{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,16]],"date-time":"2025-10-16T20:56:53Z","timestamp":1760648213799,"version":"build-2065373602"},"reference-count":36,"publisher":"MDPI AG","issue":"14","license":[{"start":{"date-parts":[[2025,7,16]],"date-time":"2025-07-16T00:00:00Z","timestamp":1752624000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Canadian Armed Forces Directorate of Cyber Operations Force Development, Service Level Arrangement","award":["2018-003-SLA"],"award-info":[{"award-number":["2018-003-SLA"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Utilizing deep learning models to detect malicious anomalies within the traffic of application layer J1939 protocol networks, found on heavy-duty commercial vehicles, is becoming a critical area of research in platform protection. At the physical layer, the controller area network (CAN) bus is the backbone network for most vehicles. The CAN bus is highly efficient and dependable, which makes it a suitable networking solution for automobiles where reaction time and speed are of the essence due to safety considerations. Much recent research has been conducted on securing the CAN bus explicitly; however, the importance of protecting the J1939 protocol is becoming apparent. Our research utilizes long short-term memory models to predict the next binary data sequence of a J1939 packet. Our primary objective is to compare the performance of our J1939 detection system trained on data sub-fields against a published CAN system trained on the full data payload. We conducted a series of experiments to evaluate both detection systems by utilizing a simulated attack representation to generate anomalies. We show that both detection systems outperform one another on a case-by-case basis and determine that there is a clear requirement for a multifaceted security approach for vehicular networks.<\/jats:p>","DOI":"10.3390\/s25144430","type":"journal-article","created":{"date-parts":[[2025,7,16]],"date-time":"2025-07-16T15:48:22Z","timestamp":1752680902000},"page":"4430","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Detecting Malicious Anomalies in Heavy-Duty Vehicular Networks Using Long Short-Term Memory Models"],"prefix":"10.3390","volume":"25","author":[{"given":"Mark J.","family":"Potvin","sequence":"first","affiliation":[{"name":"Department of Mathematics and Computer Science, Royal Military College of Canada, Kingston, ON K7K 7B4, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7882-1229","authenticated-orcid":false,"given":"Sylvain P.","family":"Leblanc","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, Royal Military College of Canada, Kingston, ON K7K 7B4, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2025,7,16]]},"reference":[{"key":"ref_1","unstructured":"Palandrani, P. (2025, March 04). A Decade of Change: How Tech Evolved in the 2010s and What\u2019s in Store for the 2020s. Global X ETFs NASDAQ. Available online: https:\/\/www.nasdaq.com\/articles\/a-decade-of-change%3A-how-tech-evolved-in-the-2010s-and-whats-in-store-for-the-2020s#:~:text=What%20changed?,s%20to%2015%20Mbit\/s.&text=For%20perspective%2C%20this%20reduced%20the,media%2C%20all%20on%20the%20go.&text=Then%20and%20now%20stat:%20Daily,to%20132%20minutes%20in%202019."},{"key":"ref_2","unstructured":"Bosch, R. (CAN Specification, 1991). CAN Specification, Version 2.0."},{"key":"ref_3","unstructured":"Valasek, C., and Miller, C. (2014). A Survey of Remote Automotive Attack Surfaces, IOActive."},{"key":"ref_4","unstructured":"(2010). Vehicle Application Layer (Standard No. J1939-71). Available online: https:\/\/www.sae.org\/standards\/content\/j1939\/71_201002\/."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"184","DOI":"10.1186\/s13638-019-1484-3","article-title":"Intrusion Detection System for Automotive Controller Area Network (CAN) bus system: A review","volume":"2019","author":"Lokman","year":"2019","journal-title":"EURASIP J. Wirel. Commun. Netw."