# CANPerFL: Improve In-Vehicle Intrusion Detection Performance by Sharing Knowledge
## 1 Introduction  
Intelligent and connected vehicles have become a key research area for the automobile industry. These vehicles assist drivers with various advanced features, such as traction control systems (TCS) and automatic collision avoidance systems (ACAS). However, these technologies unintentionally introduce several interfaces for attackers who can access a vehicle and control it for malicious intentions. The idea has been shown practically for a few years. For example, [PERSON] and [PERSON] [1] demonstrated how an attacker could remotely take control of vehicle's systems, including the engine, brakes, and steering. One critical and vulnerable part of vehicles is in-vehicle networks, e.g., the controller area network (CAN) system. CAN is a high-speed communication protocol used in automobiles to allow different electronic devices to communicate with each other [2]. One potential vulnerability is the lack of authentication, which means that any device connected to the CAN bus can potentially send messages. This can allow an attacker to inject false or malicious messages onto the bus, causing problems with the vehicle's operation. To address these security concerns, an intrusion detection system (IDS) can be installed on an electronic control unit (ECU) of a CAN bus to detect and alert the user of any potential attacks or anomalies in the messages being sent on the bus. Detection performance is one of the most critical properties of an IDS, with high accuracy and low missed detection rate being essential. Among several approaches such asrule-based and statistical methods, deep learning-based IDSs are preferred to learn normal behavior and detect anomalies on the CAN bus based on its noticeable achievements. A robust deep learning model for the in-vehicle network IDS, however, requires a large dataset, which takes a long time to collect, particularly with abnormal data. To tackle this problem, previous studies propose unsupervised models [3, 4, 5], and semi-supervised models [6]. Unsupervised models learn only normal patterns in the training dataset and detect intrusion by measuring the difference between the learned representation and the sample test. Meanwhile, semi-supervised models utilize the unlabeled data as additional knowledge, which can improve the overall performance of the model when a small labeled dataset is available. Yet, these approaches have some limitations. First, an appropriate threshold needs to be determined in the unsupervised model, which can affect the final result. For example, several studies set a high threshold [3], leading to a high false positive rate. Second, in the semi-supervised models [6], there is an assumption about the attack data amount in unlabeled data, which is difficult to achieve in reality. Moreover, transfer learning is lately applied to design an in-vehicle IDS to address the problem of scarce data. The idea behind transfer learning is that the model's knowledge of a source task can be exploited as a starting point for learning other target tasks, allowing the model to learn more quickly and effectively than if it was starting from scratch. As a result, the target tasks do not need a large dataset. For example, the study [7] successfully transferred knowledge of a pretrained model trained on a large CAN bus dataset to a smaller one in a different manufacturer. In this study, we aim to extend the idea of transfer learning by incorporating different data sources from different car manufacturers. Existing transfer learning and multiple task learning studies have confirmed that the same domain data may share a global feature representation, despite statistical differences across datasets [8]. In IDS research for CAN bus context, the study [7] utilized only a specific model trained solely on a particular CAN dataset for transferring. This leads to the question whether we could utilize all data from different car manufacturers to improve the performance of IDS for each participant.