SeqWatch: Unsupervised Sequence-based Intrusion Detection System for Automotive Ethernet - Leandro, Maurício S. G. A.; Araujo-Filho, Paulo Freitas de; Campelo, Divanilson R.; da Luz, Luigi F. Marques (Anais do Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos (SBRC); 2025: Anais do XLIII Simpósio Brasileiro de Redes de Computadores e Sistemas DistribuídosDO - 10.5753/sbrc.2025.5949, 2025)
Modern connected vehicles are increasing the demand for Ethernet in automotive networks due to its ability to provide high-bandwidth and flexible in-vehicle communication. However, Ethernet lacks built-in authentication and encryption, which has led to growing interest in Intrusion Detection Systems (IDS) as a defense mechanism to detect malicious activities when other security mechanisms are not present or fail. In this work, we present SeqWatch, an unsupervised IDS that uses a sequence-based deep learning model capable of capturing the temporal relationships in network traffic. SeqWatch can identify previously unseen (zero-day) attacks by training only on normal traffic data. Our experimental results show that SeqWatch outperforms other state-of-the-art unsupervised automotive IDSs, achieving higher detection rates in attacks from two publicly available datasets.