Local enhanced toeplitz neural network for in-vehicle network intrusion detection

Transformer-based models have been successful in identifying various intrusion attacks on in-vehicle networks. However, these models struggle to meet real-time requirements due to the quadratic complexity of the attention mechanism. The Toeplitz Neural Network (TNN) represents a significant advancement in language modeling, surpassing the capabilities of the Transformer while maintaining linear space-time complexity. Nevertheless, in the context of in-vehicle network intrusion detection, simply applying TNN may result in suboptimal accuracy, particularly in detecting low-capacity attacks that hinge on global positional relationships between CAN IDs. To address this limitation, we propose a Locally Enhanced Toeplitz Neural Network that takes advantage of the periodic nature of in-vehicle network messages. Specifically, we conduct local binary consistency comparisons among the features of CAN IDs associated with the same categories and integrate this process with the standard Toeplitz Neural Network (TNN) operation. Furthermore, this paper uses an approximate method of single-channel comparison to reduce the time and space complexity of the model. Our experimental results on three public datasets, Intrusion Detection Challenge, Attack & Defense Challenge 2020 and ROAD, show that our method outperforms competitors DCNN, LSTM, Transformer, and TNN in terms of Accuracy, Precision, Recall, FPR, F1, and MCC indicators. For low-capacity attack detection within 10%, our method also outperforms competitors in terms of Accuracy and Recall.