{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T18:04:02Z","timestamp":1784311442007,"version":"3.55.0"},"reference-count":52,"publisher":"Public Library of Science (PLoS)","issue":"7","license":[{"start":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T00:00:00Z","timestamp":1784246400000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["www.plosone.org"],"crossmark-restriction":false},"short-container-title":["PLoS One"],"abstract":"<jats:p>The Controller Area Network (CAN) bus serves as the primary communication framework in modern vehicles, enabling reliable data exchange among Electronic Control Units (ECUs) for seamless interaction. The CAN protocol lacks built-in protection, leaving in-vehicle networks vulnerable to cyberattacks such as denial-of-service, message injection, replay, and suppression.To address these challenges, this study presents a deep learning\u2013based intrusion detection approach that integrates a 1D Convolutional Neural Network (1D CNN) with a Bidirectional Long Short-Term Memory (BiLSTM) model, along with focal loss to improve detection performance. The 1D CNN is responsible for capturing spatial patterns from CAN frame attributes, including arbitration ID, data length code, and payload information. In contrast, the BiLSTM learns temporal dependencies by analyzing sequence patterns in both forward and backward directions. Furthermore, instead of relying on synthetic data balancing techniques such as SMOTE, focal loss is applied to give greater importance to difficult-to-detect attack samples during training, thereby effectively addressing the issue of class imbalance in CAN datasets. Additionally window labeling tactic that helps detect attacks more sensitively within a temporal window is also proposed. Besides these, the Car-Hacking dataset (driving scenario) with stratified 10-fold cross-validation is used to test the above framework. The experimental results demonstrate that the proposed approach can achieve an accuracy of 97.41%, precision of 96.37%, recall of 96.73%, F1-score of 96.49%, and ROC-AUC of 0.9971 which is way above the baseline BiLSTM model performance from the previous work. These findings confirm that a combination of spatial feature extraction, temporal sequence modeling, and imbalance-aware optimization not only ensures but also delivers a highly effective and more reliable intrusion detection solution for in-vehicle CAN network security.<\/jats:p>","DOI":"10.1371\/journal.pone.0353472","type":"journal-article","created":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T17:27:42Z","timestamp":1784309262000},"page":"e0353472","update-policy":"https:\/\/doi.org\/10.1371\/journal.pone.corrections_policy","source":"Crossref","is-referenced-by-count":0,"title":["Hybrid 1D CNN-BiLSTM with focal loss for robust intrusion detection in in-vehicle CAN networks"],"prefix":"10.1371","volume":"21","author":[{"given":"A.","family":"Malini","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9246-0415","authenticated-orcid":true,"given":"Gerardine Immaculate","family":"Mary","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"340","published-online":{"date-parts":[[2026,7,17]]},"reference":[{"key":"pone.0353472.ref001","doi-asserted-by":"crossref","unstructured":"Li F, Wang L, Liao C. CAN (Controller Area Network) bus communication system based on Matlab\/Simulink. In: 2008 4th International Conference on Wireless Communications, Networking and Mobile Computing, 2008. 1\u20134.","DOI":"10.1109\/WiCom.2008.1004"},{"issue":"6","key":"pone.0353472.ref002","doi-asserted-by":"crossref","first-page":"6916","DOI":"10.1109\/TVT.2023.3236593","article-title":"In-Vehicle Network Average Response Time Analysis for CAN-FD and Automotive Ethernet","volume":"72","author":"H Kim","year":"2023","journal-title":"IEEE Trans Veh Technol"},{"issue":"10","key":"pone.0353472.ref003","doi-asserted-by":"crossref","first-page":"10494","DOI":"10.1109\/TVT.2020.3009165","article-title":"VeRA: A Simplified Security Risk Analysis Method for Autonomous Vehicles","volume":"69","author":"J Cui","year":"2020","journal-title":"IEEE Trans Veh