用大模型从少量日志中自动识别汽车控制器异常，无需精确标签。
Good Enough to Learn: LLM-based Anomaly Detection in ECU Logs without Reliable Labels
- 用解码器型大模型直接学习通信日志中的正常行为模式。
- 在不一致标签下仍保持检测稳定，熵正则化提升对已知异常的敏感度。
- 适合汽车电子系统等缺乏标注数据的工业场景快速部署。
异常检测通常依赖监督或聚类方法，在汽车通信系统等专用领域效果有限，且缺乏可扩展方案。本文提出一种基于解码器的大型语言模型（LLM），用于检测电子控制单元（ECU）通信日志中的异常。该方法解决两大挑战：缺乏针对ECU通信的专用大模型，以及标注数据不一致的问题。通过学习UDP通信日志，将异常检测定义为识别与正常行为的时间偏差。引入熵正则化技术，使模型在已知异常上增加不确定性，同时保持相似场景的一致性。本方案具有三项创新：解码器架构的异常检测设计、处理不一致标签的方法，以及可适配不同ECU通信场景的可扩展大模型。利用解码器模型的生成能力，提出一种低人工标注成本的可扩展系统，仅需少量样本即可学习，并在复杂通信环境中提升检测准确率。
原文摘要 · Abstract (English)
Anomaly detection often relies on supervised or clustering approaches, with limited success in specialized domains like automotive communication systems where scalable solutions are essential. We propose a novel decoder-only Large Language Model (LLM) to detect anomalies in Electronic Control Unit (ECU) communication logs. Our approach addresses two key challenges: the lack of LLMs tailored for ECU communication and the complexity of inconsistent ground truth data. By learning from UDP communication logs, we formulate anomaly detection simply as identifying deviations in time from normal behavior. We introduce an entropy regularization technique that increases model's uncertainty in known anomalies while maintaining consistency in similar scenarios. Our solution offers three novelties: a decoder-only anomaly detection architecture, a way to handle inconsistent labeling, and an adaptable LLM for different ECU communication use cases. By leveraging the generative capabilities of decoder-only models, we present a new technique that addresses the high cost and error-prone nature of manual labeling through a more scalable system that is able to learn from a minimal set of examples, while improving detection accuracy in complex communication environments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。