# STATGRAPH: Effective In-vehicle Intrusion Detection via Multi-view Statistical Graph Learning

arXiv: https://arxiv.org/abs/2311.07056 · HTML: https://mlsanity.com/paper/2311.07056/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 14 of its 42 references that are in the map.
- First posted on arXiv 13 Nov 2023.

## Builds on (most cited first, 14 of 14)

- [Semi-Supervised Classification with Graph Convolutional Networks](https://mlsanity.com/paper/1609.02907/) (2016)
- [EfficientNet: Rethinking Model Scaling for Convolutional Neural Networks](https://mlsanity.com/paper/1905.11946/) (2019)
- [Searching for MobileNetV3](https://mlsanity.com/paper/1905.02244/) (2019)
- [GIDS: GAN based Intrusion Detection System for In-Vehicle Network](https://mlsanity.com/paper/1907.07377/) (2019)
- [CANet: An Unsupervised Intrusion Detection System for High Dimensional CAN Bus Data](https://mlsanity.com/paper/1906.02492/) (2019)
- [A Comprehensive Guide to CAN IDS Data & Introduction of the ROAD Dataset](https://mlsanity.com/paper/2012.14600/) (2020)
- [CAN-D: A Modular Four-Step Pipeline for Comprehensively Decoding Controller Area Network Data](https://mlsanity.com/paper/2006.05993/) (2020)
- [CANShield: Deep Learning-Based Intrusion Detection Framework for Controller Area Networks at the Signal-Level](https://mlsanity.com/paper/2205.01306/) (2022)
- [Detection of Message Injection Attacks onto the CAN Bus using Similarity of Successive Messages-Sequence Graphs](https://mlsanity.com/paper/2104.03763/) (2021)
- [Detecting In-vehicle Intrusion via Semi-supervised Learning-based Convolutional Adversarial Autoencoders](https://mlsanity.com/paper/2204.01193/) (2022)
- [X-CANIDS: Signal-Aware Explainable Intrusion Detection System for Controller Area Network-Based In-Vehicle Network](https://mlsanity.com/paper/2303.12278/) (2023)
- [GGNB: Graph-Based Gaussian Naive Bayes Intrusion Detection System for CAN Bus](https://mlsanity.com/paper/2108.10908/) (2021)
- [Graph-Based Intrusion Detection System for Controller Area Networks](https://mlsanity.com/paper/2009.11440/) (2020)
- [LEAP: A Lightweight Encryption and Authentication Protocol for In-Vehicle Communications](https://mlsanity.com/paper/1909.10380/) (2019)

## Abstract (arXiv)

In-vehicle network (IVN) is facing complex external cyber-attacks, especially the emerging masquerade attacks with extremely high difficulty of detection while serious damaging effects. In this paper, we propose the STATGRAPH, which is an effective and fine-grained intrusion detection methodology for IVN security services via multi-view statistical graph learning on in-vehicle controller area network (CAN) messages with insight into their variations in periodicity, payload and signal combinations. Specifically, STATGRAPH generates two statistical graphs, timing correlation graph (TCG) and coupling relationship graph (CRG), in every CAN message detection window, where edge attributes in TCGs represent temporal correlation between different message IDs while edge attributes in CRGs denote the neighbour relationship and contextual similarity. Besides, a lightweight shallow layered graph convolution network is trained based on graph property of TCGs and CRGs, which learns the universal laws of various patterns more effectively and further enhance the performance of detection. To address the problem of insufficient attack types in previous intrusion detection, we select two real in-vehicle CAN datasets covering five new instances of sophisticated and stealthy masquerade attacks that are never investigated before. Experimental result shows STATGRAPH improves both detection granularity and detection performance over state-of-the-art intrusion detection methods. Code is available at https://github.com/wangkai-tech23/StatGraph.