CANBERT+: An Optimized Multi-Layer BERT-Based Intrusion Detection for CAN Bus

Controller Area Network (CAN) buses in modern vehicles lack fundamental security mechanisms, leaving them vulnerable to message-injection attacks. While Transformer-based Intrusion Detection Systems (IDS) are a promising solution, existing designs struggle to balance performance with efficiency, either discarding payload context or incurring high computational costs and vocabulary explosion when modeling full CAN frames. We present CANBERT+, an optimized BERT-based IDS designed to consider realistic deployment viability without sacrificing message context, which makes 6 times faster. CANBERT+ represents each CAN message as a single token augmented with multi-layer embeddings for the identifier, data length, and payload bytes with the elimination of redundant layers. This approach differentiates payload nuances while maintaining short sequence lengths to allow the model to capture byte-level context. Following a two-stage training process, self-supervised pre-training on benign traffic and supervised fine-tuning on attacks, we evaluated CANBERT+ on eight public datasets covering spoofing, fuzzing, DoS, and replay attacks. The model consistently outperforms traditional machine learning baselines and prior BERT-based IDSs; notably, it improves the F1 score on replay attacks from 0.60 to 0.72, which is 20% improvement. Furthermore, we introduce two compact variants that reduce model size by up to 205 times while preserving high detection accuracy, making the approach suitable for resource-constrained automotive hardware.