File size: 2,691 Bytes
851e537 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 | ---
license: cc-by-nc-nd-4.0
language:
- en
- de
metrics:
- accuracy
- code_eval
tags:
- '1.0'
---
# CANDefender – DoS Detection Model
**Model Summary**
This model detects **DoS attacks** on the CAN bus. It was trained on approximately **4.6 million** real CAN frames (both normal traffic and DoS data). The core is an **LSTM** architecture that processes the CAN ID and the 8-byte payload to classify each frame as either “DoS” or “Normal.”
---
## Performance
**Test Accuracy**: ~94.06%
**Confusion Matrix** (DoS vs. Normal):
| True \ Pred | DoS (pred) | Normal (pred) |
|:-----------:|:----------:|:-------------:|
| **DoS** | 3,632,463 | 2,120 |
| **Normal** | 272,327 | 716,544 |
- **Recall (DoS)**: ~99.94%
- **Recall (Normal)**: ~72%
_Interpretation:_ Almost no DoS frames are missed, but ~28% of normal traffic is misclassified as DoS (higher false alarms).
---
## Intended Use
- **Goal**: Real-time DoS detection on CAN bus data.
- **Limitations**:
- Focus on DoS only (other attack types like Fuzzy, Gear, RPM not covered).
- Tends to over-classify normal frames as DoS (False Positives around 28%).
---
## How to Use
```python
import torch
import numpy as np
from can_defender_dos import CANLSTM # replace with your actual import
# Example frame: [CAN_ID, b0, b1, ..., b7]
frame = [0x315, 0x12, 0x4F, 0xA2, 0x00, 0x00, 0x78, 0x1C, 0xAA]
# Convert to the same shape as the model expects: (batch_size, seq_len, features)
x_np = np.array(frame, dtype=np.float32).reshape(1, 1, 9)
model = CANLSTM(input_dim=9, hidden_dim=64, num_classes=2)
model.load_state_dict(torch.load("candefender_dos_final.pt"))
model.eval()
with torch.no_grad():
logits = model(torch.from_numpy(x_np))
pred = torch.argmax(logits, dim=1).item()
print("Prediction:", "DoS" if pred == 0 else "Normal")
```
## Training Configuration
- Architecture: LSTM (64 hidden units) + final linear output
- Optimizer: Adam, LR=1e-3
- Epochs: ~20 (stopped when performance saturated)
- Dataset: 4.6 million CAN frames, including normal + DoS
## Limitations & Next Steps
- False Positives: ~28% of normal frames labeled as DoS. Might be acceptable for high security environments, but can be reduced via further tuning or additional features (time windows, frequency, etc.).
- Focus on DoS: Future expansions for multi-class detection (Fuzzy, Gear, RPM) are possible.
- Potential Enhancements: Weighted loss for normal class, real-time deployment with window-based sequences, or transformer-based architectures.
## License & Contact
- License: cc-by-nc-nd-4.0
- Author: Keyvan Hardani
- Contact: https://www.linkedin.com/in/keyvanhardani/ |