Thesis Work 30 hp-Federated Learning for Unsupervised Intrusion Detection for In-Vehicle CAN Network

Scania is one of the world’s leading manufacturers of trucks and buses for heavy transports, as well as industrial and marine engines. With over a million connected vehicles operating in more than 100 countries, Scania’s increasing focus on connected and autonomous systems relies on secure and intelligent data-driven solutions.

In the Section of Connected Vehicle Data and Analytics, we develop innovative solutions for connected vehicles, driving the transition toward a sustainable transport system. Advanced data analytics is a pivotal enabler in this transformation and Scania’s research background, combined with its in-house expertise in machine learning-driven analysis of vehicle data, positions us at the forefront of this development. 

Target/scope:

As vehicles become more connected through telematics, over-the-air updates, and V2X communication, ensuring cyber security of in-vehicle networks is crucial. Network intrusion detection system (IDS) provides a layer of security by monitoring and analyzing the data traffic, and identifying suspicious activities that could indicate an intrusion. It facilitates the timely detection of anomalies, enabling the application of appropriate mitigation measures and ensuring compliance with the international cybersecurity regulations (e.g., UN Regulation No. 155).

In the context of automotive cybersecurity, attack-representing data are both scarce and often vehicle-specific. This poses a fundamental challenge for data-driven intrusion detection systems: the limited and imbalanced availability of attack samples makes supervised training less effective, while local unsupervised models trained on individual vehicles can also tend to overfit to local conditions—leading to poor generalization and high false-positive rates. Federated learning (FL) can offer an effective paradigm to address these limitations by enabling collaborative model training across multiple vehicles without sharing raw CAN data.

To address these challenges, this thesis proposes to investigate Federated Learning for unsupervised intrusion detection in CAN networks. The goal is to design a privacy-preserving, distributed learning framework where multiple vehicles collaboratively train anomaly detection models — such as Variational Autoencoders (VAEs)— without sharing raw CAN data. The project will explore methods for building a global latent space representation of normal CAN communication, which can generalize across heterogeneous vehicles while allowing local personalization for individual vehicles.

The thesis will involve the following main steps:

1. Model Design and Local Learning:

   • Develop and train unsupervised VAE-based anomaly detection models to learn normal CAN behavior locally.

   • Explore reconstruction-based and latent space–based inference approaches.

1. Federated Learning Framework:

• Implement and evaluate distributed learning strategies such as FedAvg, FedPer, and FedProx, to aggregate knowledge across multiple vehicles.

1. • Investigate two update schemes:
     (a) full model parameter sharing, and
     (b) latent-space statistics sharing (e.g., mean and variance of learned features).

2. Evaluation and Benchmarking:

   • Compare federated vs. centralized training in terms of detection performance, model convergence, and communication overhead.

What skill are for needed this thesis:

• Required

  • Solid understanding of neural networks, autoencoders, and unsupervised learning.

  • Knowledge of deep learning frameworks (e.g.,PyTorch or TensorFlow).

  • Programming experience in Python

• Bonus

  • Experience with federated learning frameworks (e.g., FEDn, Flower).

  • Familiarity with automotive network data (CAN) and cyber-attack scenarios.

Education/line/direction:

Area of education or direction: Masters programmes in Machine Learning, Data Science, Computational Mathematics, Complex Adaptive Systems, Computer Science or similar.

Number of students: 1-2

Start date for the Thesis project: January 2026

Estimated timescale: 20 weeks

Contact person and supervisor:

Mahshid Helali Moghadam –Data Scientist, TRATON Group
Email: mahshid.helali.moghadam@scania.com

Juan Carlos Andresen – Group Manager, TRATON Group
Email: juan-carlos.andresen@scania.com

Application:

Your application should contain the following:

1. CV.

2. Personal letter.

3. Copies of grades.

4. Optional: To propose a tentative approach to the problem.

Applicants will be assessed on a continuous basis until the position is filled. Do not wait until the last date to apply. 

A background check might be conducted for this position.

Nothing is more important than our people. With a company culture that’s based on shared and inclusive core values. We have a supportive community, where everyone has opportunities to grow and succeed.