Graph-Based Intrusion Detection for CAN Bus Security: An Explainable AI Approach
摘要
Controller Area Networks (CANs) are integral to modern automotive systems, enabling communication among electronic control units (ECUs) for functions such as acceleration, braking, and steering. However, CANs lack fundamental security mechanisms, making them vulnerable to cyberattacks. This paper proposes a graph-based intrusion detection system that leverages machine learning and explainable artificial intelligence (XAI) to detect cyber threats in CAN bus networks. This study uses the CAN-MIRGU dataset, the largest for CAN security research, covering injection, suspension, and masquerade attacks. A graph-based approach is adopted to model complex ECU communication patterns, enhancing detection accuracy and interpretability. The proposed method achieves high F1-scores across attack types: 97.15% for mixed, 97.74% for injection, 99.68% for masquerade, and 99.56% for suspension attacks. The results demonstrate that the proposed method effectively identifies cyber threats while integrating XAI techniques to improve model transparency. Analysis of attack and attack-free prediction instances using XAI provides a novel insight that lower betweenness centrality (BC) values indicate disrupted, decentralized interactions, making them more likely to be associated with an attack, thus distinguishing normal from attack scenarios. This research advances CAN bus security by providing an interpretable, high-performing Intrusion Detection System (IDS) for automotive cybersecurity.