Integration of context-based feature encoding techniques for attack classification in In-Vehicle Networks

Automotive systems are increasingly vulnerable to cyber-attacks due to their reliance on in-vehicle networking protocols, particularly the Controller Area Network (CAN), for inter-component communication. Addressing these threats necessitates advanced and adaptable intrusion detection mechanisms. Traditional feature encoding techniques often fail to capture contextual relationships within CAN frame data, leading to reduced detection accuracy. This study introduces a novel feature encoding workflow to semantically encode CAN data bytes using two word embedding techniques such as fastText and Bidirectional Encoder Representations from Transformers (BERT). By transforming raw byte data into enriched feature representations, the embeddings effectively capture both byte-level semantics and contextual relationships, enhancing the input space for classifiers like Random Forest, XGBoost, and CatBoost. The models were developed and tested using a standard car hacking dataset. Performance comparisons revealed that embedding-based approaches, including fastText and BERT, achieved superior classification results over traditional methods, with BERT showing slight advantages in recognizing complex attack patterns. For instance, XGBoost exhibited notable improvements with embeddings, increasing precision from 91% to 99%, recall from 74% to 97%, and F1-score from 85% to 98%. These findings confirm the critical role of word embeddings in improving intrusion detection effectiveness and emphasize their value in strengthening the cybersecurity of in-vehicle networks.