These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Modern vehicles rely on a myriad of electronic control units (ECUs)
interconnected via controller area networks (CANs) for critical operations.
Despite their ubiquitous use and reliability, CANs are susceptible to
sophisticated cyberattacks, particularly masquerade attacks, which inject false
data that mimic legitimate messages at the expected frequency. These attacks
pose severe risks such as unintended acceleration, brake deactivation, and
rogue steering. Traditional intrusion detection systems (IDS) often struggle to
detect these subtle intrusions due to their seamless integration into normal
traffic. This paper introduces a novel framework for detecting masquerade
attacks in the CAN bus using graph machine learning (ML). We hypothesize that
the integration of shallow graph embeddings with time series features derived
from CAN frames enhances the detection of masquerade attacks. We show that by
representing CAN bus frames as message sequence graphs (MSGs) and enriching
each node with contextual statistical attributes from time series, we can
enhance detection capabilities across various attack patterns compared to using
only graph-based features. Our method ensures a comprehensive and dynamic
analysis of CAN frame interactions, improving robustness and efficiency.
Extensive experiments on the ROAD dataset validate the effectiveness of our
approach, demonstrating statistically significant improvements in the detection
rates of masquerade attacks compared to a baseline that uses only graph-based
features, as confirmed by Mann-Whitney U and Kolmogorov-Smirnov tests (p <
0.05).