File size: 2,597 Bytes
bbf53f3 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 | ---
license: cc-by-nc-nd-4.0
language:
- en
- de
tags:
- automotive
- IDS
- CAN
- CANIDS
- AutomotiveSecurity
- Cybersecurity
---
# CANDefender – Fuzzy Attack Detection Model
**Model Summary**
This model detects **Fuzzy attacks** on the CAN bus. It was trained on **4.73 million** real CAN frames, including normal data and Fuzzy-labeled data. The model uses an LSTM architecture that processes the CAN ID and 8-byte payload to classify each frame as either “Fuzzy” or “Normal.”
---
## Performance
**Test Accuracy**: ~94.09%
**Confusion Matrix** (Fuzzy vs. Normal):
| True \ Pred | Fuzzy (pred) | Normal (pred) |
|:-----------:|:-------------:|:-------------:|
| **Fuzzy** | 3,737,645 | 13,379 |
| **Normal** | 266,808 | 722,063 |
- **Recall (Fuzzy)**: ~99.6% (very few Fuzzy frames missed)
- **Recall (Normal)**: ~73% (about 27% false positives on Normal)
---
## Intended Use
- **Goal**: Real-time detection of **Fuzzy attacks** on the CAN bus.
- **Limitations**:
- Focused on Fuzzy vs. Normal classification only (other attacks handled in separate models).
- Tends to misclassify ~27% of normal frames as Fuzzy (relatively high false alarms).
---
## How to Use
```python
import torch
import numpy as np
from can_defender_fuzzy import CANLSTM # Adjust import name
# Example frame => [CAN_ID, b0..b7]
frame = [0x315, 0x12, 0x4F, 0xA2, 0x00, 0x00, 0x78, 0x1C, 0xAA]
x_np = np.array(frame, dtype=np.float32).reshape(1,1,9)
model = CANLSTM(input_dim=9, hidden_dim=64, num_classes=2)
model.load_state_dict(torch.load("can_lstm_model_final.pt"))
model.eval()
with torch.no_grad():
logits = model(torch.from_numpy(x_np))
pred = torch.argmax(logits, dim=1).item()
print("Prediction:", "Fuzzy" if pred == 0 else "Normal")
```
## Training Configuration
- Architecture: LSTM (64 hidden units), final linear layer → 2 classes (Fuzzy vs. Normal)
- Optimizer: Adam (lr=1e-3)
- Epochs: ~30 (stopped once performance stabilized)
- Dataset: 4.73 million CAN frames
## Limitations & Next Steps
- False Positives: ~27% of normal frames get labeled as Fuzzy. Acceptable for high-sensitivity scenarios, but can be improved (weighted loss, time-window approach, etc.).
- Scope: Only focuses on Fuzzy detection. Other attacks (DoS, Gear, RPM) are separate.
# Potential Enhancements:
- Weighted training or additional features (delta-time, frequency)
- Window-based LSTM or transformers for sequence data
## License & Contact
- License: cc-by-nc-nd-4.0
- Author: Keyvan Hardani
- Contact: https://www.linkedin.com/in/keyvanhardani/ |