Lightweight CNN-Based Intrusion Detection for CAN Bus Networks

Abstract

The Controller Area Network (CAN) bus plays a key role in keeping vehicles safe by enabling critical systems to communicate with each other. However, because it does not have its own security features, the CAN bus is open to cyber threats. A CAN bus intrusion detection system (IDS) is critical for automotive cybersecurity. This has made it especially important to create IDS that are not just accurate but also efficient enough to run on the limited hardware of Electronic Control Units (ECUs). Unfortunately, many current deep learning solutions for CAN intrusion detection use large and complex models that are too demanding for most automotive systems. Moreover, existing deep learning approaches need excessive computational resources that are unsuitable for resource-constrained ECUs. We propose TinyCNNCANNet, an ultra-lightweight convolutional neural network with just 13K parameters, designed to provide low-latency and resource-efficient CAN intrusion detection under experimental settings. Rather than focusing on on-vehicle deployment, this work evaluates the feasibility of lightweight CNN architectures for future real-time capable CAN intrusion detection. We comprehensively evaluate TinyCNNCANNet on four diverse datasets: CANFD 2021, CICIoV 2024, Multi-Fuzzer-CAN 2025, and SynCAN 2025. These datasets encompass nine attack types. TinyCNNCANNet achieves competitive or superior performance compared to models with 115- $300\times $ more parameters. All architectures detect volume-based attacks (DoS, flooding, and fuzzing) most effectively. Sophisticated attacks (malfunction and fuzzer variants) challenge all models to a similar degree, regardless of complexity. TinyCNNCANNet shows superior generalization on synthetic out-of-distribution data (SynCAN 2025). It achieves 100% accuracy, while EfficientCANNet (86.82%) and MobileNetCANNet (59.33%) fail, revealing overfitting vulnerabilities in complex models. TinyCNNCANNet delivers 12- $20\times $ faster inference (0.16-0.51 ms vs. 2.14-4.15 ms) and a 145- $383\times $ smaller model size (0.04 MB vs. 5.81-15.32 MB). These results demonstrate the potential of TinyCNNCANNet for real-time capable CAN intrusion detection and indicate its suitability for future deployment on embedded automotive platforms.