LUFT-CAN: A lightweight unsupervised learning based intrusion detection system with frequency-time analysis for vehicular CAN bus

Abstract

The Controller Area Network (CAN) bus is critical for data transmission among electronic control units (ECUs) in modern vehicles, necessitating robust intrusion detection systems (IDS) for security. However, existing IDS approaches have several limitations. For example, rule based IDS methods depend on proprietary protocol knowledge, while most machine learning approaches rely on supervised training using outdated or limited datasets, hindering their ability to detect emerging threats. Furthermore, deep learning based IDS models often have high computational complexity, making them unsuitable for resource-constrained vehicular environments. To overcome these challenges, we propose LUFT-CAN, a novel, lightweight, unsupervised IDS that integrates frequency and time domain analysis of CAN traffic. By leveraging spectral characteristics of CAN ID sequences, LUFT-CAN effectively distinguishes between normal and anomalous traffic patterns. A tailored neural network architecture extracts these features, and the system is optimized via quantization-aware training for real-time inference on embedded systems. Experiments performed on datasets collected from modern vehicles, Tesla Model 3 2022 and LeapMotor C10 2024 as well as a public benchmark dataset demonstrate that LUFT-CAN achieves promising F1-scores of 97.1% and 96.7%, significantly outperforming previous approaches. We implemented the proposed IDS on a 2024 LeapMotor C10 test vehicle equipped with a Qualcomm 8295 microcontroller unit(MCU). The model’s inference time is 14.27 s per 100,000 frames, demonstrating its effectiveness and efficiency for in-vehicle deployment.