},{"key":"ref_6","unstructured":"Butler, M. (2017, January 2\u20133). An Intrusion Detection System for Heavy-Duty Truck Networks. Proceedings of the International Conference on Cyber Warfare and Security, Dayton, OH, USA."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Mukherjee, S., Walkery, J., Rayz, I., and Daily, J. (2017, January 28\u201330). A Precedence Graph-Based Approach to Detect Message Injection Attacks in J1939 Based Networks. Proceedings of the 2017 15th Annual Conference on Privacy, Security and Trust (PST), Calgary, AB, Canada.","DOI":"10.1109\/PST.2017.00018"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"4325","DOI":"10.1109\/TVT.2018.2795384","article-title":"Security Shortcomings and Countermeasures for the SAE J1939 Commercial Vehicle Bus Protocol","volume":"67","author":"Murvay","year":"2018","journal-title":"IEEE. Trans. Veh. Technol."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Zachos, M. (2017). Securing J1939 Communications Using Strong Encryption with FIPS 140-2. WCXTM 17: SAE World Congress Experience, SAE International.","DOI":"10.4271\/2017-01-0020"},{"key":"ref_10","unstructured":"Shirazi, H., Ray, I., and Anderson, C. (2019, January 5\u20137). Using Machine Learning to Detect Anomalies in Embedded Networks in Heavy Vehicles. Proceedings of the 12th International Symposium on Foundations & Practice of Security, Toulouse, France."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"17425","DOI":"10.1109\/TITS.2022.3151712","article-title":"Effective Intrusion Detection and Prevention for the Commercial Vehicle SAE J1939 CAN Bus","volume":"23","author":"Jichici","year":"2022","journal-title":"IEEE. Trans. Intell. Transp. Syst."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"294","DOI":"10.1109\/OJITS.2025.3545474","article-title":"TruckSentry: Context Aware Intrusion Detection and Prevention System for J1939 Networks","volume":"6","author":"Mukherjee","year":"2025","journal-title":"IEEE. Open J. Intell. Transp. Syst."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Taylor, A., Leblanc, S., and Japkowicz, N. (2016, January 17\u201319). Anomaly Detection in Automobile Control Network Data with Long Short-Term Memory Networks. Proceedings of the 2016 IEEE International Conference on Data Science and Advanced Analytics (DSAA), Montreal, QC, Canada.","DOI":"10.1109\/DSAA.2016.20"},{"key":"ref_14","first-page":"54","article-title":"Probing the Limits of Anomaly Detectors for Automobiles with a Cyberattack Framework","volume":"33","author":"Taylor","year":"2018","journal-title":"IEEE. Comput. Soc."},{"key":"ref_15","unstructured":"Artail, H., and Halabi, J. (2018, January 14\u201316). A Lightweight Synchronous Cryptographic Hash Chain Solution to Securing the Vehicle CAN bus. Proceedings of the 2018 IEEE International Multidisciplinary Conference on Engineering Technology (IMCET), Beirut, Lebanon."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Wang, Q., and Sawhney, S. (2014, January 6\u20138). VeCure: A Practical Security Framework to Protect the CAN Bus of Vehicles. Proceedings of the 2014 International Conference on the Internet of Things (IOT), Cambridge, MA, USA.","DOI":"10.1109\/IOT.2014.7030108"},{"key":"ref_17","unstructured":"(2024). Road Vehicles\u2014Controller Area Network (CAN)\u2014Part 1: Data Link Layer and Physical Coding Sublayer (Standard No. ISO 11898-1:2024). Available online: https:\/\/www.iso.org\/obp\/ui\/en\/#iso:std:iso:11898:-1:ed-3:v1:en."},{"key":"ref_18","unstructured":"Corrigan, S. (2016). Introduction to the Controller Area Network (CAN), Application Report SLOA101B, Texas Instruments Incorporated."},{"key":"ref_19","unstructured":"(2016). Physical Layer, 250 Kbps, Twisted Shielded Pair (Standard No. J1939-11). Available online: https:\/\/www.sae.org\/standards\/content\/j1939\/11_201612\/."},{"key":"ref_20","unstructured":"Malhotra, P., Vig, L., Shroff, G., and Agarwal, P. (2015, January 22\u201324). Long Short Term Memory Networks for Anomaly Detection in Time Series. Proceedings of the 23rd European Symposium on Artificial Neural Networks, ESANN 2015, Bruges, Belgium."