Hybrid-CNN Intrusion Detection Framework for CAN Networks in Connected and Autonomous Vehicles

The increasing cyber-physical integration in connected and autonomous vehicles (CAVs) has amplified the need for robust intrusion detection systems (IDS) to secure controller area network (CAN) communications. Existing deep learning approaches, such as CNNs and LSTMs, have demonstrated strong potential but often struggle to detect stealthy and sophisticated attacks, primarily due to inadequate temporal modeling and the use of datasets with limited fidelity that do not reflect real-world attack complexities. To address these limitations, we propose an optimized hybrid IDS model that integrates one-dimensional convolutional neural networks (1D-CNN) with bidirectional long short-term memory (BiLSTM) layers. The architecture is specifically designed to extract spatio-temporal features from CAN traffic with minimal complexity, enabling efficient detection of subtle attack patterns. Our model incorporates a time-aware design that allows it to detect attacks as they evolve, even when they occur in localized segments of the payload. It was trained and evaluated using the high-fidelity ORNL ROAD dataset, which includes physically validated fuzzing and targeted CAN ID attacks. The proposed model achieved an accuracy of 99.73%, a Matthews Correlation Coefficient (MCC) of 0.9401, and maintained average low false positive of (≤ 0.00045) and false negative of (≤ 0.00047) rates. It also demonstrated a low average prediction latency of 0.535 milliseconds per CAN frame, highlighting its architectural efficiency. This performance reflects a deliberate design balance between lightweight complexity and high detection accuracy, advancing the development of practical and robust deep learning-based IDS solutions for modern vehicular networks.