CANMentor: A Large-Small Model Collaboration Framework for CAN Bus Intrusion Detection

Summary

CANMentor is a framework in which a cloud-side large language model teacher supervises lightweight intrusion detection models on vehicles, addressing the lack of built-in security on the Controller Area Network (CAN) bus. A privacy-aware generator converts original CAN messages into proxies before cloud inference, and the vehicle uses teacher predictions only within a latency bound. On non-IID partitions of the ROAD and HCRL Car-Hacking datasets, knowledge distillation yields maximum relative Macro F1 improvements of 25.01% and 20.79%.