# Detecting Masquerade Attacks in Controller Area Networks Using Graph Machine Learning

arXiv: https://arxiv.org/abs/2408.05427 · HTML: https://mlsanity.com/paper/2408.05427/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 23 of its 86 references that are in the map.
- First posted on arXiv 10 Aug 2024.

## Builds on (most cited first, 23 of 23)

- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [A Comprehensive Survey on Graph Neural Networks](https://mlsanity.com/paper/1901.00596/) (2019)
- [node2vec: Scalable Feature Learning for Networks](https://mlsanity.com/paper/1607.00653/) (2016)
- [Graph Embedding Techniques, Applications, and Performance: A Survey](https://mlsanity.com/paper/1705.02801/) (2017)
- [Machine Learning on Graphs: A Model and Comprehensive Taxonomy](https://mlsanity.com/paper/2005.03675/) (2020)
- [A Survey on Graph Representation Learning Methods](https://mlsanity.com/paper/2204.01855/) (2022)
- [Knowledge Graph Embedding: A Survey from the Perspective of Representation Spaces](https://mlsanity.com/paper/2211.03536/) (2022)
- [CANet: An Unsupervised Intrusion Detection System for High Dimensional CAN Bus Data](https://mlsanity.com/paper/1906.02492/) (2019)
- [Principled approach to the selection of the embedding dimension of networks](https://mlsanity.com/paper/2004.09928/) (2020)
- [A Comprehensive Guide to CAN IDS Data & Introduction of the ROAD Dataset](https://mlsanity.com/paper/2012.14600/) (2020)
- [Systematic comparison of graph embedding methods in practical tasks](https://mlsanity.com/paper/2106.10198/) (2021)
- [CAN-D: A Modular Four-Step Pipeline for Comprehensively Decoding Controller Area Network Data](https://mlsanity.com/paper/2006.05993/) (2020)
- [CANShield: Deep Learning-Based Intrusion Detection Framework for Controller Area Networks at the Signal-Level](https://mlsanity.com/paper/2205.01306/) (2022)
- [Detection of Message Injection Attacks onto the CAN Bus using Similarity of Successive Messages-Sequence Graphs](https://mlsanity.com/paper/2104.03763/) (2021)
- [GGNB: Graph-Based Gaussian Naive Bayes Intrusion Detection System for CAN Bus](https://mlsanity.com/paper/2108.10908/) (2021)
- [Graph-Based Intrusion Detection System for Controller Area Networks](https://mlsanity.com/paper/2009.11440/) (2020)
- [Detecting CAN Masquerade Attacks with Signal Clustering Similarity](https://mlsanity.com/paper/2201.02665/) (2022)
- [Knowledge Graph Embedding Methods for Entity Alignment: An Experimental Review](https://mlsanity.com/paper/2203.09280/) (2022)
- [Condition monitoring and anomaly detection in cyber-physical systems](https://mlsanity.com/paper/2301.09030/) (2023)
- [Robustness of shallow graph embedding methods for community detection](https://mlsanity.com/paper/2405.00636/) (2024)
- [Evaluating lightweight unsupervised online IDS for masquerade attacks in CAN](https://mlsanity.com/paper/2406.13778/) (2024)
- [Graph-Based Machine Learning Improves Just-in-Time Defect Prediction](https://mlsanity.com/paper/2110.05371/) (2021)
- [Shape of the Cloak: Formal Analysis of Clock Skew-Based Intrusion Detection System in Controller Area Networks](https://mlsanity.com/paper/1807.09432/) (2018)

## Built on by (most cited first, 1 of 1)

- [Evaluating False Alarm and Missing Attacks in CAN IDS](https://mlsanity.com/paper/2602.02781/) (2026)

## Abstract (arXiv)

Modern vehicles rely on a myriad of electronic control units (ECUs) interconnected via controller area networks (CANs) for critical operations. Despite their ubiquitous use and reliability, CANs are susceptible to sophisticated cyberattacks, particularly masquerade attacks, which inject false data that mimic legitimate messages at the expected frequency. These attacks pose severe risks such as unintended acceleration, brake deactivation, and rogue steering. Traditional intrusion detection systems (IDS) often struggle to detect these subtle intrusions due to their seamless integration into normal traffic. This paper introduces a novel framework for detecting masquerade attacks in the CAN bus using graph machine learning (ML). We hypothesize that the integration of shallow graph embeddings with time series features derived from CAN frames enhances the detection of masquerade attacks. We show that by representing CAN bus frames as message sequence graphs (MSGs) and enriching each node with contextual statistical attributes from time series, we can enhance detection capabilities across various attack patterns compared to using graph-based features only. Our method ensures a comprehensive and dynamic analysis of CAN frame interactions, improving robustness and efficiency. Extensive experiments on the ROAD dataset validate the effectiveness of our approach, demonstrating statistically significant improvements in the detection rates of masquerade attacks compared to a baseline that uses graph-based features only as confirmed by Mann-Whitney U and Kolmogorov-Smirnov tests p < 0.05.