{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,24]],"date-time":"2026-09-24T14:02:21Z","timestamp":1790258541965,"version":"4.1.0"},"reference-count":31,"publisher":"MDPI AG","issue":"19","license":[{"start":{"date-parts":[[2026,9,24]],"date-time":"2026-09-24T00:00:00Z","timestamp":1790208000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100003662","name":"Korea Evaluation Institute of Industrial Technology","doi-asserted-by":"publisher","award":["RS-2023-00232192"],"award-info":[{"award-number":["RS-2023-00232192"]}],"id":[{"id":"10.13039\/501100003662","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003662","name":"Korea Evaluation Institute of Industrial Technology","doi-asserted-by":"publisher","award":["RS-2024-00403397"],"award-info":[{"award-number":["RS-2024-00403397"]}],"id":[{"id":"10.13039\/501100003662","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003662","name":"Korea Evaluation Institute of Industrial Technology","doi-asserted-by":"publisher","award":["RS-2024-00433615"],"award-info":[{"award-number":["RS-2024-00433615"]}],"id":[{"id":"10.13039\/501100003662","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003662","name":"Korea Evaluation Institute of Industrial Technology","doi-asserted-by":"publisher","award":["RS-2026-25534585"],"award-info":[{"award-number":["RS-2026-25534585"]}],"id":[{"id":"10.13039\/501100003662","id-type":"DOI","asserted-by":"publisher"}]},{"award":["RS-2023-00232192"],"award-info":[{"award-number":["RS-2023-00232192"]}],"id":[{"id":"https:\/\/ror.org\/03z9cwa38","id-type":"ROR","asserted-by":"publisher"}]},{"award":["RS-2024-00403397"],"award-info":[{"award-number":["RS-2024-00403397"]}],"id":[{"id":"https:\/\/ror.org\/03z9cwa38","id-type":"ROR","asserted-by":"publisher"}]},{"award":["RS-2024-00433615"],"award-info":[{"award-number":["RS-2024-00433615"]}],"id":[{"id":"https:\/\/ror.org\/03z9cwa38","id-type":"ROR","asserted-by":"publisher"}]},{"award":["RS-2026-25534585"],"award-info":[{"award-number":["RS-2026-25534585"]}],"id":[{"id":"https:\/\/ror.org\/03z9cwa38","id-type":"ROR","asserted-by":"publisher"}]},{"name":"Institute of Information Communications Technology Planning Evaluation","award":["RS-2025-02214672"],"award-info":[{"award-number":["RS-2025-02214672"]}]},{"award":["RS-2025-02214672"],"award-info":[{"award-number":["RS-2025-02214672"]}],"id":[{"id":"https:\/\/ror.org\/01g0hqq23","id-type":"ROR","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Uncomplicated application-level vehicular computing and networking (UAVCAN) is a higher-layer protocol built on the controller area network (CAN) bus to support control and status communication among electronic control units in unmanned aerial vehicles. Because CAN provides no native authentication or encryption, UAVCAN networks are vulnerable to message injection, replay, and flooding attacks. Most existing CAN intrusion detection systems, however, are designed for automotive networks and do not explicitly account for the transfer structure and tail-byte rules of UAVCAN. This paper proposes a protocol-aware intrusion detection framework that reconstructs UAVCAN transfers and extracts six payload features and four transfer features based on the CAN ID, transfer ID, toggle bit, and transfer-boundary information. The proposed feature set is evaluated using random forest, XGBoost, logistic regression, and multilayer perceptron classifiers on ten attack scenarios from a public UAVCAN dataset. The best-performing configuration achieves average accuracy, precision, and recall of 99.89%, 99.96%, and 99.88%, respectively. Ablation results show that transfer-rule features are particularly effective for replay-attack detection, while combining payload and transfer features provides the most consistent performance across attack types. The proposed approach also outperforms the evaluated automotive CAN IDS baselines and achieves competitive performance compared with existing UAVCAN-specific IDS methods. These findings support the value of protocol-aware feature extraction for UAVCAN intrusion detection.<\/jats:p>","DOI":"10.3390\/s26196061","type":"journal-article","created":{"date-parts":[[2026,9,24]],"date-time":"2026-09-24T13:26:11Z","timestamp":1790256371000},"page":"6061","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Protocol-Aware Feature-Based Intrusion Detection System for UAVCAN Networks"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-6178-2171","authenticated-orcid":false,"given":"Seoyeon","family":"Kim","sequence":"first","affiliation":[{"name":"Department of Intelligent Semiconductors, Soongsil University, Seoul 06978, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"methodology","vocabulary":"credit"},{"role":"software","vocabulary":"credit"},{"role":"validation","vocabulary":"credit"},{"role":"investigation","vocabulary":"credit"},{"role":"writing-original-draft","vocabulary":"credit"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-8934-7162","authenticated-orcid":false,"given":"Hyungchul","family":"Im","sequence":"additional","affiliation":[{"name":"Department