{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,2]],"date-time":"2026-10-02T16:55:44Z","timestamp":1790960144914,"version":"4.1.0"},"reference-count":40,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2025,1,6]],"date-time":"2025-01-06T00:00:00Z","timestamp":1736121600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>As modern vehicles continue to evolve, advanced technologies are integrated to enhance the driving experience. A key enabler of this advancement is the Controller Area Network (CAN) bus, which facilitates seamless communication between vehicle components. Despite its widespread adoption, the CAN bus was not designed with security as a priority, making it vulnerable to various attacks. In this paper, we propose CANGuard, an Intrusion Detection System (IDS) designed to detect attacks on the CAN network and identify the originating node in real time. Using a simulated CAN-enabled system with four nodes representing diverse vehicle components, we generated a dataset featuring Denial-of-Service (DoS) attacks by exploiting the arbitration feature of the CAN bus, which prioritizes high-criticality messages (e.g., engine control) over lower-criticality ones (e.g., infotainment). We trained and evaluated several machine learning models for their ability to detect attacks and pinpoint the responsible node. Results indicate that Gradient Boosting outperformed other models, achieving high accuracy in both attack detection and node identification. While the Multi-Layer Perceptron (MLP) model demonstrated strong attack detection performance, it struggled with node identification, achieving less than 50% accuracy. These findings underscore the potential of tree-based models for real-time IDS applications in CAN-enabled vehicles.<\/jats:p>","DOI":"10.3390\/s25010278","type":"journal-article","created":{"date-parts":[[2025,1,6]],"date-time":"2025-01-06T08:08:52Z","timestamp":1736150932000},"page":"278","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":8,"title":["CANGuard: An Enhanced Approach to the Detection of Anomalies in CAN-Enabled Vehicles"],"prefix":"10.3390","volume":"25","author":[{"given":"Damilola","family":"Oladimeji","sequence":"first","affiliation":[{"name":"Department of Computer Science, Sam Houston State University, Huntsville, TX 77340, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Razaq","family":"Jinad","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Sam Houston State University, Huntsville, TX 77340, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Amar","family":"Rasheed","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Sam Houston State University, Huntsville, TX 77340, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5153-8693","authenticated-orcid":false,"given":"Mohamed","family":"Baza","sequence":"additional","affiliation":[{"name":"Department of Computer Science, College of Charleston, Charleston, SC 29424, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2025,1,6]]},"reference":[{"key":"ref_1","unstructured":"Valentine, A. (2024, July 16). Car Ownership Statistics 2024. Available online: https:\/\/www.forbes.com\/advisor\/car-insurance\/car-ownership-statistics\/#:~:text=There%20were%20a%20total%20of,Tennessee%20(19.4%25)."},{"key":"ref_2","unstructured":"Bashir, U. (2024, July 15). Most Common Modes of Transportation for Commuting in the U.S. 2024. Available online: https:\/\/www.statista.com\/forecasts\/997176\/most-common-modes-of-transportation-for-commuting-in-the-us."},{"key":"ref_3","unstructured":"AutoPi.io (2024, October 24). What Is an ECU? Learn How to Fix Common Issues. Available online: https:\/\/www.autopi.io\/blog\/what-is-electronic-control-unit-definition\/."},{"key":"ref_4","unstructured":"Specification, C. (1991). Bosch, Robert Bosch GmbH."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"5167575","DOI":"10.1155\/2019\/5167575","article-title":"A research study for the design of a portable and configurable ground test system for the A400M Aircraft","volume":"2019","author":"Larios","year":"2019","journal-title":"Int. J. Aerosp. Eng."},{"key":"ref_6","first-page":"641","article-title":"Design of flight control system bus controller of UAV based on double CAN-bus","volume":"479","author":"Pan","year":"2014","journal-title":"Appl. Mech. Mater."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Boland, H.M., Burgett, M.I., Etienne, A.J., and Stwalley, R.M. (2021). An Overview of CAN-BUS Development, Utilization, and Future Potential in Serial Network Messaging for Off-Road Mobile Equipment. Technology in Agriculture, IntechOpen.","DOI":"10.5772\/intechopen.98444"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"104847","DOI":"10.1016\/j.compag.2019.06.002","article-title":"Tractor CAN bus interface tools and application development for real-time data analysis","volume":"163","author":"Rohrer","year":"2019","journal-title":"Comput. Electron. Agric."},{"key":"ref_9","first-page":"67","article-title":"Implementation of LDUT-based redundancy and frame structure management in CAN bus space applications","volume":"8","author":"Farhid","year":"2024","journal-title":"Technol. Aerosp. Eng."