SENTINEL-WHEEL: Entropy-Compressed Edge Intelligence for Explainable Self-Healing Cyber Defense in Connected Vehicles

Abstract

Connected vehicle data can flow over in-vehicle buses, but also through V2X-like wireless and wired interconnects, of which only a few were originally built considering today’s adversaries. We introduce the SENTINEL-WHEEL architecture for ultra-fast cyber-event identification and responsive actions in connected vehicles. The design exploits entropy-compressed feature extraction to compress bus data and ignore features in V2X messages and employs a temporal micro-attention classifier that analyzes short windows of messages, eschewing the use of large, complex models. A risk ladder transforms classifier decisions into appropriate, granular responses such as silent logging, sender observation, message authentication, rate limiting, channel disconnection, or safety-envelope actuation. Instead of simply delivering a malicious-or-normal classification, the architecture maintains a trace ledger that explains unusual events in terms of interpretable origins like rate excessive traffic, frequent, jittered transmissions, the misuse of previously unseen vehicle identifier or a discrepancy between current speed/acceleration profile and observed traffic behavior. We present an experiment setup and evaluate typical vehicular traffic. Our initial experimental findings achieve up to 98.6% detection accuracy with an F1 score of 98.2%, meaning detection delay down to 4.7 ms and utilize a mere under a million trainable parameters. Our work outlines a route towards an explainable, scalable on-device cybersecurity solution for the evolving automotive domain.