Abstract
Automotive Ethernet carries heterogeneous multi-protocol traffic in modern in-vehicle networks, where labeled attack data are rarely available and the strongest prior unsupervised detector still relies on handcrafted traffic features. This article presents X-SPUR, an explainable, surprisal-based, protocol-aware unsupervised reasoning framework that instead represents raw packet fields as token sequences, learns benign traffic patterns through causal language modeling, and detects anomalies from per-token cross-entropy surprisal. To incorporate temporal context, we introduce a bimodal fusion architecture that combines payload-token embeddings with inter-packet timing through additive fusion and a Hadamard interaction. To handle the heterogeneous score distributions of different protocol families, we further propose a dual top-$k$% per-protocol $Z$-score calibration that jointly captures moderately distributed and sparse anomaly signatures. On the TOW-IDS dataset, X-SPUR achieves an AUC of 0.9987. This is marginally higher than the 0.9969 reported for AERO. X-SPUR also eliminates handcrafted feature engineering. We train a separate CarDS model using the same architecture and training hyperparameters. This model retains strong performance on the second automotive Ethernet dataset. Beyond detection, per-token surprisal provides fine-grained explainability by attributing anomaly scores to specific protocol fields, supporting interpretable security analysis in heterogeneous in-vehicle networks.
Keywords
Subject
Publication details
- Journal
- Not available
- Open access
- Green open access
Cite this article
APA 7
Kim, J., & Jeong, S. (2026). X-SPUR: Explainable Surprisal-Based Protocol-Aware Unsupervised Reasoning for Automotive Ethernet Intrusion Detection. https://omanscience.com/en/articles/x-spur-explainable-surprisal-based-protocol-aware-unsupervised-reasoning-for-automotive-ethernet-intrusion-detection
MLA 9
Kim, Jisoo, and Seonghoon Jeong. "X-SPUR: Explainable Surprisal-Based Protocol-Aware Unsupervised Reasoning for Automotive Ethernet Intrusion Detection." https://omanscience.com/en/articles/x-spur-explainable-surprisal-based-protocol-aware-unsupervised-reasoning-for-automotive-ethernet-intrusion-detection.
Chicago (author–date)
Kim, Jisoo, and Seonghoon Jeong. 2026. "X-SPUR: Explainable Surprisal-Based Protocol-Aware Unsupervised Reasoning for Automotive Ethernet Intrusion Detection." https://omanscience.com/en/articles/x-spur-explainable-surprisal-based-protocol-aware-unsupervised-reasoning-for-automotive-ethernet-intrusion-detection.
Harvard
Kim, J. and Jeong, S. (2026) 'X-SPUR: Explainable Surprisal-Based Protocol-Aware Unsupervised Reasoning for Automotive Ethernet Intrusion Detection', Available at: https://omanscience.com/en/articles/x-spur-explainable-surprisal-based-protocol-aware-unsupervised-reasoning-for-automotive-ethernet-intrusion-detection.
Vancouver
Kim J, Jeong S. X-SPUR: Explainable Surprisal-Based Protocol-Aware Unsupervised Reasoning for Automotive Ethernet Intrusion Detection. https://omanscience.com/en/articles/x-spur-explainable-surprisal-based-protocol-aware-unsupervised-reasoning-for-automotive-ethernet-intrusion-detection
IEEE
J. Kim, and S. Jeong, "X-SPUR: Explainable Surprisal-Based Protocol-Aware Unsupervised Reasoning for Automotive Ethernet Intrusion Detection," https://omanscience.com/en/articles/x-spur-explainable-surprisal-based-protocol-aware-unsupervised-reasoning-for-automotive-ethernet-intrusion-detection.