X-SPUR detects unusual network traffic in cars without manual features
X-SPUR: Explainable Surprisal-Based Protocol-Aware Unsupervised Reasoning for Automotive Ethernet Intrusion Detection
Cryptography and SecurityNetworking and Internet Architecture
Summary
Cars now use Ethernet networks that handle many types of data, making it hard to spot attacks since labeled examples are scarce. The authors present X-SPUR, a method that learns normal patterns by treating network packets like language and spotting surprising deviations without needing hand-designed rules. It combines packet content and timing to better understand context and calibrates its scores for different protocols. Tests show X-SPUR matches or beats previous methods while providing clear explanations of exactly which parts of a packet seem suspicious.
What this means in practice
- •For automotive security teams: Detect anomalies in car Ethernet networks without relying on labeled attack data or manual feature design.
- •For network security engineers: Use fine-grained anomaly scores per packet field to interpret and analyze multi-protocol network traffic anomalies.
Authors
Jisoo Kim, Seonghoon Jeong
Abstract
Automotive Ethernet carries heterogeneous multi-protocol traffic in modern in-vehicle networks, where labeled attack data are rarely available and the strongest prior unsupervised detector still relies on handcrafted traffic features. This article presents X-SPUR, an explainable, surprisal-based, protocol-aware unsupervised reasoning framework that instead represents raw packet fields as token sequences, learns benign traffic patterns through causal language modeling, and detects anomalies from per-token cross-entropy surprisal. To incorporate temporal context, we introduce a bimodal fusion architecture that combines payload-token embeddings with inter-packet timing through additive fusion and a Hadamard interaction. To handle the heterogeneous score distributions of different protocol families, we further propose a dual top-$k$% per-protocol $Z$-score calibration that jointly captures moderately distributed and sparse anomaly signatures. On the TOW-IDS dataset, X-SPUR achieves an AUC of 0.9987. This is marginally higher than the 0.9969 reported for AERO. X-SPUR also eliminates handcrafted feature engineering. We train a separate CarDS model using the same architecture and training hyperparameters. This model retains strong performance on the second automotive Ethernet dataset. Beyond detection, per-token surprisal provides fine-grained explainability by attributing anomaly scores to specific protocol fields, supporting interpretable security analysis in heterogeneous in-vehicle networks.