Technol"},{"issue":"10","key":"pone.0353472.ref004","doi-asserted-by":"crossref","first-page":"10426","DOI":"10.1109\/TVT.2022.3185111","article-title":"Analysis of ID Sequences Similarity Using DTW in Intrusion Detection for CAN Bus","volume":"71","author":"H Sun","year":"2022","journal-title":"IEEE Trans Veh Technol"},{"key":"pone.0353472.ref005","doi-asserted-by":"crossref","first-page":"42422","DOI":"10.1109\/ACCESS.2020.2975893","article-title":"Normal and Malicious Sliding Windows Similarity Analysis Method for Fast and Accurate IDS Against DoS Attacks on In-Vehicle Networks","volume":"8","author":"S Ohira","year":"2020","journal-title":"IEEE Access"},{"issue":"1","key":"pone.0353472.ref006","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3431233","article-title":"Cyberattacks and Countermeasures for In-Vehicle Networks","volume":"54","author":"E Aliwa","year":"2021","journal-title":"ACM Comput Surv"},{"key":"pone.0353472.ref007","doi-asserted-by":"crossref","first-page":"82402","DOI":"10.1109\/ACCESS.2024.3412933","article-title":"Intrusion Detection System for In-Vehicle CAN-FD Bus ID Based on GAN Model","volume":"12","author":"X Wang","year":"2024","journal-title":"IEEE Access"},{"key":"pone.0353472.ref008","doi-asserted-by":"crossref","first-page":"17501","DOI":"10.1109\/TASE.2024.3383094","article-title":"ETS-Based Human\u2013Machine Robust Shared Control Design Considering the Network Delays","volume":"22","author":"J Liang","year":"2025","journal-title":"IEEE Trans Automat Sci Eng"},{"issue":"4","key":"pone.0353472.ref009","doi-asserted-by":"crossref","first-page":"5244","DOI":"10.1109\/TTE.2023.3267949","article-title":"An active front steering system design considering the CAN network delay","volume":"9","author":"Y Lu","year":"2023","journal-title":"IEEE Transactions on Transportation Electrification"},{"key":"pone.0353472.ref010","doi-asserted-by":"crossref","first-page":"100198","DOI":"10.1016\/j.vehcom.2019.100198","article-title":"In-vehicle network intrusion detection using deep convolutional neural network","volume":"21","author":"HM Song","year":"2020","journal-title":"Vehicular Communications"},{"key":"pone.0353472.ref011","doi-asserted-by":"crossref","unstructured":"Hossain MD, Inoue H, Ochiai H, Fall D, Kadobayashi Y. An effective in-vehicle CAN bus intrusion detection system using CNN deep learning approach. In: GLOBECOM 2020-2020 IEEE global communications conference, 2020. 1\u20136.","DOI":"10.1109\/GLOBECOM42002.2020.9322395"},{"key":"pone.0353472.ref012","doi-asserted-by":"crossref","unstructured":"Mohan J, Kishore C. Smart vehicle monitoring for detecting anomalies on CAN bus. In: 2021 IEEE International Conference on Electronics, Computing and Communication Technologies (CONECCT), 2021. 1\u20136.","DOI":"10.1109\/CONECCT52877.2021.9622628"},{"key":"pone.0353472.ref013","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1155\/2021\/1440259","article-title":"Intrusion Detecting System Based on Temporal Convolutional Network for In-Vehicle CAN Networks","volume":"2021","author":"D Shi","year":"2021","journal-title":"Mobile Information Systems"},{"key":"pone.0353472.ref014","doi-asserted-by":"crossref","first-page":"100470","DOI":"10.1016\/j.vehcom.2022.100470","article-title":"Rec-CNN: In-vehicle networks intrusion detection using convolutional neural networks trained on recurrence plots","volume":"35","author":"AK Desta","year":"2022","journal-title":"Vehicular Communications"},{"key":"pone.0353472.ref015","doi-asserted-by":"crossref","unstructured":"Desta AK, Ohira S, Arai I, Fujikawa K. U-CAN: A Convolutional Neural Network Based Intrusion Detection for Controller Area Networks. In: 2022 IEEE 46th Annual Computers, Software, and Applications Conference (COMPSAC), 2022. 1481\u20138. https:\/\/doi.org\/10.1109\/compsac54236.2022.00235","DOI":"10.1109\/COMPSAC54236.2022.00235"},{"key":"pone.0353472.ref016","doi-asserted-by":"crossref","unstructured":"Taslimasa H, Dadkhah S, Neto ECP, Xiong P, Iqbal S, Ray S, et al. Imagefed: practical privacy preserving intrusion detection system for in-vehicle can bus protocol. In: 2023 IEEE 9th Intl Conference on Big Data Security on Cloud (BigDataSecurity), IEEE Intl Conference on High Performance and Smart Computing (HPSC) and IEEE Intl Conference on Intelligent Data and Security (IDS), 2023. 