Defense Against Adversarial Samples for Replay Attacks in Automotive AVTP Streams via a Novel Bidirectional Mamba-Based Intrusion Detection System

As the core protocol for transmitting Advanced Driver Assistance Systems (ADAS) perception video streams over automotive Ethernet, Audio Video Transport Protocol (AVTP) is vulnerable to replay attacks [1] due to its lack of authentication and integrity protection mechanisms. The existing supervised deep learning methods primarily target conventional replay attack detection, but their large model sizes make them unsuitable for resource-constrained and real-time deployment in embedded automotive systems. To address these issues, we propose a novel intrusion detection system (IDS) against Adversarial Samples for Replay Attacks (AdvRA) in Automotive AVTP Streams, which is based on Frame-Difference, Time-Shared Convolution and Bidirectional Mamba (FD-TSConv-BiMamba). Specifically, we first construct an efficient feature engineering pipeline that reduces the number of dimensional features from 438 to 40. Second, we propose a lightweight detection algorithm based on an improved Mamba structure. The parameter complexity of the proposed algorithm is <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">O</i>(<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i> ·<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">m</i>+<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</i> · <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i>), which is significantly lower than the parameter complexity of GRU (<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">O</i>(3(<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">nd</i> + <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</i><sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup>))), LSTM (<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">O</i>(4(<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">nd</i> + <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</i><sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup>))) and CNN (<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">O</i>(<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">f</i><sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> · <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">c</i><sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">in</sub> · <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">c</i><sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">out</sub>)). Finally, to validate the effectiveness of our model in detecting AdvRA, we construct a conditional Generative Adversarial Network (cGAN) to generate the AdvRA dataset. Experimental results show that the proposed model achieves the parameters of the accuracy and F1-score with 0.9974 and 0.9970 under the indoor scenario using the window size of 114, and with 1.0000 and 0.9999 under the driving scenario using the window size of 108, respectively. In addition, the model size is only 1.17 MB. Compared to advanced methods such as TOW-IDS [2] at 11.30 MB and CNN-IDS [3] at 3.58 MB, the model size is reduced by approximately 89.6% and 67.3%, respectively. Furthermore, for the AdvRA detection task, our model achieves an F1-score of 0.9917, outperforming GRU and LSTM by 7.15% and 6.27%, respectively, with a detection speed of 3155 samples/s. Our code is available at: https://github.com/Haihang-Zhao/FD_TSConv_Mamba.