A Compact Dual-Stream Multi-Scale Separable Temporal Convolutional Network for Controller Area Network Intrusion Detection

The lack of authentication and message integrity mechanisms in the Controller Area Network (CAN) exposes in-vehicle communication to flooding, fuzzing, spoofing, and replay attacks. This study presents a compact dual-stream causal depthwise-separable Temporal Convolutional Network (TCN) for five-class CAN intrusion detection. A global stream processes 32-frame windows with 11 CAN-derived features, while a same-ID stream encodes 16 occurrences using 28 causal history features. Residual temporal encoders, average and last-step pooling, learned gated fusion, and hierarchical Normal/Attack and attack-type classification are combined in a 19,685-parameter model. The model is developed separately on the Driving and Stationary preliminary submission recordings of the Car Hacking: Attack and Defense Challenge 2020 dataset using chronological 60% training and 20% validation partitions, with the final 20% reserved from model testing. Across five training seeds, validation macro-F1 reaches 98.40 ± 0.08% and 97.50 ± 0.37% for Driving and Stationary, respectively. Corresponding Spoofing F1-scores are 99.63% and 99.70%; Replay remains more challenging compared to other attacks, achieving mean F1-scores of 93.30 ± 0.42% and 88.40 ± 1.74%, for Driving and Stationary, respectively. Analysis of the validation confusion matrices shows remaining confusion between Replay and Normal traffic. In zero-shot evaluation on AutoHack_2025 dataset, mean macro F1-scores decreased to 40.20% and 34.97% for the Driving-trained and Stationary-trained models, respectively, with substantial degradation in Spoofing and Replay detection. These results demonstrate strong five-class detection under chronological within-recording validation while identifying cross-dataset robustness as the principal limitation of the current dual-stream temporal representation.