FPGA-Accelerated Context-Aware Intrusion Detection System Using Decision Transformer and LightGBM for Automotive CAN Networks

In the evolving landscape of intelligent transportation systems, ensuring robust cybersecurity for in-vehicle communication is critical. This paper proposes a hybrid learning framework for intrusion detection in Controller Area Network (CAN)-based autonomous vehicles by integrating a Decision Transformer with a Light Gradient Boosting Machine (LightGBM) classifier. The system incorporates contextual information from raw CAN frames and multimodal sensor data, enabling the construction of temporal trajectories that reflect historical driving behavior. These trajectories are encoded using a transformer-based temporal model to capture dynamic patterns, followed by lightweight boosted tree classification for efficient and interpretable decision-making. To enable real-time inference, the model is implemented on a Zynq UltraScale+ FPGA using hardware modules such as FIFO buffers, digital filters, tanh scalers, and sliding window controllers. The implementation was trained using a Python environment and evaluated on the OCSLab CAN-intrusion dataset comprising over 100,000 frames across multiple attack types, including DoS, Fuzzy, and Impersonation. The proposed system achieves a True Positive Rate of 71.50%, an Attack Detection Rate of 72.00%, and an overall accuracy of 80.05%, while maintaining a low False Positive Rate of 3.50%. Compared to conventional CNN and Rainbow DQN-based models, it demonstrates superior performance in detection, decision latency (under 10 ms), and computational efficiency. This hybrid model presents a scalable, cost-effective, and real-time capable solution for enhancing vehicular cybersecurity, making it highly suitable for deployment in safety-critical autonomous driving environments.