# Graph-Based Intrusion Detection System for Controller Area Networks

arXiv: https://arxiv.org/abs/2009.11440 · HTML: https://mlsanity.com/paper/2009.11440/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Sep 2020.

## Built on by (most cited first, 5 of 5)

- [FreeGAD: A Training-Free yet Effective Approach for Graph Anomaly Detection](https://mlsanity.com/paper/2508.10594/) (2025)
- [Detecting Masquerade Attacks in Controller Area Networks Using Graph Machine Learning](https://mlsanity.com/paper/2408.05427/) (2024)
- [STATGRAPH: Effective In-vehicle Intrusion Detection via Multi-view Statistical Graph Learning](https://mlsanity.com/paper/2311.07056/) (2023)
- [KD-GAT: Combining Knowledge Distillation and Graph Attention Transformer for a Controller Area Network Intrusion Detection System](https://mlsanity.com/paper/2507.19686/) (2025)
- [A Multi Method Importance and Performance Efficiency Analysis of Topological Metrics for Natural Visibility Graph Based Cyber Attack Detection](https://mlsanity.com/paper/2610.02342/) (2026)

## Abstract (arXiv)

The controller area network (CAN) is the most widely used intra-vehicular communication network in the automotive industry. Because of its simplicity in design, it lacks most of the requirements needed for a security-proven communication protocol. However, a safe and secured environment is imperative for autonomous as well as connected vehicles. Therefore CAN security is considered one of the important topics in the automotive research community. In this paper, we propose a four-stage intrusion detection system that uses the chi-squared method and can detect any kind of strong and weak cyber attacks in a CAN. This work is the first-ever graph-based defense system proposed for the CAN. Our experimental results show that we have a very low 5.26% misclassification for denial of service (DoS) attack, 10% misclassification for fuzzy attack, 4.76% misclassification for replay attack, and no misclassification for spoofing attack. In addition, the proposed methodology exhibits up to 13.73% better accuracy compared to existing ID sequence-based methods.