CANBERT+: An Optimized Multi-Layer BERT-Based Intrusion Detection for CAN Bus
summary
A BERT-derived IDS represents each CAN message as a single token with multi-layer embeddings for ID, length and payload bytes, reducing sequence length so training and inference shrink dramatically. Pretraining masks CAN IDs on benign traffic then fine-tuning on attacks over eight public datasets and 258 data logs yields clear gains: F1 from 0.60 to 0.72 on replay, about 6x faster inference, fine-tuning drops to 150s from ~2000s, and compact variants cut model size up to 205x with minor F1 loss.
AI-written summary · about
chapters (10)
- 0:00CANBERT+ research
- 2:21CAN bus security challenges
- 4:08CAN-BERT limitations
- 5:55CANBERT+ multi-layer embeddings
- 8:23Training and fine-tuning
- 9:26Performance comparison
- 10:30Efficiency improvements
- 11:34Hardware-constrained variants
- 12:18Limitations and future work
- 13:22Conclusion
related talks
18mModels on the Move: Towards Feasible Embedded AI for Intrusion Detection on...
16mCANdid - An Open-Access Annotated Dataset of Vehicle CAN Bus Traffic
41mIt's easier to break than to patch: a stealthy DoS attack on CAN
30mFingerprinting Electronic Control Units for Vehicle Intrusion Detection
11mWIP: Intrusion Detection and Localization for CAN by Extracting Propagation Delay..
44m$1 AI Guardrails: The Unreasonable Effectiveness of Finetuned ModernBERTs
28mProtecting the connected car
41mVoBERT: Unstable Log Sequence Anomaly Detection: Introducing Vocabulary-Free BERT