},{"key":"ref_10","unstructured":"CSS Electronics (2024, November 07). Can Bus Explained\u2014A Simple Intro [2024]. Available online: https:\/\/www.csselectronics.com\/pages\/can-bus-simple-intro-tutorial."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Bozdal, M., Samie, M., Aslam, S., and Jennions, I. (2020). Evaluation of can bus security challenges. Sensors, 20.","DOI":"10.3390\/s20082364"},{"key":"ref_12","unstructured":"Yang, O. (2024, July 25). How to Get Away with Car Theft: Unveiling the Dark Side of the Can Bus. Available online: https:\/\/vicone.com\/blog\/how-to-get-away-with-car-theft-unveiling-the-dark-side-of-the-can-bus."},{"key":"ref_13","unstructured":"Greenberg, A. (2024, July 26). Hackers Cut a Corvette\u2019s Brakes via a Common Car Gadget. Available online: https:\/\/www.wired.com\/2015\/08\/hackers-cut-corvettes-brakes-via-common-car-gadget\/."},{"key":"ref_14","unstructured":"Checkoway, S., McCoy, D., Kantor, B., Anderson, D., Shacham, H., Savage, S., Koscher, K., Czeskis, A., Roesner, F., and Kohno, T. (2011, January 8\u201312). Comprehensive experimental analyses of automotive attack surfaces. Proceedings of the 20th USENIX Security Symposium (USENIX Security 11), San Francisco, CA, USA."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Koscher, K., Czeskis, A., Roesner, F., Patel, S., Kohno, T., Checkoway, S., McCoy, D., Kantor, B., Anderson, D., and Shacham, H. (2010, January 16\u201319). Experimental security analysis of a modern automobile. Proceedings of the 2010 IEEE Symposium on Security and Privacy, Oakland, CA, USA.","DOI":"10.1109\/SP.2010.34"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Oladimeji, D., Rasheed, A., Varol, C., Baza, M., Alshahrani, H., and Baz, A. (2023). CANAttack: Assessing Vulnerabilities Within Controller Area Network. Sensors, 23.","DOI":"10.3390\/s23198223"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Khan, J., Lim, D.W., and Kim, Y.S. (2023). Intrusion detection system can-bus in-vehicle networks based on the statistical characteristics of attacks. Sensors, 23.","DOI":"10.3390\/s23073554"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Adly, S., Moro, A., Hammad, S., and Maged, S.A. (2023). Prevention of Controller Area Network (CAN) Attacks on Electric Autonomous Vehicles. Appl. Sci., 13.","DOI":"10.3390\/app13169374"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Olufowobi, H., Bloom, G., Young, C., and Zambreno, J. (2018, January 11\u201314). Work-in-progress: Real-time modeling for intrusion detection in automotive controller area network. Proceedings of the 2018 IEEE Real-Time Systems Symposium (RTSS), Nashville, TN, USA.","DOI":"10.1109\/RTSS.2018.00030"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"184","DOI":"10.1186\/s13638-019-1484-3","article-title":"Intrusion detection system for automotive Controller Area Network (CAN) bus system: A review","volume":"2019","author":"Lokman","year":"2019","journal-title":"EURASIP J. Wirel. Commun. Netw."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Casillo, M., Coppola, S., De Santo, M., Pascale, F., and Santonicola, E. (2019, January 20\u201322). Embedded intrusion detection system for detecting attacks over CAN-BUS. Proceedings of the 2019 4th International Conference on System Reliability and Safety (ICSRS), Rome, Italy.","DOI":"10.1109\/ICSRS48664.2019.8987605"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Lampe, B., and Meng, W. (2022, January 4\u20138). IDS for CAN: A practical intrusion detection system for CAN bus security. Proceedings of the GLOBECOM 2022\u20142022 IEEE Global Communications Conference, Rio de Janeiro, Brazil.","DOI":"10.1109\/GLOBECOM48099.2022.10001536"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Jin, S., Chung, J.G., and Xu, Y. (2021, January 22\u201328). Signature-based intrusion detection system (IDS) for in-vehicle CAN bus network. Proceedings of the 2021 IEEE International Symposium on Circuits and Systems (ISCAS), Daegu, Republic of Korea.","DOI":"10.1109\/ISCAS51556.2021.9401087"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Song, H.M., Kim, H.R., and Kim, H.K. (2016, January 13\u201315). Intrusion detection system based on the analysis of time intervals of CAN messages for in-vehicle network. Proceedings of the 2016 International Conference on Information Networking (ICOIN), Kota Kinabalu, Malaysia.","DOI":"10.1109\/ICOIN.2016.7427089"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"2554280","DOI":"10.1155\/2022\/2554280","article-title":"Intrusion Detection Method for In-Vehicle CAN Bus Based on Message and Time Transfer Matrix","volume":"2022","author":"Bi","year":"2022","journal-title":"Secur. Commun. Netw."