CAN Intrusion Detection Using Federated Graph Neural Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing CAN bus intrusion detection systems struggle to simultaneously detect message injection, suspension, and falsification attacks in real-time due to high computation complexity and the inability to handle highly imbalanced training data, while also failing to address bus-off and DoS attacks effectively.
Innovation Solution
A two-stage GNN-based classifier cascade with a one-class classification layer for anomaly detection and a multi-class classification layer for attack classification, utilizing directed attributed graphs to integrate message contents and statistical sequences, combined with federated learning to cover various driving scenarios and vehicle states, and employing an openmax layer for unknown anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing IDS methods use separate models for each CAN ID to detect attacks, then detection accuracy improves, but computation complexity and intrusion detection delay increase significantly
Solution Approach 1:
The patent merges multiple separate detection models into a single unified GNN model that processes all CAN IDs simultaneously. The graph structure integrates message sequences and contents across different CAN IDs, allowing the model to learn global patterns while maintaining detection accuracy for individual CAN IDs without requiring separate models for each.
Solution Approach 2:
The GNN-based IDS is designed as a universal detection system that can handle multiple attack types (injection, suspension, falsification) across all CAN IDs using a single model. The graph neural network architecture provides multi-functionality by processing diverse message patterns and attack scenarios within one unified framework, eliminating the need for multiple specialized models.
2Reliability
If message frequency or sequence-based detection methods are used, then injection and suspension attacks can be detected, but falsification attacks are missed
Solution Approach 1:
The patent combines message sequence analysis and message content analysis into a unified graph structure where nodes represent CAN IDs and edges represent message sequences. The GNN processes both sequence patterns and content features simultaneously, enabling the system to detect all three attack types (injection, suspension, and falsification) by leveraging complementary information from both sequence and content dimensions.
Solution Approach 2:
The detection approach uses a composite feature representation that integrates statistical message sequences with actual message contents. This composite input to the GNN model combines the strengths of sequence-based methods (detecting injection/suspension) and content-based methods (detecting falsification), creating a robust detection system that covers all attack types.
3Measurement precision
If IDSs for message falsification are used, then falsification attacks can be identified, but DoS and bus-off attacks cannot be detected
Solution Approach 1:
The GNN-based IDS achieves multi-functionality by designing a unified detection framework that handles both falsification attacks (through content analysis) and DoS/bus-off attacks (through sequence frequency analysis). The graph neural network simultaneously processes message contents for falsification detection and message sequences for injection/suspension detection, providing universal coverage across all attack types within a single system.
4Adaptability or versatility
If federated learning is implemented to cover various driving scenarios, then model adaptability improves, but system complexity and data privacy requirements increase
Solution Approach 1:
The patent implements federated learning to create a universal GNN model that adapts to various driving scenarios and vehicle states without requiring centralized data collection. The federated approach allows the model to learn from diverse sources while maintaining data privacy, and the graph neural network architecture ensures the model can handle different message patterns across scenarios within a unified framework.
Data Source
AI summary
A method and apparatus for intrusion detection includes generating graph data from a sequence of messages in a communication network. The graph data denotes a node for each message identifier in the sequence of messages and an edge for each pair of consecutive message identifiers. Pair counts are generated for edges in the graph data as a number of times the associated pair of consecutive message identifiers occurs in the sequence. Input feature vectors are generated for nodes in the graph data. The vectors include data content of messages associated with the node and a pair count for each edge connected to the node. The input feature vectors are processed through a first graph neural network, based on the graph data, and then through one or more layers of a classifier to classify the sequence of messages as containing an anomaly or not.