Privacy-preserving multiclass intrusion detection in in-vehicle CAN networks using federated learning

The Controller Area Network (CAN) bus serves as the primary communication backbone in modern connected vehicles. However, the lack of built-in encryption and authentication mechanisms makes CAN-based systems vulnerable to a wide range of cyberattacks, including spoofing, denial-of-service (DoS), and replay attacks. These security weaknesses pose significant challenges for the safe operation of intelligent transportation systems. This paper proposes a privacy-preserving intrusion detection system based on federated learning for multiclass classification of CAN bus traffic, using the CICIoT2024 dataset. Two federated deep learning models, namely Fed-DLSTM and a hybrid Fed CNN-BiLSTM, are developed and evaluated under both centralized and decentralized training settings. The decentralized scenario is realized through collaborative training across multiple clients, enabling model learning without the exchange of raw vehicular data. The hybrid CNN-BiLSTM architecture effectively captures both spatial correlations and temporal dependencies in CAN messages, resulting in robust detection of complex intrusion patterns. Experimental results demonstrate that the proposed models achieve high detection performance, with classification accuracy reaching up to 99% and consistently strong precision, recall, and F1-scores across six classes of benign and malicious traffic. These results indicate that the proposed federated framework provides a practical balance between detection accuracy and data privacy. To the best of our knowledge, this study represents the first federated learning–based intrusion detection architecture evaluated on the CICIoT2024 multiclass dataset. The proposed approach offers a scalable and privacy-aware solution for real-time intrusion detection in connected and intelligent vehicular networks.