X-SPUR: Explainable Surprisal-Based Protocol-Aware Unsupervised Reasoning for Automotive Ethernet Intrusion Detection
X-SPUR flags Automotive Ethernet attacks unsupervised via token surprisal, scoring AUC 0.9987 on TOW-IDS.
X-SPUR is an unsupervised Automotive Ethernet intrusion detector that tokenizes raw packet fields, learns benign traffic with causal language modeling, and scores anomalies by per-token cross-entropy surprisal. A bimodal architecture fuses payload-token embeddings with inter-packet timing, and a dual top-k percent per-protocol Z-score calibration handles differing protocol families. On TOW-IDS it reports an AUC of 0.9987, marginally above the 0.9969 cited for AERO, without handcrafted features. A separate CarDS model trained with the same architecture retains strong performance on a second automotive Ethernet dataset, and per-token surprisal attributes scores to specific protocol fields.
- Unsupervised model learns benign Automotive Ethernet via causal language modeling.
- Fusion combines payload-token embeddings with inter-packet timing.
- TOW-IDS AUC is 0.9987, slightly above AERO at 0.9969.
- Per-token surprisal attributes anomalies to specific protocol fields.
- A CarDS model uses the same architecture on a second dataset.
Full article189 words · extracted from arxiv.org · click to collapse
Automotive Ethernet carries heterogeneous multi-protocol traffic in modern in-vehicle networks, where labeled attack data are rarely available and the strongest prior unsupervised detector still relies on handcrafted traffic features. This article presents X-SPUR, an explainable, surprisal-based, protocol-aware unsupervised reasoning framework that instead represents raw packet fields as token sequences, learns benign traffic patterns through causal language modeling, and detects anomalies from per-token cross-entropy surprisal. To incorporate temporal context, we introduce a bimodal fusion architecture that combines payload-token embeddings with inter-packet timing through additive fusion and a Hadamard interaction. To handle the heterogeneous score distributions of different protocol families, we further propose a dual top-$k$% per-protocol $Z$-score calibration that jointly captures moderately distributed and sparse anomaly signatures. On the TOW-IDS dataset, X-SPUR achieves an AUC of 0.9987. This is marginally higher than the 0.9969 reported for AERO. X-SPUR also eliminates handcrafted feature engineering. We train a separate CarDS model using the same architecture and training hyperparameters. This model retains strong performance on the second automotive Ethernet dataset. Beyond detection, per-token surprisal provides fine-grained explainability by attributing anomaly scores to specific protocol fields, supporting interpretable security analysis in heterogeneous in-vehicle networks.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.21217