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Subir Halder, F., and Conti, M.S. (2020, January 4\u20137). COIDS: A clock offset based intrusion detection system for controller area networks. Proceedings of the 21st International Conference on Distributed Computing and Networking (ICDCN 2020), Kolkata, India.","DOI":"10.1145\/3369740.3369787"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Seo, E., Song, H.M., and Kim, H.K. (2018, January 28\u201330). GIDS: GAN based intrusion detection system for in-vehicle network. Proceedings of the 2018 16th Annual Conference on Privacy, Security and Trust (PST), Belfast, Ireland.","DOI":"10.1109\/PST.2018.8514157"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"10880","DOI":"10.1109\/TVT.2021.3106940","article-title":"Anomaly Detection for In-Vehicle Network Using CNN-LSTM With Attention Mechanism","volume":"70","author":"Sun","year":"2021","journal-title":"IEEE Trans. Veh. Technol."},{"key":"ref_29","unstructured":"Hossain, M.D., Inoue, H., Ochiai, H., Fall, D., and Kadobayashi, Y. (2020, January 7\u201311). An effective in-vehicle CAN bus intrusion detection system using CNN deep learning approach. Proceedings of the GLOBECOM 2020\u20142020 IEEE Global Communications Conference, Taipei, China."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Lombardi, M., Pascale, F., and Santaniello, D. (2020, January 1\u20135). EIDS: Embedded Intrusion Detection System using Machine Learning to Detect Attack over the CAN-BUS. Proceedings of the 30th European Safety and Reliability Conference and the 15th Probabilistic Safety Assessment and Management Conference, Venice, Italy.","DOI":"10.3850\/978-981-14-8593-0_5090-cd"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Tian, D., Li, Y., Wang, Y., Duan, X., Wang, C., Wang, W., Hui, R., and Guo, P. (2018). An intrusion detection system based on machine learning for CAN-bus. Industrial Networks and Intelligent Systems, Proceedings of the 3rd International Conference, INISCOM 2017, Ho Chi Minh City, Vietnam, 4 September 2017, Springer. Proceedings 3.","DOI":"10.1007\/978-3-319-74176-5_25"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Alfardus, A., and Rawat, D.B. (2021, January 1\u20134). Intrusion detection system for can bus in-vehicle network based on machine learning algorithms. Proceedings of the 2021 IEEE 12th Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON), New York, NY, USA.","DOI":"10.1109\/UEMCON53757.2021.9666745"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Rajapaksha, S., Kalutarage, H., Al-Kadri, M.O., Madzudzo, G., and Petrovski, A.V. (June, January 31). Keep the moving vehicle secure: Context-aware intrusion detection system for in-vehicle CAN bus security. Proceedings of the 2022 14th International Conference on Cyber Conflict: Keep Moving! (CyCon), Tallinn, Estonia.","DOI":"10.23919\/CyCon55549.2022.9811048"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Lee, H., Jeong, S.H., and Kim, H.K. (2017, January 28\u201330). OTIDS: A novel intrusion detection system for in-vehicle network by using remote frame. Proceedings of the 2017 15th Annual Conference on Privacy, Security and Trust (PST), Calgary, AB, Canada.","DOI":"10.1109\/PST.2017.00017"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Moore, M.R., Bridges, R.A., Combs, F.L., Starr, M.S., and Prowell, S.J. (2017, January 4\u20136). Modeling inter-signal arrival times for accurate detection of can bus signal injection attacks: A data-driven approach to in-vehicle intrusion detection. Proceedings of the 12th Annual Conference on Cyber and Information Security Research, Oak Ridge, TN, USA.","DOI":"10.1145\/3064814.3064816"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"19","DOI":"10.1007\/s12198-020-00208-0","article-title":"Improving CAN bus security by assigning dynamic arbitration IDs","volume":"13","author":"Islam","year":"2020","journal-title":"J. Transp. Secur."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Hosmer, D.W., Lemeshow, S., and Sturdivant, R.X. (2013). Applied Logistic Regression, John Wiley & Sons.","DOI":"10.1002\/9781118548387"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"217","DOI":"10.1080\/01431160412331269698","article-title":"Random forest classifier for remote sensing classification","volume":"26","author":"Pal","year":"2005","journal-title":"Int. J. Remote Sens."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"1189","DOI":"10.1214\/aos\/1013203451","article-title":"Greedy function approximation: A gradient boosting machine","volume":"29","author":"Friedman","year":"2001","journal-title":"Ann. Stat."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Taud, H., and Mas, J.F. (2018). Multilayer perceptron (MLP). Geomatic Approaches for Modeling Land Change Scenarios, Springer International Publishing.","DOI":"10.1007\/978-3-319-60801-3_27"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/25\/1\/278\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,8]],"date-time":"2025-10-08T10:23:34Z","timestamp":1759919014000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/25\/1\/278"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,1,6]]},"references-count":40,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,1]]}},"alternative-id":["s25010278"],"URL":"https:\/\/doi.org\/10.3390\/s25010278","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,1,6]]}}}