A HYBRID LIGHTGBM–1D CNN FRAMEWORK FOR ANOMALY DETECTION IN VEHICULAR CAN TRAFFIC

Abstract

The Controller Area Network (CAN) protocol serves as the principal in-vehicle com munication backbone in modern automobiles, enabling real-time interaction between dozens of Electronic Control Units (ECUs) that govern safety-critical functions such as braking, steering, engine control and infotainment. CAN was designed in the 1980s for reliability rather than security; it carries no authentication, no encryption and no message-origin verification. As the vehicle has evolved into a connected, networked cyber-physical system, this design choice has been transformed from an engineering simplification into a serious attack surface, exposing road users to Denial-of-Service (DoS), Fuzzy, Impersonation and injection attacks that can disable steering, falsify telemetry or freeze the bus. This thesis presents a hybrid machine-learning Intrusion Detection System (IDS) for in-vehicle CAN networks that combines a fast, interpretable ensemble model with a deep sequence learner. Two complementary models are proposed and evaluated: a Light Gradient Boosting Machine (LightGBM) classifier configured for embedded-grade inference, and a One-Dimensional Convolutional Neural Network (1D-CNN) that learns spatial and temporal dependencies directly from sequences of CAN payload bytes. Both models are trained on a stratified, four-class subset of the HCRL Car-Hacking dataset comprising 400,000 messages drawn from approximately seven million real-vehicle CAN frames, balanced across Normal, DoS, Fuzzy and Impersonation traffic. A four-feature engineered enrichment (DataSum, DataMean, DataStd and TimeDiff) is added to the eleven raw fields to expose statistical and temporal irregularities of attack pay loads. A comparative evaluation against classical baselines from the author’s earlier stud ies (Support Vector Machine, Decision Tree and K-Nearest Neighbour) shows that LightGBM achieves an overall accuracy of 89.34% with sub-second training time and iv a memory footprint below 60 KB, making it attractive for deployment on resource constrained ECUs. The 1D-CNNattains 83.77%accuracy while demonstrating stronger generalisation to subtle temporal anomaly patterns, particularly for the Fuzzy attack class. A per-class confusion-matrix analysis, combined with Cohen’s κ and ROC-AUC measurements, confirms that the two models capture different aspects of the attack space and are therefore mutually complementary rather than redundant. The the sis concludes with a discussion of latency, embedded-deployment trade-offs, identified research gaps, and the social implications of robust vehicular intrusion detection.