# CANPerFL: Improve In-Vehicle Intrusion Detection Performance by Sharing Knowledge
## 3 Related Works
### Machine Learning-Based IDS  
Many researchers have applied several machine learning and deep learning techniques to detect invasion on the CAN bus scrupulously. For instance, the idea of using hierarchical temporal memory (HTM) was proposed [17] to develop a distributed anomaly detection system for the in-vehicle network. The proposed system predicted the next bit based on the data stream of each CAN ID and calculated the anomalous score based on the incoming data and the prediction to determine if any attack exists. [PERSON] et al. [18] presented an induced Inception ResNet model trained based on a sequential binary CAN ID matrix. The study became state-of-the-art in the field when achieving a relatively small error rate compared to other models. However, the proposed architecture is considered to be complex for deploying in an ECU. The IDS model was defined as an LSTM autoencoder fed by various signals along with corresponding CAN IDs and trained with reconstruction loss [19]. While the idea is interesting, the results of this study need to be further improved. [PERSON] et al. [20] introduced a new way of encoding CAN data by using a histogram of sequential CAN data fields. Then, a one-class support vector machine (OCSVM) model was trained to detect attacks on the CAN bus. However, the model required a large window size to achieve high performance. [PERSON] et al. [21] developed a lightweight deep-learning CNN model based on recurrence plots built from various continuous CAN IDs. Although the model was able to adapt to time and hardware constraints, it was not good with multiclass classification. Sequential patterns existing in CAN IDs can be utilized the to build a model, which predicts the next CAN ID given a sequence [22]. For prediction, the authors used a bi-directional generative pretrained transformer (GPT), which is a recent advanced model in natural language processing. There are two bidirectional GPT models implemented as intrusion detection systems (IDS), where the CAN ID sequences are converted into integers, and performance is evaluated using negative log-likelihood (NNL). To improve the performance of IDS, [PERSON] et al. [23] combined both rule-based and machine learning-based methods to develop a hybrid two-stage IDS. The proposed system is shown efficient when tested on their own collected datasets. Electric signals generated during transmission of Controller Area Network (CAN) packets contain slight variations that can identify individual Electronic Control Units (ECUs). [PERSON] et al. [24] utilized the CAN ID field of CAN packets to create digital fingerprints for all ECUs. By measuring the electric signals associated with the CAN ID field, the authors generated fingerprints for the IDS. The IDS was evaluated in a simulated environment with ten USB-to-CAN devices and five CAN development boards. [PERSON] et al. [25] found that malicious CAN packets can affect response time distributions of ECUs. They proposed an IDS that periodically sends request messages to all ECUs and compared their response times to known distributions. If a response time deviates from its expected distribution, it may indicate malicious packet injections. However, the IDS is limited to detecting attacks that affect response times. [PERSON] et al. [26] identified four common data types in the Controller Area Network (CAN) data field: constant value, multi-value, counter value, and sensor value. As commercial vehicle CAN packet specifications are confidential, an algorithm was developed to assign each part of the 64-bit CAN data field to one of the four data types. Classification and specific rules for each data type were used to identify potential attacks on the automotive CAN system. [PERSON] et al. [27] proposed VoltageIDS, an IDS for automotive networks that utilizes the physical properties of electrical signals for transmitting CAN messages. The system operates in three phases: feature extraction, feature selection, and intrusion detection.