用知识蒸馏压缩图注意力模型，提升车载网络入侵检测精度与效率
KD-GAT: Combining Knowledge Distillation and Graph Attention Transformer for a Controller Area Network Intrusion Detection System
- 将CAN报文建模为时序图，用多层图注意力网络捕捉关系特征
- 学生模型仅占教师6.32%大小，仍达99.97%准确率
- 适合资源受限的车载系统，兼顾性能与计算开销
控制器局域网（CAN）协议广泛用于车载通信，但缺乏内置安全机制，易受网络攻击。本文提出KD-GAT框架，结合图注意力网络（GAT）与知识蒸馏（KD），在提升检测精度的同时降低计算复杂度。通过滑动窗口将CAN流量表示为图结构，以捕捉时序与关联模式。采用多层带跳跃知识聚合的GAT作为教师模型，训练一个仅为其6.32%大小的紧凑学生GAT，过程包含监督预训练及软硬标签联合知识蒸馏。在Car-Hacking、Car-Survival和can-train-and-test三个基准数据集上测试，学生模型在Car-Hacking和Car-Survival上分别达到99.97%和99.31%准确率。然而，can-train-and-test数据集存在显著类别不平衡，导致两模型性能下降，该问题将是未来研究重点。
原文摘要 · Abstract (English)
The Controller Area Network (CAN) protocol is widely adopted for in-vehicle communication but lacks inherent security mechanisms, making it vulnerable to cyberattacks. This paper introduces KD-GAT, an intrusion detection framework that combines Graph Attention Networks (GATs) with knowledge distillation (KD) to enhance detection accuracy while reducing computational complexity. In our approach, CAN traffic is represented as graphs using a sliding window to capture temporal and relational patterns. A multi-layer GAT with jumping knowledge aggregation acting as the teacher model, while a compact student GAT--only 6.32% the size of the teacher--is trained via a two-phase process involving supervised pretraining and knowledge distillation with both soft and hard label supervision. Experiments on three benchmark datasets--Car-Hacking, Car-Survival, and can-train-and-test demonstrate that both teacher and student models achieve strong results, with the student model attaining 99.97% and 99.31% accuracy on Car-Hacking and Car-Survival, respectively. However, significant class imbalance in can-train-and-test has led to reduced performance for both models on this dataset. Addressing this imbalance remains an important direction for future work.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。