Abstract
The rapid growth of connected and autonomous vehicles has greatly expanded the cyberattack surface of in-vehicle networks, especially those based on the Controller Area Network (CAN) bus, which lacks built-in authentication and encryption. This paper presents a lightweight, semi-supervised intrusion detection system (IDS) that integrates generative adversarial networks (GANs) and large language models (LLMs) to deliver high accuracy, efficiency, and interpretability. CAN traffic is transformed into image-like representations that combine identifiers, data length codes, and payload bytes to capture both structural and semantic features. A binarized GAN discriminator generates compact, discriminative embeddings that are classified by a multi-layer perceptron (MLP) under limited supervision. To improve robustness, GAN-based data augmentation enhances detection stability when trained with as little as 10% of attack data. Experiments on the Car-Hacking and Survival benchmark datasets achieve over 99% detection accuracy, outperforming existing baselines while maintaining a total footprint under 10 MB and inference latency below 2 ms. Also, an LLM-driven interpreter produces concise, human-readable explanations for IDS alerts, increasing operator trust and transparency. The results demonstrate the feasibility of a scalable, explainable, and real-time IDS for next-generation intelligent vehicles.