DST-IDS: Dynamic spatial-temporal graph-transformer network for in-vehicle network intrusion detection system

The development of the Internet of Vehicles (IoV) has greatly increased connectivity, making the In-Vehicle Network (IVN) more susceptible to intrusions. Furthermore, the utilization of Electronic Control Units (ECUs) in current vehicles has experienced a significant increase, establishing the Controller Area Network (CAN) as the widely used standard in the automotive field. However, it lacks provisions for authentication. The attackers have exploited these weaknesses to launch various attacks on CAN-based IVN. Sequential data approaches such as Recurrent Neural Networks (RNNs) and Long Short-Term Memory (LSTM) have emerged as prominent approaches in this domain, contributing significantly to the evolution of the Intrusion Detection System (IDS). However, these methods are limited in feature extraction as they depend solely on previously interacted hidden states, potentially overlooking critical features. Additionally, capturing the complex spatial-temporal dynamics of CAN messages remains a significant challenge.

In response to these challenges, we propose the Dynamic Spatial-Temporal Graph-Transformer Network for In-vehicle Network Intrusion Detection System, denoted as the “DST-IDS”. It comprises three modules: a graph spatial-temporal embedding module that converts the row CAN messages correlation into latent graph representations, a spatial-temporal learning module, and a classification module. The second module utilizes a graph-transformer network to capture and learn the dynamic spatial-temporal dependencies between CAN messages. The last module classifies the learnt features into either normal or attack messages. The model was evaluated on two publicly available datasets (CAR-Hacking and IVN-IDS), achieving exceptionally high accuracy scores of 0.999999 and 0.9996, respectively. These results demonstrate that the proposed model significantly outperforms state-of-the-art methods in detection accuracy and false alarm rate for in-vehicle network intrusion detection.