用图模型检测汽车网络攻击，准确率提升超16%。
Multi-Stage Knowledge-Distilled VGAE and GAT for Robust Controller-Area-Network Intrusion Detection
- 先用变分图自编码器发现异常，再用知识蒸馏图注意力网络分类。
- 在六个数据集上平均F1提升16.2%，不平衡数据下最高提升55%。
- 模型体积缩小96%，适合部署在资源受限的车载系统中。
控制器局域网（CAN）协议是车载通信标准，但因缺乏内置安全机制易受网络攻击。本文提出一种多阶段入侵检测框架，结合无监督异常检测与有监督图学习，针对汽车CAN流量设计。通过将CAN总线活动编码为图序列，建模时序与关联关系。流程首先采用基于VGAE的选样降采样解决类别不平衡问题，随后使用带有可选分数级融合的图注意力网络（GAT）进行攻击分类。紧凑型学生GAT模型相比教师模型参数减少96%，仍保持优异预测性能。在六个公开的CAN入侵数据集（Car-Hacking、Car-Survival、can-train-and-test等）上的实验表明，该方法在准确率与效率方面表现优异，平均F1-score较现有方法提升16.2%，尤其在高度不平衡数据集上，最高实现55%的F1提升。
原文摘要 · Abstract (English)
The Controller Area Network (CAN) protocol is a standard for in-vehicle communication but remains susceptible to cyber-attacks due to its lack of built-in security. This paper presents a multi-stage intrusion detection framework leveraging unsupervised anomaly detection and supervised graph learning tailored for automotive CAN traffic. Our architecture combines a Variational Graph Autoencoder (VGAE) for structural anomaly detection with a Knowledge-Distilled Graph Attention Network (KD-GAT) for robust attack classification. CAN bus activity is encoded as graph sequences to model temporal and relational dependencies. The pipeline applies VGAE-based selective undersampling to address class imbalance, followed by GAT classification with optional score-level fusion. The compact student GAT achieves 96% parameter reduction compared to the teacher model while maintaining strong predictive performance. Experiments on six public CAN intrusion datasets--Car-Hacking, Car-Survival, and can-train-and-test--demonstrate competitive accuracy and efficiency, with average improvements of 16.2% in F1-score over existing methods, particularly excelling on highly imbalanced datasets with up to 55% F1-score improvements.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。