of Intelligent Semiconductors, Soongsil University, Seoul 06978, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"}]},{"given":"Jongsoo","family":"Choi","sequence":"additional","affiliation":[{"name":"School of AI Convergence, Soongsil University, Seoul 06978, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"writing-review-editing","vocabulary":"credit"},{"role":"supervision","vocabulary":"credit"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3407-6236","authenticated-orcid":false,"given":"Seongsoo","family":"Lee","sequence":"additional","affiliation":[{"name":"Department of Intelligent Semiconductors, Soongsil University, Seoul 06978, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"writing-review-editing","vocabulary":"credit"},{"role":"supervision","vocabulary":"credit"}]}],"member":"1968","published-online":{"date-parts":[[2026,9,24]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"102739","DOI":"10.1016\/j.jnca.2020.102739","article-title":"Communication and networking technologies for UAVs: A survey","volume":"168","author":"Sharma","year":"2020","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"104073","DOI":"10.1016\/j.cose.2024.104073","article-title":"GUIDE: GAN-based UAV IDS enhancement","volume":"147","author":"Yoo","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"104133","DOI":"10.1016\/j.adhoc.2025.104133","article-title":"UpsFed-IDS: U-shaped split federated intrusion detection system for securing UAV communication in dynamic networks","volume":"183","author":"Wei","year":"2026","journal-title":"Ad Hoc Netw."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"103481","DOI":"10.1016\/j.cose.2023.103481","article-title":"Enhancing security and robustness of Cyphal on Controller Area Network in unmanned aerial vehicle environments","volume":"135","author":"Han","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"103878","DOI":"10.1016\/j.cose.2024.103878","article-title":"Exhaustive distributed intrusion detection system for UAVs attacks detection and security enforcement (E-DIDS)","volume":"142","author":"Tlili","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Allouch, A., Cheikhrouhou, O., Koubaa, A., Khalgui, M., and Abbes, T. (2019, January 24\u201328). MAVSec: Securing the MAVLink protocol for ArduPilot\/PX4 unmanned aerial systems. Proceedings of the 15th International Wireless Communications and Mobile Computing Conference (IWCMC 2019), Tangier, Morocco.","DOI":"10.1109\/IWCMC.2019.8766667"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Ko, Y., Kim, J., Duguma, D.G., Astillo, P.V., You, I., and Pau, G. (2021). Drone secure communication protocol for future sensitive applications in military zone. Sensors, 21.","DOI":"10.3390\/s21062057"},{"key":"ref_8","first-page":"21","article-title":"Cyberattacks and countermeasures for in-vehicle networks","volume":"54","author":"Aliwa","year":"2021","journal-title":"ACM Comput. Surv."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"39213","DOI":"10.1109\/ACCESS.2023.3268519","article-title":"G-IDCS: Graph-based intrusion detection and classification system for CAN protocol","volume":"11","author":"Park","year":"2023","journal-title":"IEEE Access"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"58194","DOI":"10.1109\/ACCESS.2020.2982544","article-title":"CANet: An unsupervised intrusion detection system for high dimensional CAN bus data","volume":"8","author":"Hanselmann","year":"2020","journal-title":"IEEE Access"},{"key":"ref_11","first-page":"993","article-title":"A practical wireless attack on the connected car and security protocol for in-vehicle CAN","volume":"16","author":"Woo","year":"2015","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Song, H.M., Kim, H.R., and Kim, H.K. (2016, January 13\u201315). Intrusion detection system based on the analysis of time intervals of CAN messages for in-vehicle network. Proceedings of the 30th International Conference on Information Networking (ICOIN 2016), Kota Kinabalu, Malaysia.","DOI":"10.1109\/ICOIN.2016.7427089"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"22596","DOI":"10.1109\/TITS.2022.3146024","article-title":"NovelADS: A novel anomaly detection system for intra-vehicular networks","volume":"23","author":"Agrawal","year":"2022","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_14","first-page":"100520","article-title":"Detecting in-vehicle intrusion via semi-supervised learning-based convolutional adversarial autoencoders","volume":"38","author":"Hoang","year":"2022","journal-title":"Veh. Commun."