LiPar: A Lightweight Parallel Learning Model for Practical In-Vehicle Network Intrusion Detection

TL;DR

This work tackles intrusion detection for the in-vehicle CAN bus under strict on-board resource constraints. It introduces LiPar, a lightweight parallel learning framework that distributes multiple shallow branches across ECUs, combining DWParNet for spatial feature extraction and STParNet for temporal feature extraction, with a resource-adaptation algorithm to map branches to available hardware. Empirical results on the Car-Hacking CAN dataset show near-perfect detection performance (top-1 accuracy and AUC around 1.0) while keeping the total branch footprint well under 1 MB, outperforming lightweight baselines such as MobileNetV3, EfficientNet, and CANet in both accuracy and efficiency. The approach demonstrates practical viability for on-vehicle deployment, offering robust spatial-temporal fusion and dynamic ECU-level resource management for CAN bus intrusion detection.

Abstract

With the development of intelligent transportation systems, vehicles are exposed to a complex network environment. As the main network of in-vehicle networks, the controller area network (CAN) has many potential security hazards, resulting in higher generalization capability and lighter security requirements for intrusion detection systems to ensure safety. Among intrusion detection technologies, methods based on deep learning work best without prior expert knowledge. However, they all have a large model size and usually rely on large computing power such as cloud computing, and are therefore not suitable to be installed on the in-vehicle network. Therefore, we explore computational resource allocation schemes in in-vehicle network and propose a lightweight parallel neural network structure, LiPar, which achieve enhanced generalization capability for identifying normal and abnormal patterns of in-vehicle communication flows to achieve effective intrusion detection while improving the utilization of limited computing resources. In particular, LiPar adaptationally allocates task loads to in-vehicle computing devices, such as multiple electronic control units, domain controllers, computing gateways through evaluates whether a computing device is suitable to undertake the branch computing tasks according to its real-time resource occupancy. Through experiments, we prove that LiPar has great detection performance, running efficiency, and lightweight model size, which can be well adapted to the in-vehicle environment practically and protect the in-vehicle CAN bus security. Furthermore, with only the common multi-dimensional branch convolution networks for detection, LiPar can have a high potential for generalization in spatial and temporal feature fusion learning.

Figures (13)

• Figure 1: The topology of in-vehicle CAN bus and the possible attack routes: (a) attacking through the OBD-II port; (b) attacking from the external interfaces; (c) attacking by infected ECU to occupy the CAN bus.
• Figure 2: The standard data frame of CAN bus.
• Figure 3: The schematic diagram of ECU internal structure.
• Figure 4: The schematic diagram of convolution calculation. The convolution kernel is used as the weight to multiply and add the corresponding input data pixel points to obtain a neuron of the feature map. Then, the convolution kernel is sliding according to the step size (1 in this figure) to calculate other neurons, forming a complete feature map.
• Figure 5: The schematic diagram of recurrent neural networks.