338079","relation":{},"ISSN":["1932-6203"],"issn-type":[{"value":"1932-6203","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3,19]]}}}