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"103567","DOI":"10.1016\/j.sysarc.2025.103567","article-title":"LUFT-CAN: A lightweight unsupervised learning based intrusion detection system with frequency-time analysis for vehicular CAN bus","volume":"168","author":"Xin","year":"2025","journal-title":"J. Syst. Archit."},{"key":"ref_16","first-page":"100198","article-title":"In-vehicle network intrusion detection using deep convolutional neural network","volume":"21","author":"Song","year":"2020","journal-title":"Veh. Commun."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"185489","DOI":"10.1109\/ACCESS.2020.3029307","article-title":"LSTM-based intrusion detection system for in-vehicle CAN bus communications","volume":"8","author":"Hossain","year":"2020","journal-title":"IEEE Access"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Seo, E., Song, H.M., and Kim, H.K. (2018, January 28\u201330). GIDS: GAN-based intrusion detection system for in-vehicle network. Proceedings of the 16th Annual Conference on Privacy, Security and Trust (PST 2018), Belfast, UK.","DOI":"10.1109\/PST.2018.8514157"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"48","DOI":"10.1016\/j.csi.2017.03.003","article-title":"Capacity and spectrum-aware communication framework for wireless sensor network-based smart grid applications","volume":"53","author":"Faheem","year":"2017","journal-title":"Comput. Stand. Interfaces"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"215219","DOI":"10.1109\/ACCESS.2025.3645058","article-title":"Intrusion detection systems for in-vehicle networks: Protocols, applications, and challenges","volume":"13","author":"Khan","year":"2025","journal-title":"IEEE Access"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"50811","DOI":"10.1109\/ACCESS.2026.3675250","article-title":"Efficient intrusion detection for intra-vehicle CAN network with light-weight deep learning-based model","volume":"14","author":"Singh","year":"2026","journal-title":"IEEE Access"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"104076","DOI":"10.1016\/j.cose.2024.104076","article-title":"DGIDS: Dynamic graph-based intrusion detection system for CAN","volume":"147","author":"Song","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_23","first-page":"100470","article-title":"Rec-CNN: In-vehicle networks intrusion detection using convolutional neural networks trained on recurrence plots","volume":"35","author":"Desta","year":"2022","journal-title":"Veh. Commun."},{"key":"ref_24","first-page":"100471","article-title":"A hybrid deep learning based intrusion detection system using spatial\u2013temporal representation of in-vehicle network traffic","volume":"35","author":"Lo","year":"2022","journal-title":"Veh. Commun."},{"key":"ref_25","first-page":"100956","article-title":"MetaCAN: An optimized adaptive hybrid metaheuristic-based intrusion detection system for CAN bus security","volume":"55","author":"Ileri","year":"2025","journal-title":"Veh. Commun."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Tlili, F., Ayed, S., and Chaari Fourati, L. (September, January 29). Dynamic intrusion detection framework for UAVCAN protocol using AI. Proceedings of the 18th International Conference on Availability, Reliability and Security (ARES 2023), Benevento, Italy.","DOI":"10.1145\/3600160.3605071"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"111157","DOI":"10.1016\/j.comnet.2025.111157","article-title":"UGL: A comprehensive hybrid model integrating GCN and LSTM for enhanced intrusion detection in UAV controller area networks","volume":"262","author":"Du","year":"2025","journal-title":"Comput. Netw."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"3418","DOI":"10.1109\/JIOT.2025.3634343","article-title":"WaveMamba: Intrusion detection in IoT systems using a Mamba module with embedded wavelet transform","volume":"13","author":"Wang","year":"2026","journal-title":"IEEE Internet Things J."},{"key":"ref_29","unstructured":"Robert Bosch GmbH (1991). CAN Specification Version 2.0, Robert Bosch GmbH."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Mohale, V.Z., and Obagbuwa, I.C. (2025). Evaluating machine learning-based intrusion detection systems with explainable AI: Enhancing transparency and interpretability. Front. Comput. Sci., 7.","DOI":"10.3389\/fcomp.2025.1520741"},{"key":"ref_31","unstructured":"Kim, D., Song, Y., Kwon, S., Kim, H., Yoo, J.D., and Kim, H.K. (2022). UAVCAN dataset description. arXiv."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/19\/6061\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,24]],"date-time":"2026-09-24T13:28:53Z","timestamp":1790256533000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/19\/6061"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,24]]},"references-count":31,"journal-issue":{"issue":"19","published-online":{"date-parts":[[2026,10]]}},"alternative-id":["s26196061"],"URL":"https:\/\/doi.org\/10.3390\/s26196061","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,24]]}}}