Towards a Hybrid Generative AI-Based Framework for Automotive Cybersecurity: A Feasibility Study

This repository contains the source code, Jupyter Notebooks, and data artifacts used in the preliminary feasibility study for the proposed hybrid Generative AI (GenAI) cybersecurity framework. ## Overview This repository contains the replication package (datasets, Jupyter Notebooks, and generated artifacts) for the paper *"Towards a Hybrid Generative AI-Based Framework for Automotive Cybersecurity: A Feasibility Study"*. The provided codebase empirically demonstrates the potential of Generative AI in Vehicle Security Operations Centers (VSOCs), while explicitly highlighting the critical structural and semantic limitations of off-the-shelf models when applied to cyber-physical systems without proper architectural orchestration (e.g., Semantic Sanitization and Retrieval-Augmented Generation). ## Abstract Vehicle Security Operations Centers face two critical challenges: the scarcity of zero-day attack data for training Intrusion Detection Systems, and the cognitive overload on analysts interpreting raw vehicular logs. This paper proposes a hybrid Generative AI-Based (GenAI) framework to address these issues by integrating a Generative Adversarial Network (GAN) for data augmentation and a lightweight Large Language Model (LLM) for alert interpretation. A preliminary feasibility study using a Conditional Tabular GAN and LLM demonstrates the potential of GenAI but also reveals critical limitations in off-the-shelf models, including semantic integrity violations in generated packets and hallucination risks in alert interpretation, underscoring the need for robust architectural orchestration and tailored software engineering practices in critical automotive environments. ## Repository Structure & Contents The project is divided into three main operational phases, reflecting the architecture proposed in the paper: DoS_dataset.csv: A sample of the original raw CAN bus logs (provided by the Hacking and Countermeasure Research Lab - HCRL). Contains both normal traffic and DoS attack injections. Phase_1.ipynb: Script for Synthetic Data Generation. Trains a CTGAN model on the raw data. Note: We intentionally bypass data sanitization here to demonstrate how off-the-shelf generative models blindly replicate structural artifacts (e.g., NaNs in variable-length packets). synthetic_data_output.csv: The output generated by Phase 1, showcasing the semantic violations (e.g., traffic flags shifted into payload columns). Phase_1_KS_TEST.ipynb: Evaluation script that calculates the statistical fidelity (Kolmogorov-Smirnov Test) and generates the comparative distribution chart between real and synthetic CAN IDs. Phase_2.ipynb: Script for the Intrusion Detection System (IDS). Implements a Random Forest classifier. It applies a strict programmatic coercion step to address structural misalignments in the raw data, detects DoS attacks, and exports the True Positives. detected_alerts.csv: The simulated SIEM queue. Contains only the malicious packets correctly identified by Phase 2, formatted with simulated tracking IDs. Phase_3.ipynb: Script for the Virtual Analyst. Loads the `TinyLlama-1.1B-Chat-v1.0` model locally to simulate an on-premises VSOC environment. It reads the alerts from Phase 2 and generates natural language diagnostics. ## How to Reproduce To replicate the feasibility study, execute the Jupyter Notebooks sequentially (Phase 1 $\rightarrow$ Phase 2 $\rightarrow$ Phase 3) in a GPU-accelerated environment (e.g., Google Colab with an NVIDIA T4 GPU).