2018 NDIA GROUND VEHICLE SYSTEMS ENGINEERING AND TECHNOLOGY SYMPOSIUM Vehicle Electronics and Architecture (VEA) & Ground Systems Cyber Engineering (GSCE) Technical Session AUGUST 7-9, 2018 - NOVI, MICHIGAN A TWO-STAGE DEEP LEARNING APPROACH FOR CAN INTRUSION DETECTION Linxi Zhang University of Michigan- Dearborn Computer and Information Science Department Dearborn, MI Lyndon Shi University of Michigan Ann Arbor Electrical Engineering and Computer Science Department Ann Arbor, MI Nevrus Kaja University of Michigan- Dearborn Electrical and Computer Engineering Department Dearborn, MI Di Ma, PhD University of Michigan- Dearborn Computer and Information Science Department Dearborn, MI ABSTRACT With recent advancements in the automotive world and the introductions of autonomous vehicles, automotive cybersecurity has become a main and primary issue for every automaker. In order to come up with measures to detect and protect against malicious attacks, intrusion detection systems (IDS) are commonly used. These systems identify attacks while comparing normal behavior with abnormalities. In this paper, we propose a novel, two-stage IDS based on deep-learning and rule-based systems. The objective of this IDS is to detect malicious attacks and ensure CAN security in real time. Deep Learning has already been used in CAN IDS and is already proven to be a successful algorithm when it comes to extensive datasets but comes with the cost of high computational requirements. The novelty of this paper is to use Deep Learning to achieve high predictability results while keeping low computational requirements by offsetting it with rule-based systems. In addition, we examine the performance of proposed IDS with the objective for using it in real-time situations. I. INTRODUCTION The transportation ecosystem is going through a revolutionary transformation with automation and connectivity as its main drivers. These services increase mobility and promise to virtually eliminate crashes and fatalities which are a