},{"key":"ref_21","unstructured":"Pandey, P. (2019). Simplifying the ROC and AUC Metrics, Towards Data Science. Available online: https:\/\/towardsdatascience.com\/understanding-the-roc-and-auc-curves-a05b68550b69."},{"key":"ref_22","first-page":"281","article-title":"Random Search for Hyper-Parameter Optimization","volume":"13","author":"Bergstra","year":"2012","journal-title":"J. Mach. Learn. Res."},{"key":"ref_23","first-page":"1929","article-title":"Dropout: A Simple Way to Prevent Neural Networks from Overfitting","volume":"15","author":"Srivastava","year":"2014","journal-title":"J. Mach. Learn. Res."},{"key":"ref_24","unstructured":"G\u00e9ron, A. (2019). Hands-on machine learning with Scikit-Learn, Keras, and TensorFlow: Concepts, Tools, and Techniques to Build Intelligent Systems, O\u2019Reilly Media, Inc."},{"key":"ref_25","unstructured":"(2020, July 13). Deep AI. What Is the F-Score?. Available online: https:\/\/deepai.org\/machine-learning-glossary-and-terms\/f-score."},{"key":"ref_26","first-page":"2825","article-title":"Scikit-learn: Machine Learning in Python","volume":"12","author":"Pedregosa","year":"2011","journal-title":"J. Mach. Learn. Res."},{"key":"ref_27","unstructured":"Burakova, Y., Hass, B., Millar, L., and Weimerskirch, A. (2016, January 8\u20139). Truck Hacking: An Experimental Analysis of the SAE J1939 Standard. Proceedings of the 10th USENIX Workshop on Offensive Technologies (WOOT 16), Berkeley, CA, USA."},{"key":"ref_28","unstructured":"Karpathy, A. (2019, November 04). The Unreasonable Effectiveness of Recurrent Neural Networks. Andrej Karpathy blog. Available online: http:\/\/karpathy.github.io\/2015\/05\/21\/rnn-effectiveness\/."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long Short-Term Memory","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Comput."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1561\/2200000006","article-title":"Learning Deep Architectures for AI","volume":"2","author":"Bengio","year":"2009","journal-title":"Found. Trends\u00ae Mach. Learn."},{"key":"ref_31","unstructured":"Kingma, D.P., and Ba, J. (2014). Adam: A Method for Stochastic Optimization. arXiv, Available online: http:\/\/arxiv.org\/abs\/1412.6980."},{"key":"ref_32","unstructured":"(2020, June 04). Tensorflow, tf.keras.callbacks.EarlyStopping. Available online: https:\/\/www.tensorflow.org\/api_docs\/python\/tf\/keras\/callbacks\/EarlyStopping."},{"key":"ref_33","unstructured":"Dariz, L., Ruggeri, M., Costantino, G., and Martinelli, F. (2016, January 14\u201315). A survey over low-level security issues in heavy duty vehicles. Proceedings of the Automotive Cyber Security Conference (ESCAR), Berlin, Germany."},{"key":"ref_34","first-page":"43","article-title":"Field classification, modeling and anomaly detection in unknown CAN bus networks","volume":"9","author":"Markovitz","year":"2017","journal-title":"Veh. Commun."},{"key":"ref_35","unstructured":"McKinney, W. (2022). Python for Data Analysis: Data Wrangling with Pandas, NumPy, and Jupyter, O\u2019Reilly. [3rd ed.]."},{"key":"ref_36","unstructured":"(2025, March 18). Supply Chain Cybersecurity: A Comprehensive Guide. National Motor Freight Traffic Association. Available online: https:\/\/nmfta.org\/supply-chain-cybersecurity-a-guide\/."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/25\/14\/4430\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:10:47Z","timestamp":1760033447000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/25\/14\/4430"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7,16]]},"references-count":36,"journal-issue":{"issue":"14","published-online":{"date-parts":[[2025,7]]}},"alternative-id":["s25144430"],"URL":"https:\/\/doi.org\/10.3390\/s25144430","relation":{},"ISSN":["1424-8220"],"issn-type":[{"type":"electronic","value":"1424-8220"}],"subject":[],"published":{"date-parts":[[2025,7,16]]}}}