A Novel Intrusion Detection System Using Cyclic Redundancy Check Field for In-Vehicle Networks

This paper introduces a novel intrusion detection system (IDS) suitable for both CAN and CAN-FD protocols, which are widely used in vehicle networks. Since most existing machine learning-based IDS are designed without considering the CAN-FD data frame, their application to CAN-FD systems increases model complexity or complicate implementation. This issue is particularly noticeable in models that use data payloads as input features, since CAN allows data payloads of up to 8 bytes, whereas CAN-FD is capable of up to 64 bytes. To address this problem, we propose a novel approach that utilizes CAN ID and CRC fields. This is because the CRC field is calculated based on the data field in both CAN and CAN-FD protocols, which eliminates the need to separately adopt the data field as a feature. We evaluated the performance of an LSTM-based IDS trained with these features. Experimental results confirm that our IDS achieves near-perfect detection performance and is significantly more lightweight compared to existing models.