{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T03:21:08Z","timestamp":1783567268493,"version":"3.55.0"},"reference-count":37,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2026,2,11]],"date-time":"2026-02-11T00:00:00Z","timestamp":1770768000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["MAKE"],"abstract":"<jats:p>Modern Autonomous Vehicles generate large volumes of heterogeneous in-vehicle data, making cybersecurity a critical challenge as adversarial attacks become increasingly adaptive, stealthy, and multi-protocol. Traditional intrusion detection systems often fail under these conditions because of their limited contextual understanding, poor robustness to distribution shifts, and insufficient regulatory transparency. This study introduces LLM-Guardian, a hierarchical intrusion detection framework with decision-making mechanisms that integrates Large Language Models (LLMs) with classical statistical detection theory, optimal transport drift analysis, graph neural networks, and formal uncertainty quantification. LLM-Guardian uses semantic anomaly scoring, conformal prediction for distribution-free confidence calibration, adaptive cumulative sum (CUSUM) sequential testing for low-latency detection, and topology-aware GNN reasoning designed to identify coordinated attacks across CAN, Ethernet, and V2X interfaces. In this work, the framework is empirically evaluated on four heterogeneous CAN-bus datasets, while the Ethernet and V2X components are instantiated at the architectural level and left as directions for future multi-protocol experimentation.<\/jats:p>","DOI":"10.3390\/make8020043","type":"journal-article","created":{"date-parts":[[2026,2,11]],"date-time":"2026-02-11T13:25:49Z","timestamp":1770816349000},"page":"43","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Towards LLM-Driven Cybersecurity in Autonomous Vehicles: A Big Data-Empowered Framework with Emerging Technologies"],"prefix":"10.3390","volume":"8","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4632-6511","authenticated-orcid":false,"given":"Aristeidis","family":"Karras","sequence":"first","affiliation":[{"name":"Computer Engineering and Informatics Department, University of Patras, 26504 Patras, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0891-6780","authenticated-orcid":false,"given":"Leonidas","family":"Theodorakopoulos","sequence":"additional","affiliation":[{"name":"Department of Management Science and Technology, University of Patras, 26334 Patras, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4253-7661","authenticated-orcid":false,"given":"Christos","family":"Karras","sequence":"additional","affiliation":[{"name":"Computer Engineering and Informatics Department, University of Patras, 26504 Patras, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-6314-7795","authenticated-orcid":false,"given":"Alexandra","family":"Theodoropoulou","sequence":"additional","affiliation":[{"name":"Department of Management Science and Technology, University of Patras, 26334 Patras, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,2,11]]},"reference":[{"key":"ref_1","unstructured":"Sharma, S., Tuli, S., and Badam, N. (2025). Challenges and Applications of Large Language Models: A Comparison of GPT and DeepSeek Family of Models. arXiv."},{"key":"ref_2","first-page":"141","article-title":"A Survey of Adaptation of Large Language Models to Idea and Hypothesis Generation: Downstream Task Adaptation, Knowledge Distillation Approaches and Challenges","volume":"58","author":"Oyelade","year":"2025","journal-title":"ACM Comput. Surv."},{"key":"ref_3","first-page":"e240895","article-title":"Privacy-Ensuring Open-Weights Large Language Models Are Competitive with Closed-Weights GPT-4o in Extracting Chest Radiography Findings from Free-Text Reports","volume":"314","author":"Montalenti","year":"2024","journal-title":"Radiology"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Karras, A., Theodorakopoulos, L., Karras, C., Theodoropoulou, A., Kalliampakou, I., and Kalogeratos, G. (2025). LLMs for Cybersecurity in the Big Data Era: A Comprehensive Review of Applications, Challenges, and Future Directions. Information, 16.","DOI":"10.3390\/info16110957"},{"key":"ref_5","unstructured":"Luo, Y., Qin, Z., Zhang, N., Li, S., and Qin, Z. (2024). The Dark Side of AI: Large Language Models as Tools for Cyber Attacks on Vehicle Systems. arXiv."