122\u20139.","DOI":"10.1109\/BigDataSecurity-HPSC-IDS58521.2023.00031"},{"issue":"12","key":"pone.0353472.ref017","doi-asserted-by":"crossref","first-page":"16624","DOI":"10.1109\/TVT.2023.3296705","article-title":"Attack detection for intelligent vehicles via CAN-bus: A lightweight image network approach","volume":"72","author":"S Gao","year":"2023","journal-title":"IEEE Transactions on Vehicular Technology"},{"key":"pone.0353472.ref018","doi-asserted-by":"crossref","unstructured":"Lalouani W, Omorogbe I, Dube C, Baza M, Rasheed A, Raymond Choo K-K. A Robust Physical Layer IDS for Intra-Vehicle Communication Security. In: 2024 International Conference on Smart Applications, Communications and Networking (SmartNets), 2024. 1\u20136. https:\/\/doi.org\/10.1109\/smartnets61466.2024.10577640","DOI":"10.1109\/SmartNets61466.2024.10577640"},{"key":"pone.0353472.ref019","doi-asserted-by":"crossref","unstructured":"Zhang L, Yan X, Ma D. Efficient and Effective In-Vehicle Intrusion Detection System using Binarized Convolutional Neural Network. In: IEEE INFOCOM 2024 - IEEE Conference on Computer Communications, 2024. 2299\u2013307. https:\/\/doi.org\/10.1109\/infocom52122.2024.10621400","DOI":"10.1109\/INFOCOM52122.2024.10621400"},{"issue":"1","key":"pone.0353472.ref020","doi-asserted-by":"crossref","first-page":"138","DOI":"10.1007\/s42154-023-00273-w","article-title":"In-Vehicle Network Injection Attacks Detection Based on Feature Selection and Classification","volume":"7","author":"H Ji","year":"2024","journal-title":"Automot Innov"},{"key":"pone.0353472.ref021","doi-asserted-by":"crossref","unstructured":"Yan X, Zhang L. A multi-scale lightweight 1D-CNN for efficient CAN intrusion detection. In: 2025 IEEE Computer Society Annual Symposium on VLSI (ISVLSI), 2025. 1\u20136.","DOI":"10.1109\/ISVLSI65124.2025.11130204"},{"issue":"5","key":"pone.0353472.ref022","doi-asserted-by":"crossref","first-page":"3873","DOI":"10.1007\/s11276-025-03956-w","article-title":"An effective classification using enhanced flame seeker optimization with convolution neural network for intrusion detection","volume":"31","author":"A Binthiya","year":"2025","journal-title":"Wireless Netw"},{"key":"pone.0353472.ref023","doi-asserted-by":"crossref","unstructured":"Desta AK, Ohira S, Arai I, Fujikawa K. MLIDS: Handling raw high-dimensional CAN bus data using long short-term memory networks for intrusion detection in in-vehicle networks. In: 2020 30th International Telecommunication Networks and Applications Conference (ITNAC), 2020. 1\u20137.","DOI":"10.1109\/ITNAC50341.2020.9315024"},{"key":"pone.0353472.ref024","doi-asserted-by":"crossref","first-page":"185489","DOI":"10.1109\/ACCESS.2020.3029307","article-title":"LSTM-Based Intrusion Detection System for In-Vehicle Can Bus Communications","volume":"8","author":"MD Hossain","year":"2020","journal-title":"IEEE Access"},{"key":"pone.0353472.ref025","doi-asserted-by":"crossref","first-page":"58194","DOI":"10.1109\/ACCESS.2020.2982544","article-title":"CANet: An Unsupervised Intrusion Detection System for High Dimensional CAN Bus Data","volume":"8","author":"M Hanselmann","year":"2020","journal-title":"IEEE Access"},{"key":"pone.0353472.ref026","doi-asserted-by":"crossref","unstructured":"Yang S, Tan M, Xia S, Liu F. A method of intrusion detection based on Attention-LSTM neural network. In: Proceedings of the 2020 5th International Conference on Machine Learning Technologies, 2020. 46\u201350. https:\/\/doi.org\/10.1145\/3409073.3409096","DOI":"10.1145\/3409073.3409096"},{"key":"pone.0353472.ref027","doi-asserted-by":"crossref","first-page":"312","DOI":"10.1109\/OJITS.2021.3104495","article-title":"Design of Anomaly Detection Functions for Controller Area Networks","volume":"2","author":"V Tanksale","year":"2021","journal-title":"IEEE Open J Intell Transp Syst"},{"key":"pone.0353472.ref028","doi-asserted-by":"crossref","first-page":"100291","DOI":"10.1016\/j.vehcom.2020.100291","article-title":"Application of controller area network (CAN) bus anomaly detection based on time series prediction","volume":"27","author":"H Qin","year":"2021","journal-title":"Vehicular