Digital twin-based evaluation of vehicular controller area network intrusion detection systems - Sharmin, Shaila; Mansor, Hafizah; Abdul Kadir, Andi Fitriah; Ismail, Amelia Ritahani (IIUM Press, 2025)
The functions and operations of a modern automobile are becoming increasingly computerised, with this transformation made possible by Electronic Control Units (ECUs) that communicate and coordinate with each other on the in-vehicle network. Controller Area Network (CAN) is one of the most popular protocols for the in-vehicle network, supporting low latency and reliable communications. However, the CAN protocol does not have provisions for security, such as encryption, authentication, and authorisation, which makes it vulnerable to cyberattacks, particularly in today’s automotive landscape characterised by extensive connectivity with external devices, vehicles, and infrastructure. While intrusion detection systems (IDS) for CAN have emerged as a key security measure, assessing their performance against realistic attacks remains a challenge since testing with real vehicles poses significant costs and safety risks and testbeds suffer from a lack of fidelity in terms of the CAN frame transmission timings and generated payloads. This work proposes a digital twin (DT)-based framework for CAN IDS evaluation that replicates the functionality of real-world ECUs and CAN bus of a vehicle with real-time flow of data from the physical bus to its virtual representation. The main contribution of this work is a CAN DT that can not only enable the generation of realistic attack traffic for simple and sophisticated attack scenarios but also the generation of diverse combinations of attack and real driving scenarios. This DT can facilitate the evaluation of both the detection capability and performance of CAN IDS. This work presents the methodology for generating the proposed DT and discusses current findings as well as future work