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"116818","DOI":"10.1109\/ACCESS.2025.3584649","article-title":"Cybersecurity in Connected and Autonomous Vehicles: A Systematic Review of Automotive Security","volume":"13","author":"Abreu","year":"2024","journal-title":"IEEE Access"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Aloraini, F., Javed, A., and Rana, O. (2024). Adversarial Attacks on Intrusion Detection Systems in In-Vehicle Networks of Connected and Autonomous Vehicles. Sensors, 24.","DOI":"10.3390\/s24123848"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Wang, Y., Ren, Y., Qin, H., Cui, Z., Zhao, Y., and Yu, H. (2024). A Dataset for Cyber Threat Intelligence Modeling of Connected Autonomous Vehicles. arXiv.","DOI":"10.1038\/s41597-025-04439-5"},{"key":"ref_9","unstructured":"(2021). Road Vehicles\u2014Cybersecurity Engineering (Standard No. ISO\/SAE 21434:2021)."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Kukkala, V.K., Thiruloga, S.V., and Pasricha, S. (2022). Roadmap for Cybersecurity in Autonomous Vehicles. arXiv.","DOI":"10.1109\/MCE.2022.3154346"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Angelopoulos, A.N., and Bates, S. (2022). A Gentle Introduction to Conformal Prediction and Distribution-Free Uncertainty Quantification. arXiv.","DOI":"10.1561\/9781638281597"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"4","DOI":"10.1109\/TNNLS.2020.2978386","article-title":"A Comprehensive Survey on Graph Neural Networks","volume":"32","author":"Wu","year":"2021","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_13","first-page":"100198","article-title":"In-vehicle network intrusion detection using deep convolutional neural network","volume":"21","author":"Song","year":"2020","journal-title":"Veh. Commun."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Verma, M.E., Bridges, R.A., Iannacone, M.D., Hollifield, S.C., Moriano, P., Hespeler, S.C., Kay, B., and Combs, F.L. (2024). A Comprehensive Guide to CAN IDS Data and Introduction of the ROAD Dataset. PLoS ONE, 19.","DOI":"10.1371\/journal.pone.0296879"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"237","DOI":"10.1145\/3570954","article-title":"AI-Based Intrusion Detection Systems for In-Vehicle Networks: A Survey","volume":"55","author":"Rajapaksha","year":"2023","journal-title":"ACM Comput. Surv."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"185489","DOI":"10.1109\/ACCESS.2020.3029307","article-title":"LSTM-Based Intrusion Detection System for In-Vehicle CAN Bus Communications","volume":"8","author":"Hossain","year":"2020","journal-title":"IEEE Access"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Moriano, P., Bridges, R.A., and Iannacone, M.D. (2022, January 24). Detecting CAN Masquerade Attacks with Signal Clustering Similarity. Proceedings of the 4th International Workshop on Automotive and Autonomous Vehicle Security (AutoSec) 2022, San Diego, CA, USA.","DOI":"10.14722\/autosec.2022.23028"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"13820","DOI":"10.1038\/s41598-025-98433-x","article-title":"Securing the CAN Bus Using Deep Learning for Intrusion Detection in Vehicles","volume":"15","author":"Rai","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Bari, B.S., Yelamarthi, K., and Ghafoor, S. (2023). Intrusion Detection in Vehicle Controller Area Network (CAN) Bus Using Machine Learning: A Comparative Performance Study. Sensors, 23.","DOI":"10.3390\/s23073610"},{"key":"ref_20","first-page":"8570","article-title":"Transformer-Based Attention Network for In-Vehicle Intrusion Detection","volume":"24","author":"Nguyen","year":"2023","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"1897","DOI":"10.1214\/aoms\/1177693055","article-title":"Procedures for Reacting to a Change in Distribution","volume":"42","author":"Lorden","year":"1971","journal-title":"Ann. Math. Stat."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"467","DOI":"10.1081\/SQA-200038994","article-title":"Likelihood Ratio Identities and Their Applications to Sequential Analysis","volume":"23","author":"Lai","year":"2004","journal-title":"Seq. Anal."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1109\/TNN.2008.2005605","article-title":"The Graph Neural Network Model","volume":"20","author":"Scarselli","year":"2009","journal-title":"IEEE Trans. Neural Netw."},{"key":"ref_24","unstructured":"Kipf, T.N., and Welling, M. (2017, January 24\u201326). Semi-Supervised Classification with Graph Convolutional Networks. Proceedings of the 5th International Conference on Learning Representations (ICLR 2017), Toulon, France."