Evaluating Small Language Models for Intrusion Detection on Automotive Embedded Platforms

The increasing reliance on embedded computing and communication systems in vehicles has expanded their attack surface, making embedded automotive systems increasingly vulnerable to malware and intrusion. Traditional intrusion detection systems, originally designed for general-purpose computing, are often too resource-intensive for deployment in automotive environments. This study investigates the use of Small Language Models (SLMs) for lightweight intrusion detection in embedded automotive systems. We implement a CAN-to-text transformation that allows transformer-based SLMs to model Controller Area Network (CAN) traffic as contextual sequences and effectively detect anomalous communication patterns. The results demonstrate the feasibility of using compact transformer architectures for embedded intrusion detection. We evaluate three representative SLMs, such as MiniLM, DistilBERT, and TinyBERT, on an embedded development board. Among them, MiniLM achieved the most balanced performance, offering high detection accuracy while consuming less power and memory than DistilBERT. TinyBERT provided better computational efficiency, but at the cost of reduced accuracy, limiting its use in safety-critical environments. Our findings indicate that compact transformer-based models can effectively balance accuracy and efficiency, making them viable candidates for next-generation in-vehicle intrusion detection systems.