doi: 10.18178/jacn.2026.14.2.300
CANDOR: A Disentangled Deep Learning Architecture for Robust and Lightweight Intrusion Detection in Consumer Automotive Electronics
Hannah B. Pasandi
1,*
,
Poma Panezai
2
,
Bushra Qayyum
3
- 1 Department of Electrical Engineering and Computer Sciences, University of California, Berkeley, CA, USA
- 2 Department of Computer Science, Balochistan University of Information Technology, Engineering and Management Sciences, Quetta, Pakistan
- 3 Independent researcher
- Manuscript received September 17, 2026
- accepted October 12, 2026
- published October 27, 2026
Abstract
Learned intrusion detectors for the in-vehicle Controller Area Network score well on clean benchmarks, yet a small change to the eight payload bytes of a frame can blind them. In our measurements on the Real Oak Ridge National Laboratory Automotive Dynamometer (ROAD) benchmark, a payload-only perturbation cuts the F1-Score of a recurrent baseline detector from 0.63 to 0.13. We trace this failure to the representation rather than to data or model size. Joint detectors mix frame timing and payload into one feature vector, so an attacker who controls only the payload moves the whole vector. Timing behaves differently, because bus arbitration and each sender’s transmission schedule constrain when frames appear. We present CANDOR, a detector that keeps the two feature groups in separate branches and applies adversarial training only to the payload branch, the part an attacker can reach. A short analysis shows that the worst-case output change of this design depends only on the payload encoder and the fusion head. On ROAD, CANDOR keeps 96.4% of its clean F1-Score under a constrained projected-gradient attack, 4.7 times the retention of the strongest baseline, and on the Car-Hacking dataset it keeps 99.3%. The model has 78,432 parameters and classifies a frame in 4.8 microseconds on a Raspberry Pi 4. Masquerade traffic, which preserves the victim’s timing, remains the open weakness, and we outline how physical-layer sender fingerprints can close it.
Keywords
- controller area network
- in-vehicle networks
- intrusion detection
- adversarial robustness
- disentangled representation
- embedded network security
How to Cite
Hannah B. Pasandi, Poma Panezai, and Bushra Qayyum, "CANDOR: A Disentangled Deep Learning Architecture for Robust and Lightweight Intrusion Detection in Consumer Automotive Electronics," Journal of Advances in Computer Networks, vol. 14, no. 2, pp. 19-27, 2026. https://doi.org/ 10.18178/jacn.2026.14.2.300
Copyright & License
Copyright © 2026 by the authors. This is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited (CC BY 4.0).