SecureBERT and LLAMA 2 Empowered Control Area Network Intrusion Detection and Classification

TL;DR

This paper introduces CAN-SecureBERT and CAN-LLAMA2, transformer-based models that significantly improve intrusion detection accuracy and reduce false alarms in Control Area Networks, leveraging pre-trained language models for cybersecurity.

Contribution

It develops and evaluates two novel transformer-based models, demonstrating that large language models can be effectively adapted for CAN intrusion detection with superior performance.

Findings

CAN-LLAMA2 achieves 0.999993 balanced accuracy and F1 score.

False alarm rate is 52 times lower than the previous best model.

Large language models can be adapted for cybersecurity tasks effectively.

Abstract

Numerous studies have proved their effective strength in detecting Control Area Network (CAN) attacks. In the realm of understanding the human semantic space, transformer-based models have demonstrated remarkable effectiveness. Leveraging pre-trained transformers has become a common strategy in various language-related tasks, enabling these models to grasp human semantics more comprehensively. To delve into the adaptability evaluation on pre-trained models for CAN intrusion detection, we have developed two distinct models: CAN-SecureBERT and CAN-LLAMA2. Notably, our CAN-LLAMA2 model surpasses the state-of-the-art models by achieving an exceptional performance 0.999993 in terms of balanced accuracy, precision detection rate, F1 score, and a remarkably low false alarm rate of 3.10e-6. Impressively, the false alarm rate is 52 times smaller than that of the leading model, MTH-IDS (Multitiered Hybrid Intrusion Detection System). Our study underscores the promise of employing a Large Language Model as the foundational model, while incorporating adapters for other cybersecurity-related tasks and maintaining the model's inherent language-related capabilities.