Designing intrusion detection systems for in-vehicle networks and IoT devices using language models, federated learning, and graph-based anomaly detection.
Modern vehicles and IoT deployments are increasingly interconnected, making them attractive targets for cyberattacks. Controller Area Network (CAN) buses — the communication backbone of most vehicles — were designed without security in mind, leaving them vulnerable to injection and replay attacks.
Our work applies large language models (CANBERT) to detect intrusions on in-vehicle networks by treating CAN bus traffic as a language and learning normal communication patterns. Anomalies in this 'language' signal potential attacks.
We extend this to broader IoT settings using graph-based representation learning to model device communication patterns, and federated learning to enable collaborative anomaly detection across devices without sharing raw data — preserving privacy while improving detection accuracy.