STC-GraphFormer: Graph spatial-temporal correlation transformer for in-vehicle network intrusion detection system

Abstract

The integration of several developing technologies and their applications with Internet of Vehicles (IoVs) techniques has been improved. Utilizing these emerging technologies renders the in-vehicle network more susceptible to intrusions. Furthermore, the utilization of Electronic Control Units (ECUs) in current vehicles has experienced a significant increase, establishing the Controller Area Network (CAN) as the widely used standard in the automotive field. The CAN protocol provides an efficient and broadcast-based protocol for facilitating serial data exchange between ECUs. However, it lacks provisions for security measures such as authentication and encryption. The attackers have exploited these weaknesses to launch various attacks on CAN-based IVN. This paper proposes STC-GraphFormer, an innovative spatial-temporal model that utilizes a Graph Convolutional Network (GCN) and a transformer. The spatial GCN layers are utilized to construct and acquire local spatial features, while the temporal transformer layers are employed to capture the long-term global temporal dependencies. By employing this integrated approach, STC-GraphFormer can learn complex spatial-temporal correlations within the IVN data, enabling it to detect and classify malicious intrusions. The proposed STC-GraphFormer has been validated using five real in-vehicle CAN datasets that cover a wide range of attacks that have not been previously investigated together. The finding results indicate that the STC-GraphFormer is more efficient than the SOTA approaches. It demonstrates excellent performance, with Car-hacking (0.99983), IVN intrusion detection (0.9991), CAN Dataset for intrusion detection “OTIDS” (0.9992), CAR hacking: attack & defense challenge (0.9901), and Survival analysis (0.9982), with a minimal false alarm rate and the highest achievable F1 scores for various types of attacks.