Protocol-Aware Feature-Based Intrusion Detection System for UAVCAN Networks

Uncomplicated application-level vehicular computing and networking (UAVCAN) is a higher-layer protocol built on the controller area network (CAN) bus to support control and status communication among electronic control units in unmanned aerial vehicles. Because CAN provides no native authentication or encryption, UAVCAN networks are vulnerable to message injection, replay, and flooding attacks. Most existing CAN intrusion detection systems, however, are designed for automotive networks and do not explicitly account for the transfer structure and tail-byte rules of UAVCAN. This paper proposes a protocol-aware intrusion detection framework that reconstructs UAVCAN transfers and extracts six payload features and four transfer features based on the CAN ID, transfer ID, toggle bit, and transfer-boundary information. The proposed feature set is evaluated using random forest, XGBoost, logistic regression, and multilayer perceptron classifiers on ten attack scenarios from a public UAVCAN dataset. The best-performing configuration achieves average accuracy, precision, and recall of 99.89%, 99.96%, and 99.88%, respectively. Ablation results show that transfer-rule features are particularly effective for replay-attack detection, while combining payload and transfer features provides the most consistent performance across attack types. The proposed approach also outperforms the evaluated automotive CAN IDS baselines and achieves competitive performance compared with existing UAVCAN-specific IDS methods. These findings support the value of protocol-aware feature extraction for UAVCAN intrusion detection.