X-SPUR: Explainable Surprisal-Based Protocol-Aware Unsupervised Reasoning for Automotive Ethernet Intrusion Detection
X-SPUR flags Automotive Ethernet attacks unsupervised via token surprisal, scoring AUC 0.9987 on TOW-IDS.
X-SPUR is an unsupervised Automotive Ethernet intrusion detector that tokenizes raw packet fields, learns benign traffic with causal language modeling, and scores anomalies by per-token cross-entropy surprisal. A bimodal architecture fuses payload-token embeddings with inter-packet timing, and a dual top-k percent per-protocol Z-score calibration handles differing protocol families. On TOW-IDS it reports an AUC of 0.9987, marginally above the 0.9969 cited for AERO, without handcrafted features. A separate CarDS model trained with the same architecture retains strong performance on a second automotive Ethernet dataset, and per-token surprisal attributes scores to specific protocol fields.
- Unsupervised model learns benign Automotive Ethernet via causal language modeling.
- Fusion combines payload-token embeddings with inter-packet timing.
- TOW-IDS AUC is 0.9987, slightly above AERO at 0.9969.
- Per-token surprisal attributes anomalies to specific protocol fields.
- A CarDS model uses the same architecture on a second dataset.
- Products
- Automotive EthernetAEROTOW-IDS
From the original article
1 min read at arxiv.orgAutomotive Ethernet carries heterogeneous multi-protocol traffic in modern in-vehicle networks, where labeled attack data are rarely available and the strongest prior unsupervised detector still relies on handcrafted traffic features.
By Jisoo Kim · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.