Intrusion Detection Using Transformer in Controller Area Network

The message broadcast network of the Controller Area Network (CAN) protocol is vulnerable to external attacks. The ongoing development of intrusion detection systems (IDS) aims to prevent malicious attacks on vehicles. Time series analysis of language models has emerged as a new approach in this area and has significantly contributed to the development of IDS performance. Nevertheless, because the language model requires significant resources to process, its application to actual vehicles requires balancing model performance with complexity. In this paper, we propose an efficient IDS model that uses transformer-based techniques while operating with limited resources. The proposed IDS leverages a transformer-based spatial and temporal data analysis mechanism, enabling quick response to attacks even with limited data, and demonstrates excellent performance. Since the IDS uses unsupervised learning, labeling the input sequence during preprocessing is not required. This approach helps protect the vehicle from both predictable and unpredictable attacks. Furthermore, the prediction range can be expanded to make the model’s performance more robust against various attack scenarios.