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"22111","DOI":"10.1109\/JIOT.2023.3303271","article-title":"CANShield: Deep-Learning-Based Intrusion Detection Framework for Controller Area Networks at the Signal Level","volume":"10","author":"Shahriar","year":"2023","journal-title":"IEEE Internet of Things J."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"355","DOI":"10.1561\/2200000073","article-title":"Computational Optimal Transport: With Applications to Data Science","volume":"11","author":"Cuturi","year":"2019","journal-title":"Found. Trends Mach. Learn."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Lee, J., and Rew, J. (2025). Vision-Language Model-Based Local Interpretable Model-Agnostic Explanations Analysis for Explainable In-Vehicle Controller Area Network Intrusion Detection. Sensors, 25.","DOI":"10.3390\/s25103020"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Chen, T., and Guestrin, C. (2016). XGBoost: A Scalable Tree Boosting System. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Association for Computing Machinery.","DOI":"10.1145\/2939672.2939785"},{"key":"ref_29","unstructured":"Nkomo, S., Moyo, S., and Thakur, S. (2025). LENS-XAI: Redefining Lightweight and Explainable Network Security Through Knowledge Distillation and Variational Autoencoders for Scalable Intrusion Detection in Cybersecurity. arXiv."},{"key":"ref_30","unstructured":"Bonawitz, K., Eichner, H., Grieskamp, W., Huba, D., Ingerman, A., Ivanov, V., Kiddon, C., Kone\u010dn\u00fd, J., Mazzocchi, S., and McMahan, H.B. (April, January 31). Towards Federated Learning at Scale: System Design. Proceedings of the 2nd Conference on Machine Learning and Systems, Stanford, CA, USA."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Zhang, L., Zuo, J., Lu, Y., and Zou, S. (2024). Personalized Differential Privacy Federated Learning Model for Internet of Vehicles. Proceedings of the 2024 IEEE Smart World Congress (SWC) Nadi, Fiji, 2\u20137 December 2024, IEEE.","DOI":"10.1109\/SWC62898.2024.00349"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"1456","DOI":"10.1109\/TNSE.2021.3059881","article-title":"CANintelliIDS: Detecting In-Vehicle Intrusion Attacks on a Controller Area Network Using CNN and Attention-Based GRU","volume":"8","author":"Javed","year":"2021","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Seo, E., Song, H.M., and Kim, H.K. (2018). GIDS: GANBased Intrusion Detection System for In-Vehicle Network. Proceedings of the 2018 16th Annual Conference on Privacy, Security and Trust (PST), IEEE.","DOI":"10.1109\/PST.2018.8514157"},{"key":"ref_34","unstructured":"Tariq, S., Lee, S., and Woo, S.S. (April, January 30). CANTransfer: Transfer Learning-Based Intrusion Detection on a Controller Area Network Using Convolutional LSTM Network. SAC \u201920: Proceedings of the 35th Annual ACM Symposium on Applied Computing, Brno, Czech Republic."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"55389","DOI":"10.1109\/ACCESS.2023.3282110","article-title":"Transformer-Based Attention Network for In-Vehicle Intrusion Detection","volume":"11","author":"Nguyen","year":"2023","journal-title":"IEEE Access"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Luo, L., Liu, C., Xue, Z., and Han, G. (2024). An Attention Mechanism Spatio-Temporal Graph Framework for Misbehavior Detection in IoV. 2024 IEEE 10th International Symposium on Microwave, Antenna, Propagation and EMC Technologies for Wireless Communications (MAPE), IEEE.","DOI":"10.1109\/MAPE62875.2024.10813797"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"113","DOI":"10.1016\/j.ins.2013.07.007","article-title":"An Insight into Classification with Imbalanced Data: Empirical Results and Current Trends on Using Data Intrinsic Characteristics","volume":"250","author":"Palade","year":"2013","journal-title":"Inf. Sci."}],"container-title":["Machine Learning and Knowledge Extraction"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2504-4990\/8\/2\/43\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,11]],"date-time":"2026-02-11T14:04:58Z","timestamp":1770818698000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2504-4990\/8\/2\/43"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2,11]]},"references-count":37,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2026,2]]}},"alternative-id":["make8020043"],"URL":"https:\/\/doi.org\/10.3390\/make8020043","relation":{},"ISSN":["2504-4990"],"issn-type":[{"value":"2504-4990","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,2,11]]}}}