Communications"},{"key":"pone.0353472.ref029","doi-asserted-by":"crossref","first-page":"4133","DOI":"10.1109\/TIFS.2021.3098162","article-title":"Detection of Message Injection Attacks Onto the CAN Bus Using Similarities of Successive Messages-Sequence Graphs","volume":"16","author":"M Jedh","year":"2021","journal-title":"IEEE TransInformForensic Secur"},{"issue":"1","key":"pone.0353472.ref030","doi-asserted-by":"crossref","DOI":"10.1186\/s40537-021-00448-4","article-title":"Intrusion detection systems using long short-term memory (LSTM)","volume":"8","author":"F Laghrissi","year":"2021","journal-title":"J Big Data"},{"issue":"1","key":"pone.0353472.ref031","first-page":"5827056","article-title":"A GRU-Based Lightweight System for CAN Intrusion Detection in Real Time","volume":"2022","author":"H Ma","year":"2022","journal-title":"Security and Communication Networks"},{"key":"pone.0353472.ref032","doi-asserted-by":"crossref","first-page":"102957","DOI":"10.1016\/j.sysarc.2023.102957","article-title":"Detecting CAN overlapped voltage attacks with an improved voltage-based in-vehicle intrusion detection system","volume":"143","author":"L Yin","year":"2023","journal-title":"Journal of Systems Architecture"},{"key":"pone.0353472.ref033","doi-asserted-by":"crossref","first-page":"100845","DOI":"10.1016\/j.vehcom.2024.100845","article-title":"CANival: A multimodal approach to intrusion detection on the vehicle CAN bus","volume":"50","author":"H Kang","year":"2024","journal-title":"Vehicular Communications"},{"key":"pone.0353472.ref034","doi-asserted-by":"crossref","first-page":"100837","DOI":"10.1016\/j.vehcom.2024.100837","article-title":"A robust multi-stage intrusion detection system for in-vehicle network security using hierarchical federated learning","volume":"49","author":"M Althunayyan","year":"2024","journal-title":"Vehicular Communications"},{"issue":"3","key":"pone.0353472.ref035","doi-asserted-by":"crossref","first-page":"541","DOI":"10.1007\/s40031-023-00987-9","article-title":"Intelligent Intrusion Detection Framework for Anomaly-Based CAN Bus Network Using Bidirectional Long Short-Term Memory","volume":"105","author":"ChR Kishore","year":"2024","journal-title":"J Inst Eng India Ser B"},{"issue":"6","key":"pone.0353472.ref036","doi-asserted-by":"crossref","first-page":"185","DOI":"10.3390\/fi16060185","article-title":"HP-LSTM: Hawkes Process\u2013LSTM-Based Detection of DDoS Attack for In-Vehicle Network","volume":"16","author":"X Li","year":"2024","journal-title":"Future Internet"},{"issue":"15","key":"pone.0353472.ref037","doi-asserted-by":"crossref","first-page":"12357","DOI":"10.1007\/s13369-024-09748-2","article-title":"Improved Particle Swarm Optimization based Bidirectional-Long Short-Term Memory for Intrusion Detection System in Internet of Vehicle","volume":"50","author":"ChR Kishore","year":"2024","journal-title":"Arab J Sci Eng"},{"key":"pone.0353472.ref038","doi-asserted-by":"crossref","first-page":"3539","DOI":"10.1007\/s13042-024-02465-0","article-title":"Deep learning-based intrusion detection system for in-vehicle networks with knowledge graph and statistical methods","volume":"16","author":"H Alqahtani","year":"2024","journal-title":"Int J Mach Learn & Cyber"},{"issue":"23","key":"pone.0353472.ref039","doi-asserted-by":"crossref","first-page":"13429","DOI":"10.1007\/s00500-024-10313-0","article-title":"Attention-CNN-LSTM based intrusion detection system (ACL-IDS) for in-vehicle networks","volume":"28","author":"A Taneja","year":"2024","journal-title":"Soft Computing"},{"issue":"3","key":"pone.0353472.ref040","doi-asserted-by":"crossref","first-page":"1294","DOI":"10.1109\/TNET.2021.3137084","article-title":"Adversarial Attacks Against Deep Learning-Based Network Intrusion Detection Systems and Defense Mechanisms","volume":"30","author":"C Zhang","year":"2022","journal-title":"IEEE\/ACM Trans Networking"},{"key":"pone.0353472.ref041","first-page":"7272479","article-title":"Network Intrusion Detection Method Combining CNN and BiLSTM in Cloud Computing Environment","volume":"2022","author":"J Gao","year":"2022","journal-title":"Comput Intell Neurosci"},{"issue":"1","key":"pone.0353472.ref042","first-page":"3424819","article-title":"Distributed