Lightweight temporal and spatial fusion for intrusion detection in automotive controller area network

초록

With the proliferation of intelligent connected vehicles and tightening regulations such as UNECE R155 and ISO/SAE 21434, the need for lightweight, reliable intrusion detection in vehicle controller area networks (CANs) increases. This paper proposes an intrusion detection system (IDS) that models spatial (payload, including data length code, DLC) and temporal (inter-arrival) characteristics independently and fuses them at the decision stage. The spatial detector tokenizes the DLC and eight payload bytes, learns per-identifier (ID) distributions using a Transformer, and flags anomalies via negative log-likelihood (NLL). The temporal detector estimates per-ID nominal periods from benign logs and detects deviations from those nominal values. The two outputs are combined using a precision-oriented AND policy. On a public dataset comprising Hyundai Sonata, Kia Soul, and Chevrolet Spark with flooding, fuzzing, malfunction, and synthesized replay scenarios, the IDS attains strong F1 scores at both frame-and window-level. In particular, temporal cues enable detection in replay cases where payload-only separation is difficult. Overall, the proposed IDS achieves a favorable balance between detection performance and computational cost, supporting practical deployment in CAN-based in-vehicle networks.

키워드