Bidirectional GPT-2 CAN Bus Detection for Sparse Attack IDs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection methods for Controller Area Network (CAN) buses struggle to effectively detect attacks, especially when only a small number of attack IDs are present, due to the lack of security features in the CAN bus protocol and indirect detection of CAN ID sequence changes.
Innovation Solution
A bi-directional Generative Pretrained Transformer 2 (GPT2) deep learning network is employed to analyze CAN ID sequences, using a forward and backward GPT module to calculate a loss function that identifies anomalies by comparing the sequence to a threshold, effectively detecting attacks even with a small number of attack IDs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional intrusion detection methods are used to monitor CAN bus, then the system can identify obvious attacks, but it fails to detect attacks when only a small number of attack IDs are present in the sequence
Solution Approach 1:
The system performs preliminary learning of normal CAN ID sequence patterns during a training phase before actual intrusion detection. The GPT-2 model is pre-trained on extensive sequences of normal CAN bus traffic to establish a baseline of expected behavior, enabling it to detect deviations even when attack IDs are sparse or subtle in the monitoring phase
Solution Approach 2:
The patent introduces an intermediary probabilistic model (GPT-2) that acts as a mediator between the raw CAN ID sequences and the detection decision. This intermediary translates the sequence patterns into probability distributions, allowing the system to detect anomalies based on statistical deviations rather than simple pattern matching, thereby improving detection sensitivity for subtle attacks
2Productivity
If the CAN bus protocol is used without security features, then communication between controllers is simple and efficient, but the system becomes vulnerable to various attacks
Solution Approach 1:
The system implements continuous feedback monitoring of CAN ID sequences by comparing observed patterns against the learned normal behavior model. When deviations are detected, the system can trigger alerts or countermeasures, creating a closed-loop security mechanism that maintains communication efficiency while providing real-time protection against attacks
Solution Approach 2:
The patent replaces traditional mechanical or rule-based security mechanisms with a data-driven machine learning approach. Instead of relying on predefined security rules or hardware security modules, the system uses the GPT-2 language model to dynamically learn and detect anomalies, substituting complex computational analysis for simpler traditional security methods
3Measurement precision
If pattern learning methods are used to detect CAN ID sequence changes, then normal operation patterns can be identified, but the method becomes ineffective when attack IDs are very few in the sequence
Solution Approach 1:
The system transforms the detection problem from analyzing individual CAN ID values to analyzing the probabilistic distribution and contextual relationships across entire sequences. By converting discrete ID patterns into continuous probability distributions through the GPT-2 model, the system gains an additional dimensional perspective that enables detection of subtle attacks embedded in normal traffic patterns
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An intrusion detection method for a CAN, performed by a processor, may comprise: collecting CAN IDs from the CAN in an order of occurrence; generating a sequence of a predetermined number L of CAN IDs from the collected CAN IDs, L being an integer greater than or equal to 1; and inputting the sequence into a bi-directional GPT2 network and calculating a value of a loss function corresponding to the sequence, wherein when a number of allowed CAN IDs is K, the allowed CAN IDs in the sequence are sorted in an order of magnitude and converted into values 0 to K - 1, CAN IDs that are not allowed in the sequence are converted to K, the sequence is input to the bidirectional GPT2 network, and K is an integer equal to or greater than 1.