A Hardware–Software Co-Designed Lightweight CNN–MLP Accelerator for CAN Intrusion Detection on FPGA

Modern cars are no longer just machines with engines and wheels; they are rolling networks of dozens of small computers, known as electronic control units, that constantly talk to one another to manage everything from braking to steering. These computers communicate over a shared highway called the Controller Area Network, or CAN bus. For decades, this system has worked reliably because it was designed for speed and simplicity, not for security. It lacks the digital locks and identity checks found in modern internet connections, meaning that if a hacker can plug into the car's diagnostic port or access its wiring, they can send false messages that look just like legitimate ones. This vulnerability allows attackers to flood the network with noise, confuse the car's systems, or even take control of critical functions. To stop these threats, engineers are turning to artificial intelligence, specifically systems that can learn to spot the subtle patterns of a cyberattack in real time. However, these smart systems usually require powerful computers that consume too much energy and take too long to process data to fit inside a car's limited electronic brain.

A team of researchers from Sfax University in Tunisia has tackled this problem by creating a new kind of security system that is both smart enough to detect attacks and small enough to run on a car's existing hardware. Instead of trying to force a massive, complex computer program into a tiny space, they designed a lightweight system from the ground up, carefully balancing the software that does the thinking with the specialized hardware that does the work. They built a custom accelerator on a chip called an FPGA, which is a reconfigurable computer chip often used in engineering because it can be programmed to perform specific tasks with incredible speed and low power usage. The researchers did not simply take a standard security program and shrink it; they co-designed the entire system, shaping the artificial intelligence model to fit the hardware's strengths while tailoring the hardware to handle the model's needs.

The core of their solution is a hybrid architecture that combines two types of neural networks, which are computer systems modeled after the human brain. One part looks for short-term patterns in the flow of data, while the other part makes the final decision on whether a message is safe or malicious. This design avoids the heavy, sequential processing steps that slow down other types of AI, allowing the system to analyze traffic as it flows through the car's network without delay. To make this work on a chip with limited memory, the researchers used a technique called heterogeneous fixed-point quantization. In plain terms, this means they adjusted the precision of the numbers the computer uses for different parts of the calculation. They kept high precision for the most critical parts of the decision-making process to ensure accuracy, while using simpler, lower-precision numbers for the less critical steps to save space and energy. This approach allowed them to keep the system's brain compact without losing its ability to spot subtle threats.

When the researchers tested their system using a well-known dataset of car network traffic that included normal driving as well as simulated attacks like denial-of-service floods and impersonation attempts, the results were striking. The system correctly identified the type of traffic with an accuracy of 99.28 percent, meaning it rarely made mistakes in distinguishing between a safe car and a hacked one. More importantly, it did this with extreme speed and efficiency. The system could analyze a new set of data and make a decision in just 0.138 milliseconds, a timeframe so short that it happens almost instantly from a human perspective. It also consumed very little power, drawing only 1.793 watts while running, which is a level of energy efficiency that makes it feasible for a car to run this security monitor continuously without draining the battery.

The researchers compared their approach to other methods that have been tried on similar hardware. Many existing solutions either rely on extreme simplifications that make the numbers unstable or use complex, sequential designs that are too slow for real-time safety. Others depend on specific, proprietary hardware that cannot be easily moved to different car models. The new design avoids these pitfalls by finding a middle ground. It achieves nearly the same detection accuracy as the most complex models but runs significantly faster and uses less power. The team measured a specific efficiency score that combined accuracy, speed, and power usage, and their system scored more than twice as high as other leading approaches. This suggests that the trade-off between being smart and being efficient is not a zero-sum game; by designing the software and hardware together, it is possible to have both.

The system was built and tested on a Xilinx Zynq-7020 chip, a type of processor that combines a general-purpose computer core with the specialized logic needed for this kind of acceleration. The researchers used a high-level synthesis workflow, which is a method that automatically translates the software design into the specific instructions the hardware chip needs to execute. This allowed them to create a fully pipelined data flow, where the system processes data in a continuous stream, much like an assembly line where a new item is processed every single moment the machine is running. This design ensures that the car's security system never has to wait for the previous calculation to finish before starting the next one, providing a steady, predictable response that is essential for safety-critical applications.

While the results are promising, the researchers acknowledge that their work is a step toward a larger goal. The testing was done using a specific dataset of recorded traffic, which provides a controlled environment but may not capture every possible variation of a real-world attack or the chaotic conditions of a busy road. They also noted that a significant portion of the total power consumption came from the general-purpose processor part of the chip, suggesting that further refinements could make the system even more energy-efficient. Despite these limitations, the study demonstrates that it is possible to embed sophisticated artificial intelligence directly into the electronic control units of a vehicle. This opens the door for cars that can defend themselves against cyberattacks in real time, protecting the safety of the vehicle and its passengers without relying on slow connections to the cloud or bulky external computers. The work proves that with careful engineering, the constraints of embedded hardware do not have to be a barrier to advanced security.