A Novel Feature Extraction Framework Using Graph Node Attention Network for In-Vehicle Networks Intrusion Detection

As various intelligent networked devices are increasingly introduced and applied or connected to modern vehicles, the services and functions of vehicles with controller area network (CAN) become more powerful and intelligent, however, exposed to the wide external networks. which suffer from serious cyber-security threats. Benefit from the intelligent and networked techniques, CAN for modern intelligent vehicles develops rapidly, but still faces critical security problems since it is lack of strong security protection mechanism. For the threat detection of CAN in modern vehicles, this research proposes a graph node attention network (GNAT) method to extract CAN packet context-dependent features, and improve the accuracy of malicious packet IDs identification in packet sequence windows. First, time-continuous CAN packets are converted into node profile according to the arbitration field, and the obtained nodes are connected to edges based on the time–adjacent relationship, thereby being converted into a graph. Using proper graph construction method, normal and malicious CAN packets can be converted into graphs with different topological structures. Second, the attention values of each node and edge in the graph are calculated with the GNAT through the topology difference between normal and malicious CAN packet conversion graphs, and then the node fusion features are acquired. The fused features are fed to the random forest for training and intrusion detection of CAN. Multiple tests were carried out, and the results show the features extracted by GNAT can help improve the generalization performance of the trained random forest model.