Deep CNN-LSTM Model for Intrusion Detection Method in IoT-Based Vehicles","volume":"2022","author":"A Alferaidi","year":"2022","journal-title":"Mathematical Problems in Engineering"},{"key":"pone.0353472.ref043","doi-asserted-by":"crossref","first-page":"271","DOI":"10.1109\/OJVT.2023.3237802","article-title":"A Novel Detection Approach of Unknown Cyber-Attacks for Intra-Vehicle Networks Using Recurrence Plots and Neural Networks","volume":"4","author":"OY Al-Jarrah","year":"2023","journal-title":"IEEE Open J Veh Technol"},{"key":"pone.0353472.ref044","doi-asserted-by":"crossref","first-page":"112814","DOI":"10.1109\/ACCESS.2023.3323891","article-title":"A Deep Learning-Based IDS for Automotive Theft Detection for In-Vehicle CAN Bus","volume":"11","author":"JA Khan","year":"2023","journal-title":"IEEE Access"},{"key":"pone.0353472.ref045","doi-asserted-by":"crossref","first-page":"4800","DOI":"10.1109\/TIFS.2023.3297444","article-title":"CAN-LOC: Spoofing Detection and Physical Intrusion Localization on an In-Vehicle CAN Bus Based on Deep Features of Voltage Signals","volume":"18","author":"E Levy","year":"2023","journal-title":"IEEE TransInformForensic Secur"},{"issue":"27","key":"pone.0353472.ref046","doi-asserted-by":"crossref","first-page":"20319","DOI":"10.1007\/s00521-023-08818-0","article-title":"A novel methodology for malicious traffic detection in smart devices using BI-LSTM\u2013CNN-dependent deep learning methodology","volume":"35","author":"T Anitha","year":"2023","journal-title":"Neural Comput & Applic"},{"issue":"8","key":"pone.0353472.ref047","doi-asserted-by":"crossref","first-page":"9296","DOI":"10.1109\/TITS.2024.3380263","article-title":"Time-Series Anomaly Detection in Automated Vehicles Using D-CNN-LSTM Autoencoder","volume":"25","author":"F Khanmohammadi","year":"2024","journal-title":"IEEE Trans Intell Transport Syst"},{"issue":"10","key":"pone.0353472.ref048","doi-asserted-by":"crossref","first-page":"14580","DOI":"10.1109\/TVT.2024.3413849","article-title":"HybridSecNet: In-Vehicle Security on Controller Area Networks Through a Hybrid Two-Step LSTM-CNN Model","volume":"73","author":"A Chougule","year":"2024","journal-title":"IEEE Trans Veh Technol"},{"key":"pone.0353472.ref049","doi-asserted-by":"crossref","first-page":"110868","DOI":"10.1016\/j.comnet.2024.110868","article-title":"Gradient correlation based detection of adversarial attacks on vehicular networks","volume":"255","author":"Y Lai","year":"2024","journal-title":"Computer Networks"},{"issue":"13","key":"pone.0353472.ref050","doi-asserted-by":"crossref","first-page":"20908","DOI":"10.1109\/JSEN.2024.3397966","article-title":"Sensor and Decision Fusion-Based Intrusion Detection and Mitigation Approach for Connected Autonomous Vehicles","volume":"24","author":"M Moradi","year":"2024","journal-title":"IEEE Sensors J"},{"issue":"3","key":"pone.0353472.ref051","doi-asserted-by":"crossref","DOI":"10.1002\/spy2.70033","article-title":"A network anomaly traffic detection method based on CNN-LSTM","volume":"8","author":"L Jiang","year":"2025","journal-title":"Security and Privacy"},{"key":"pone.0353472.ref052","doi-asserted-by":"crossref","unstructured":"Lin T-Y, Goyal P, Girshick R, He K, Dollar P. Focal Loss for Dense Object Detection. In: 2017 IEEE International Conference on Computer Vision (ICCV), 2017. 2999\u20133007. https:\/\/doi.org\/10.1109\/iccv.2017.324","DOI":"10.1109\/ICCV.2017.324"}],"container-title":["PLOS One"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0353472","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T17:27:50Z","timestamp":1784309270000},"score":1,"resource":{"primary":{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0353472"}},"subtitle":[],"editor":[{"given":"Jinhao","family":"Liang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"editor"}]}],"short-title":[],"issued":{"date-parts":[[2026,7,17]]},"references-count":52,"journal-issue":{"issue":"7","published-online":{"date-parts":[[2026,7,17]]}},"URL":"https:\/\/doi.org\/10.1371\/journal.pone.0353472","relation":{},"ISSN":["1932-6203"],"issn-type":[{"value":"1932-6203","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,17]]}}}