CANMentor large-small model collaboration for CAN bus IDS
Original title: CANMentor: A Large-Small Model Collaboration Framework for CAN Bus Intrusion Detection
CANMentor framework uses cloud LLM to supervise vehicle-side lightweight IDS models via knowledge distillation, yielding up to 25% F1 gains on non-IID data.
The Controller Area Network lacks built-in security, necessitating real-time intrusion detection. Vehicle-side IDS models are limited by resource constraints and suffer performance drops on non-IID data. CANMentor lets a cloud LLM teacher supervise lightweight models. Vehicles perform local inference and send privacy-aware proxies for teacher supervision. Teacher predictions improve detection accuracy near decision boundaries by 38.71-42.00 percentage points.
- Cloud LLM teacher supervises vehicle lightweight IDS
- Privacy-aware generator produces proxies for cloud inference
- Knowledge distillation yields 25.01% Macro F1 gain on ROAD dataset
- Improves detection accuracy for boundary CAN messages by 38.71-42.00pp
From the original article
1 min read at arxiv.orgThe Controller Area Network (CAN) bus lacks built-in security mechanisms, making real-time intrusion detection necessary. However, resource and latency constraints limit vehicle-side intrusion detection systems (IDSs) to lightweight models, whose detection performance and generalization can degrade under non-independent and identically distributed (non-IID) data.
By Zhiquan Liu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.