Scholarlink

The CAN bus is vulnerable to various attacks due to the lack of data frame encryption and authentication. Most existing practical IDS solutions rely on the knowledge of ECU identities, which are proprietary information and not open to the public. Therefore, this paper proposes an anomaly detection mechanism that does not rely on ECU IDs. By constructing a dynamic graph with CAN messages, the temporal graph attention network is used to continuously capture the structural characteristics of the graph and the changes on node states. Then potential anomalies can be discovered in the evolving process of graph flow. In addition, as abnormal samples in actual flow are often scarce and difficult to be captured, we use the statistical distribution of unlabeled samples as the reference distribution for loss calculation. Corresponding pseudo labels are generated to participate in supervised learning, in order to fully utilize the potential of unlabeled samples. At last, the experiments have been conducted, compared with previously proposed CAN bus abnormal detection methods. It is proved that the mechanism proposed in this paper has a good performance on DoS, Fuzzy, RPM and GEAR attacks, considering on the accuracy, precision, F1-score and other indicators.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Dynamic Graph-Based Semi-supervised Anomaly Detection for In-Vehicle CAN Bus Network

  • 会议论文

  • 发表日期：

    2025年

查看全文
  • Chao Wang,
  • Qiuyu Zhang,
  • Yunhua He,
  • Ke Xiao

摘要

The CAN bus is vulnerable to various attacks due to the lack of data frame encryption and authentication. Most existing practical IDS solutions rely on the knowledge of ECU identities, which are proprietary information and not open to the public. Therefore, this paper proposes an anomaly detection mechanism that does not rely on ECU IDs. By constructing a dynamic graph with CAN messages, the temporal graph attention network is used to continuously capture the structural characteristics of the graph and the changes on node states. Then potential anomalies can be discovered in the evolving process of graph flow. In addition, as abnormal samples in actual flow are often scarce and difficult to be captured, we use the statistical distribution of unlabeled samples as the reference distribution for loss calculation. Corresponding pseudo labels are generated to participate in supervised learning, in order to fully utilize the potential of unlabeled samples. At last, the experiments have been conducted, compared with previously proposed CAN bus abnormal detection methods. It is proved that the mechanism proposed in this paper has a good performance on DoS, Fuzzy, RPM and GEAR attacks, considering on the accuracy, precision, F1-score and other indicators.