A&D Graph-Based Graph Neural Network Intrusion Detection for In-Vehicle Controller Area Network

The rapid advancement of the Internet of Vehicles (IoV) has significantly enhanced the diversity and intelligence of Electronic Control Units (ECUs) within the Controller Area Network (CAN) of vehicles. Implementing an effective Intrusion Detection System (IDS) is paramount for ensuring the security of the in-vehicle CAN. Traditional approaches in intrusion detection often rely on single-sample analysis, demanding extensive labeled data. To circumvent this limitation, a graph-based IDS that eliminates the necessity for single-sample labeling becomes imperative. Nonetheless, existing graph-based IDS models encounter the challenge of achieving high accuracy, especially for impersonation attacks. In this paper, we propose Arbitration&Data graph-based Graph Neural Networks (A&D-GNN) IDS to improve detection accuracy for in-vehicle CAN effectively. The proposed A&D-GNN IDS can significantly improve detection accuracy for impersonation attacks, which includes the Arbitration&Data (A&D) graph construction algorithm, representation learning, and intrusion detection. Based on the CAN message characteristics, the A&D directed attribute graph can extract comprehensive information, including information about both the arbitration field and the data field in the CAN message frame, notably, the data field is associated with the arbitration field. Therefore, the following Graph Neural Networks (GNN) with powerful representation capabilities can learn more precise graph-level representations. Lastly, a multi-classification layer is applied to perform intrusion detection. Experimental results on the public benchmark OTIDS dataset show that our proposed model is superior to other models with higher accuracy and an impressive accuracy of 99.92% for impersonation attacks.