Explainable Frame-Level Attack Identification in a Sequence-Based In-Vehicle Network Intrusion Detection System

Abstract

Recently, advances in autonomous driving technologies have increased the possibility of attacks on in-vehicle controller area network (CAN) communication. Accordingly, various deep learning-based intrusion detection systems (IDSs) have been proposed to detect such attacks. Among them, sequence-based learning methods have been widely used because they can capture temporal correlations that are difficult to analyze from a single frame alone. However, conventional sequence-based IDSs generally label an entire sequence as an attack if at least one attack frame is included in the sequence. As a result, it is difficult to directly identify frame-level information within a sequence classified as an attack, and even normal frames may be incorrectly regarded as attack frames. To address this problem, we propose a sequence-based IDS capable of frame-level attack identification using explainable AI (XAI). The proposed model encodes each CAN frame into a latent representation, constructs a sequence from consecutive representations, and classifies it. For sequences detected as attacks, integrated gradients (IG) method is applied in the latent representation space to compute frame-wise contributions. Then, malicious frames are identified using a threshold calibrated with frame-level ground-truth labels from the validation set. Experimental results show that the proposed model achieves high sequence-level detection performance with an average accuracy of 99.99%. In addition, it records an average accuracy of 99.91%, precision of 99.94%, and recall of 99.83% in frame-level detection. These results demonstrate that the proposed method can identify attack frames based on sequence-level detection results, unlike existing methods.