# Federated Learning for Secure In-Vehicle Communication
## 3 Federated Learning-Based Intrusion Detection Framework
### Problem Statement  
In-vehicle networks use sensors to collect CAVs data from the outside environment. The collected data is then broadcasted among the in-vehicle network components such as ECUs using the CAN bus. The CAN gateway transfers the CAN frames between CAN bus and OBU without any encryption or authentication procedures. Therefore, this lack of protection opens the door for many attack vectors that originate either through compromised V2X interfaces or directly on unsecured ECUs within the local in-vehicle network.  
To link the internal and external networks, the OBU acts as a bridge and is directly connected to the CAN gateway. Therefore, attacks that successfully exploit vulnerabilities in the OBU, e.g., those arising from V2X messages or external data injection, can lead to the injection of malicious CAN frames into the internal bus via the gateway. This direct connection enables remote or close attackers to affect safety-critical functionality in the vehicle. An attack can lead to dangerous scenarios, including brake failure, runaway vehicle, or full vehicle loss of control, and put passengers and other road users at risk. One of the most dangerous threats is the Flooding Attack, where an attacker introduces a massive number of malicious CAN messages at high rates to jam ordinary communication. This attack exploits the priority-based arbitration mechanism of the CAN protocol, withholding important messages such as braking commands, speed control, and hazard detection signals from reaching their destination ECUs in a timely manner. This makes legitimate messages, such as emergency braking signals, delayed or lost due to continuous arbitration loss to the attack frames. Important communication between ECUs is blocked, rendering important vehicle operations futile. Continuous message flooding can cause certain ECUs to crash or reset, leading to unstable vehicle performance. To defend against the consequences of such attacks, we adopt a deep learning-based approach that leverages federated learning to detect attacks in an in-vehicular network. Attack detection includes, initially, each CAV constantly receiving CAN frames to construct real-time network traffic patterns.  
The system identifies unusual patterns such as unanticipated bursts in message rates, abnormally short inter-arrival times, and high bus utilization, typically in case of flooding attacks. Each vehicle uses an OBU locally to train a DL model based on its historically labeled CAN traffic data to learn normal and abnormal messages. After training the model locally, the parameters of the model are transmitted via the CAN gateway to an external federated learning server, located at the edge network, for a global update. In this way, numerous vehicles (OBUs) collaboratively improve the IDS model by sharing updates to all models with the centralized server without sacrificing data privacy. The trained IDS model is then rolled out to each vehicle, which continuously monitors incoming CAN traffic for anomalies. By leveraging FL with edge computing, the solution delivers real-time, privacy-preserving, and adaptive intrusion detection to protect existing connected vehicles from cyberattacks without centralizing key CAN information.