AI
CAN Bus Blindness and the Need for Unsupervised Learning
CAN buses have no authentication, encryption, or integrity checks. Every message is broadcast to all nodes. Traditional anomaly detection requires decoding the protocol and knowing signal definitions for each vehicle model. That does not scale across fleets or vendors. Ravi Rajput’s approach uses unsupervised machine learning on raw CAN frames. LSTM and LSTM-VAE models learn the normal sequence of CAN IDs, timing deltas, and payload entropy. They flag deviations without knowing what a specific signal means.
How LSTM and LSTM-VAE Detect Sequence Breaks
LSTM networks maintain a cell state with forget, input, and output gates. They process CAN frames as a sequence, learning normal timing and ID patterns. The sequence-to-sequence autoencoder reconstructs the input; high reconstruction error signals an anomaly. LSTM-VAE extends this by learning a latent distribution with mean and variance. It samples from that distribution, handling the natural noise of automotive networks. The KL divergence term measures how far the latent vector strays from normal. Replay attacks produce a KL spike; fuzzing appears as an entropy spike.
Data Pipeline and Live Demo on Door Lock CAN ID 19B
The data pipeline captures normal CAN traffic logs. Features are extracted: timestamp differences (delta t), payload entropy, and CAN ID frequency in a sliding window. Sequences are normalized and fed to the model. Training uses only normal data. During evaluation on attack logs, the model computes reconstruction error. Rajput demonstrated on a vehicle simulator. Door lock CAN ID 19B was fuzzed. Plain LSTM showed some false positives. LSTM-VAE produced a distinct peak for 19B, correctly identifying the anomaly with higher confidence.
Key Findings and Deployment Possibilities
Unseen CAN IDs appearing at high frequency, payload entropy spikes, and timing deviations were reliably detected. The LSTM-VAE handled noisy environments better than plain LSTM. Rajput stated deployment options include a lighter model on ECUs or integration into VSOC and SIM platforms. Code and model will be published on GitHub after the talk.
Q&A
What is the application? Is this specially designed for intrusion detection? Ravi Rajput confirmed the current work focuses on intrusion detection; prevention is not yet figured out. ▶ 18:00
Notable Quotes
anomalies doesn’t mean that one wrong message. It’s a break in the context. Ravi Rajput · ▶ 3:42
It’s like a musician trying to play a music and if he misses a note or uh do some some minor mistake the whole music is disrupted. Ravi Rajput · ▶ 5:31
why uncertaintity matters in a can anomaly detection as automotive networks are noisy and busty. Static threshold can cause false positives. Ravi Rajput · ▶ 9:36
Key Takeaways
- Unsupervised LSTM-VAE detects CAN anomalies without decoding, scaling across vehicle models.
- LSTM-VAE reduces false positives compared to plain LSTM by learning a distribution of normal behavior.
- Code and model will be released on GitHub; a lighter version can run on ECUs for real-time detection.
About the Speaker(s)
Ravi Rajput is a principal architect in information security at New Tech Global. He has expertise in Belgium and automotive service security. He launched an automotive pen testing OS called Autoac OS at Black Hat Arsenal in Asia, which has reached millions of downloads and is used by OEMs. He is a core team member of the Telecom Village at DEF CON.