Master's thesis: Interpretable CAN Bus Intrusion Forensics via Tensor Networks

We are inviting a motivated master’s student to collaborate with us at the Computer Science and Industrial Systems Department at RISE under the MAGIC project. Our research is dedicated to developing advanced security solutions for next-generation networks, with a strong focus on collaborative projects with Swedish industrial and academic partners.

Background and Purpose

The Controller Area Network (CAN) remains the dominant in-vehicle communication bus despite lacking built-in authentication and encryption mechanisms. Consequently, modern vehicles are vulnerable to cyberattacks such as message injection, masquerading, replay attacks, fuzzing, and denial-of-service (DoS) attacks. Although machine learning and deep learning-based Intrusion Detection Systems (IDSs) have demonstrated excellent detection accuracy, they often operate as black boxes, providing limited insight into why a specific message or event has been classified as malicious.

Automotive cybersecurity regulations, such as UNECE R155 and ISO/SAE 21434, emphasize not only attack detection but also traceability, explainability, and post-incident forensic analysis. Security analysts must be able to understand, verify, and justify detection results when investigating cybersecurity incidents. There is therefore a growing need for cybersecurity solutions that combine strong detection performance with transparency and reproducibility.

Quantum-inspired machine learning approaches based on tensor networks have recently attracted attention due to their ability to model complex dependencies while remaining computationally efficient and interpretable. For example, Matrix Product States (MPS) offer a deterministic learning framework that can produce reproducible models and provide insight into the correlations that drive anomaly detection decisions.

Thesis Description

This thesis will investigate the use of quantum-inspired tensor networks for interpretable CAN bus intrusion detection and forensic analysis. The goal is to develop an anomaly detection framework that learns normal vehicle communication patterns from CAN traffic and identifies deviations associated with cyberattacks. The proposed approach will encode sequences of CAN messages, arbitration IDs, payload bytes, and timing information into a tensor-network representation. Anomalies will be identified while the learned tensor structure will be analyzed to explain which messages, bytes, or communication patterns contributed to an alert. A central objective is to investigate whether tensor network models can achieve detection performance comparable to state-of-the-art deep learning methods while providing superior interpretability, reproducibility, and forensic value.

Key tasks include:

• Conduct a literature review on automotive cybersecurity, CAN bus security, intrusion detection systems, tensor networks, and quantum-inspired machine learning.

• Study common CAN attack scenarios, including DoS, spoofing, fuzzing, replay, and masquerading attacks.

• Design suitable feature representations for CAN traffic, incorporating arbitration IDs, payload content, message sequences, and timing information.

• Develop and implement a tensor network based anomaly detection framework.

• Investigate interpretability for attributing anomalies to specific CAN messages and communication patterns.

• Evaluate the proposed method using public automotive cybersecurity datasets and compare results with conventional machine learning and deep learning approaches.

• Analyze model compactness, reproducibility, detection performance, and suitability for forensic investigations.

• Document findings and provide recommendations for future deployment of interpretable AI methods in automotive cybersecurity. This work will be carried out in close collaboration with the Swedish automotive industry.

Duration: 6 months of full-time engagement.
Application Deadline: November 10th, 2026.
Start Date: By January 2025.
Scope: 30 hp.
Location: RISE Industrial Systems, Sundsvall or Kista. Flexibility to work partly remotely.

Who Are You?

The ideal candidate will have basic knowledge in computer science and cybersecurity, with specific skills in machine learning. Proficiency in programming languages such as Python and machine learning frame.

Welcome with your application!

To know more, please contact Nishat Mowla (nishat.mowla@ri.se, tel 073 051 19 37). Applications should include a brief personal letter, CV/resume, recent transcript of records, and a code example written by you. Candidates are encouraged to send in their application as soon as possible but at the latest by the 10th of November 2024. Suitable applicants will be interviewed as soon as applications are received.