Inspiration
Modern connected vehicles are increasingly vulnerable to cyberattacks. The Controller Area Network (CAN) bus, which connects critical Electronic Control Units (ECUs) in cars, operates entirely without encryption or authentication. This leaves vehicles open to high-consequence attacks like Denial of Service (DoS), payload fuzzing, and sensor spoofing. We built SentryCAN to explore how edge-capable AI can inspect packet-level telemetry in real-time, detecting and classifying intrusion attempts before they can impact driver safety.
What it does
SentryCAN is a complete end-to-end Machine Learning pipeline and monitoring dashboard for automotive network security:
Feature Extraction: Computes dynamic packet features (Inter-arrival time, payload Shannon entropy, CAN ID frequency, and ID-transition bigram hashes) on a sliding window. Multi-Class Intrusion Detection: Inspects each packet to label it as Normal, DoS, Fuzzy, Gear Spoofing, or RPM Spoofing. Edge Optimization: Deploys a highly compressed 1D-CNN (only 171 KB with ~10k parameters) achieving 99.48% accuracy and a 13.7ms latency on CPU (dropping to <5ms under Linux/WSL2). Interactive Dashboard: Replays real-time CAN traffic, displays real-time model confidence and latency, and features an interactive "Inject Attack" button to simulate and visualize live security breaches.
How we built it
Data Engineering: Created a SQLite database pipeline storing raw frames and computed feature matrices. Built a high-fidelity synthetic traffic generator mimicking the HCRL Car-Hacking Dataset schema. Model Development: Baseline: Trained a Random Forest classifier (100% accuracy, ~50MB size). Edge-AI: Developed a custom lightweight 1D-CNN in TensorFlow/Keras to enable deployment on resource-constrained embedded systems. Anomaly Detection: Integrated an unsupervised Isolation Forest baseline to detect zero-day abnormalities. Deployment & Interface: Wrapped the models in a FastAPI backend (/predict, /health, /stats) and built the monitoring interface using Streamlit.
Challenges we faced
Dataset Access: The standard HCRL Car-Hacking Dataset requires manual browser downloads, making automated training setup tricky. We resolved this by building a highly realistic synthetic generator that matches the original dataset's schemas and attack signatures. Latency overhead: Running Random Forest models on single-sample predictions introduced high overhead (18ms). We designed the 1D-CNN to combat this, keeping inference times under 15ms on CPU.
What we learned
Feature Power: Engineering specific domain features (like payload entropy and CAN ID sequence transition hashes) makes automotive attacks highly separable, allowing even microscopic neural networks to achieve >99% classification accuracy. Optimization: Compressing a model down to 171 KB enables deployment directly onto automotive gateways and edge microcontrollers without sacrificing detection power.
What's next for SentryCAN
Compile the 1D-CNN to TensorFlow Lite (TFLite) or MicroTVM for bare-metal MCUs. Implement hardware-in-the-loop (HIL) testing using physical CAN transceivers and a Raspberry Pi.
Built With
- fastapi
- keras
- numpy
- pandas
- python
- scikit-learn
- sqlite
- streamlit
- tensorflow
- uvicorn
