用图神经网络和循环模型检测车载网络异常，无需复杂特征工程。
GUARD-CAN: Graph-Understanding and Recurrent Architecture for CAN Anomaly Detection
- 将CAN消息按时间窗建模为保持顺序的图结构
- 在窗口和序列两级检测异常，对四类攻击识别率高
- 实证表明窗口大小影响检测效果，可优化选择
现代车载网络因控制器局域网（CAN）缺乏加密和认证而面临多种网络威胁。本文提出GUARD-CAN异常检测框架，结合图表示学习与时间序列建模。该框架将CAN消息划分为固定长度的时间窗，并将每窗转换为保留消息顺序的图结构。利用过完备自编码器（AE）与图卷积网络（GCN）生成图嵌入向量，再将这些向量序列化并输入门控循环单元（GRU），以捕捉跨图的时间异常模式。模型在序列级与窗口级均实现异常检测，支持多角度评估。通过香农熵分析验证了窗口大小选择的重要性。实验表明，该模型无需复杂特征工程，即可有效检测四类典型攻击：泛洪、模糊、重放与伪造攻击。
原文摘要 · Abstract (English)
Modern in-vehicle networks face various cyber threats due to the lack of encryption and authentication in the Controller Area Network (CAN). To address this security issue, this paper presents GUARD-CAN, an anomaly detection framework that combines graph-based representation learning with time-series modeling. GUARD-CAN splits CAN messages into fixed-length windows and converts each window into a graph that preserves message order. To detect anomalies in the timeaware and structure-aware context at the same window, GUARD-CAN takes advantage of the overcomplete Autoencoder (AE) and Graph Convolutional Network (GCN) to generate graph embedding vectors. The model groups these vectors into sequences and feeds them into the Gated Recurrent Unit (GRU) to detect temporal anomaly patterns across the graphs. GUARD-CAN performs anomaly detection at both the sequence level and the window level, and this allows multi-perspective performance evaluation. The model also verifies the importance of window size selection through an analysis based on Shannon entropy. As a result, GUARD-CAN shows that the proposed model detects four types of CAN attacks (flooding, fuzzing, replay and spoofing attacks) effectively without relying on complex feature engineering.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。