# CANPerFL: Improve In-Vehicle Intrusion Detection Performance by Sharing Knowledge
## 2 Controller Area Network Background  
The Controller Area Network (CAN) is a serial data communication technology that was developed by Robert Bosch GmbH in the 1980s to facilitate efficient communication between automotive applications. The data frame format of CAN 2.0B, shown in Figure 1, uses either a single or double wire arrangement with data rates up to 1 Mb/s [2]. This protocol allows each module in a vehicle to communicate with one another, transmitting and receiving driving data. Multiple ECUs are connected in parallel through the CAN bus, including C-CAN, M-CAN, and B-CAN [9]. C-CAN is responsible for generating data such as speed, RPM, and brake data, while B-CAN is a network that communicates messages to control various parts of the vehicle. M-CAN is responsible for navigating media and entertainment information [10].  
The CAN bus frame consists of four types: data frame, error frame, overload frame, and remote frame [2]. Each of these frames has a standard structure that includes different fields: arbitration identifier, data, acknowledgment, and others. The definition of each field of a CAN frame is shown in Figure 1. The start of frame (SOF) indicates the beginning of a CAN message with a dominant bit, and it informs all nodes to begin CAN message transmission. The arbitration field consists of 11 bits, which can be expanded to 29 bits. The control field, also known as the check field, provides data from the receiver to check if all transmitted packets are working properly. The data field contains actual information for CAN nodes to perform actions and can be 8 bytes. The CRC field, also known as the cyclic redundancy code or security field, is a 15-bit error detection tool that checks for packet validity. The acknowledge (ACK) field, also known as the confirmation field, ensures that the receiver nodes have received the CAN packet correctly. If an error is detected during the transmission process, the transmitter is promptly notified by the receiver to resend their data packets. The EOF field indicates the end of the CAN datasets with a flag of a dormant bit. Data frames are used to transfer CAN packet information (Request Command) from the sender. Therefore, the CAN bus communicates with other nodes by transmitting packets through data frames. Whenever the remote transmission request (RTR) bit is flagged as dominant, it becomes a CAN data frame.  
Advanced technology in the automotive industry has led to an increase in the number of vehicles that are connected to external devices and services, making them susceptible to attacks. This includes the use of wireless connections, such as Bluetooth, Wi-Fi, and mobile phone networks, which opens an access point for the assaulters [11]. In addition, electric vehicles' OTA updates also present a potential vulnerability for attackers, where the Tesla S model became under attack through a Wi-Fi hotspot [12]. These entry points for attack include things such as GPS, LiDAR, camera sensors, tire pressure monitoring systems, and the OBD-II port [13; 14; 15]. These can all be manipulated to create serious attack scenarios. The internal architecture of vehicles has become more complex as a result of these new technologies, making them more vulnerable to attacks.  
Figure 1: Controller Area Network Specification.