SecureBERT and Llama 2 Empowered Control Area Network Intrusion Detection and Classification

Numerous studies have proved their effective strength in detecting Control Area Network (CAN) attacks. In the realm of understanding the human semantic space, transformer- based models have demonstrated remarkable effectiveness. Leveraging pre-trained transformers has become a common strategy in various language-related tasks, enabling these models to grasp human semantics more comprehensively. To delve into the adaptability evaluation on pre-trained models for CAN intrusion detection, we have developed three distinct models: CAN-C-BERT, CAN-SecureBERT and CAN-Llama2. Notably, our CAN-Llama2 model surpasses the state-of-the-art models by achieving an exceptional performance 0.999993 in terms of Balanced Accuracy (BA), Precision (PREC), Detection Rate (DR), F1 score, and a remarkably low false alarm rate of 3.10e-6. Impressively, the false alarm rate is 52 times smaller than that of the leading model, MTH-IDS (Multitiered Hybrid Intrusion Detection System). Our study underscores the promise of employing a Large Language Model as the foundational model, while incorporating adapters for other cybersecurity-related tasks and maintaining the model’s inherent language-related capabilities.