DriveShield: attention-based hybrid neural network for intrusion detection in automotive controller area networks

Abstract

Vehicle network security is important as increasing amounts of connected technology are being added to vehicles nowadays, putting them at risk of cyberattacks. This paper presents DriveShield, a novel real-time intrusion detection system (IDS) that is the first to combine gated recurrent units (GRU), convolutional neural networks (CNN), and long short-term memory (LSTM) with an attention mechanism. The systematic pre-processing pipeline, which includes feature engineering, the synthetic minority oversampling technique (SMOTE) for class balancing, and normalization. The model was validated on the open training intrusion detection system (OTIDS) dataset and the Hacking and Countermeasure Research Lab (HCRL) car hacking dataset. In the HCRL dataset, the model had an accuracy of 96.30% with F1-scores as high as 96% for all kinds of attacks. On the OTIDS dataset, it performed very well in terms of generalization, with a highest accuracy of 99.78% and a weighted F1-score of 99.78%. The addition of an attention mechanism enabled the model to concentrate on the most significant features, providing better adaptability to changing threats. These findings demonstrate the efficacy, scalability, and reliability of the system for in-vehicle network security. The future research will focus on performance on lower-frequency attacks through the study of unsupervised learning methods and real-world deployment trials.