基于指数平滑动态图的CAN总线入侵检测方法

韦文杰; 王建萍; 陈彬; 林福宏

doi:10.11959/j.issn.1000-436x.2026078

您当前的位置：

首页 >

文章列表页 >

基于指数平滑动态图的CAN总线入侵检测方法

学术论文 | 更新时间：2026-05-07

- 基于指数平滑动态图的CAN总线入侵检测方法
- CAN bus intrusion detection method based on exponentially smoothed dynamic graph
- 通信学报 2026年47卷第4期页码：40-53
- 作者机构：
  
  1.北京科技大学计算机与通信工程学院，北京 100083
  2.新唐智创电子技术有限公司，北京 100020
- 作者简介：
  
  [ "韦文杰（1993- ），男，山西朔州人，北京科技大学博士生，主要研究方向为深度学习、网络安全和异常检测。" ]
  [ "王建萍（1974- ），女，河北保定人，博士，北京科技大学教授，主要研究方向为可见光通信、人工智能。" ]
  [ "陈彬（1995- ），男，北京人，新唐智创电子技术有限公司网络维护工程师，主要研究方向为计算机网络运维。" ]
  [ "林福宏（1981- ），男，北京人，博士，北京科技大学教授，主要研究方向为网络安全、人工智能和边缘计算。" ]
- 基金信息：
  
  国家重点研发计划基金资助项目(2022YFB3104903)
- DOI：10.11959/j.issn.1000-436x.2026078
  中图分类号： TN929.5
- 收稿：2026-02-02，
  
  修回：2026-03-17，
  
  录用：2026-03-19，
  
  纸质出版：2026-04-20
- 稿件说明：
移动端阅览
韦文杰,王建萍,陈彬等.基于指数平滑动态图的CAN总线入侵检测方法[J].通信学报,2026,47(04):40-53.

Wei Wenjie,Wang Jianping,Chen Bin,et al.CAN bus intrusion detection method based on exponentially smoothed dynamic graph[J].Journal on Communications,2026,47(04):40-53.
韦文杰,王建萍,陈彬等.基于指数平滑动态图的CAN总线入侵检测方法[J].通信学报,2026,47(04):40-53. DOI： 10.11959/j.issn.1000-436x.2026078.

Wei Wenjie,Wang Jianping,Chen Bin,et al.CAN bus intrusion detection method based on exponentially smoothed dynamic graph[J].Journal on Communications,2026,47(04):40-53. DOI： 10.11959/j.issn.1000-436x.2026078.

摘要

控制器局域网络（CAN）总线的安全性正面临现代车辆中动态非平稳通信模式的严峻挑战，传统静态检测方法难以有效捕捉此类特征。为此，提出一种基于指数平滑动态图神经网络（ES-DyGNN）的CAN总线入侵检测模型，旨在精准刻画电子控制单元（ECU）间的动态关联关系。与启发式动态模型不同，该方法通过严格定义的指数平滑图算子实现拓扑变化的自适应捕捉，推导了动态邻接序列的闭式展开式，并建立了刻画模型稳定性的Frobenius范数收敛界。同时，从理论上证明了攻击扰动的持续存在性下界，确保即使在噪声环境中仍能检测到细微的注入攻击。模型利用正弦时间嵌入技术增强节点的时间感知能力，并结合边缘条件注意力机制，使消息传递同时考虑特征相似性与平滑转移频率。在两个基准数据集上的实验结果表明，ES-DyGNN检测准确率超过99%，且单窗口推理时延为0.14 ms。理论分析与实验验证证明了该方法的高效性和实用性。

Abstract

The security of controller area network (CAN) bus is increasingly challenged by volatile and non-stationary communication patterns in modern vehicles

which traditional static detection methods have failed to capture. ES-DyGNN

an exponentially smoothed dynamic graph neural network

was proposed to capture the evolving relationships between electronic control unit (ECU). Unlike heuristic dynamic models

this method was underpinned by a rigorous exponential smoothing graph operator that adaptively captured topological shifts. Closed form expansions for the dynamic adjacency sequences were derived and Frobenius norm convergence bounds that characterized the stability of the model were established. Furthermore

a theoretical lower bound on attack persistence was proven

ensuring subtle injections were detectable despite noise. Additionally

the model employed sinusoidal time embeddings and edge-conditional attention to weigh both feature similarity and transition frequencies during message passing. Through extensive evaluations on benchmark datasets

it was demonstrated that an accuracy of over 99% was achieved by ES-DyGNN

while an inference latency of less than 0.14 ms for each window was sustained. Through both rigorous theoretical analysis and extensive experimental validation

the proposed method demonstrates the feasibility of topology adaptation for automotive security.

关键词

Keywords

references

Song H M , Woo J , Kim H K . In-vehicle network intrusion detection using deep convolutional neural network [J ] . Vehicular Communications , 2020 , 21 : 100198 .

Martínez-Cruz A , Ramírez-Gutiérrez K A , Feregrino-Uribe C , et al . Security on in-vehicle communication protocols: Issues, challenges, and future research directions [J ] . Computer Communications , 2021 , 180 : 1 - 20 .

Rajapaksha S , Kalutarage H , Al-Kadri M O , et al . AI-based intrusion detection systems for in-vehicle networks: a survey [J ] . ACM Computing Surveys , 2023 , 55 ( 11 ): 1 - 40 .

Khan M H , Javed A R , Iqbal Z , et al . DivaCAN: detecting in-vehicle intrusion attacks on a controller area network using ensemble learning [J ] . Computers & Security , 2024 , 139 : 103712 .

Song J R , Qin G H , Liang Y H , et al . DGIDS: dynamic graph-based intrusion detection system for CAN [J ] . Computers & Security , 2024 , 147 : 104076 .

Wei Y H , Cheng C , Xie G Q . OFIDS: online learning-enabled and fingerprint-based intrusion detection system in controller area networks [J ] . IEEE Transactions on Dependable and Secure Computing , 2023 , 20 ( 6 ): 4607 - 4620 .

Yu Z W , Liu Y , Xie G Q , et al . TCE-IDS: time interval conditional entropy- based intrusion detection system for automotive controller area networks [J ] . IEEE Transactions on Industrial Informatics , 2023 , 19 ( 2 ): 1185 - 1195 .

Liu W N , Qin G H , Liang Y H , et al . ETFIDS: an entropy-driven, time-frequency analysis framework for in-vehicle CAN signal intrusion detection [J ] . IEEE Internet of Things Journal , 2025 , 12 ( 12 ): 21507 - 21522 .

Kulandaivel S , Goyal T , Agrawal A K , et al . CANvas: fast and inexpensive automotive network mapping [C ] // 28th USENIX Security Symposium (USENIX Security 19) . Berkeley : USENIX Association , 2019 : 389 - 405 .

Lucas J M , Saccucci M S . Exponentially weighted moving average control schemes: properties and enhancements [J ] . Technometrics , 1990 , 32 ( 1 ): 1 - 12 .

熊炫睿 , 郭星佑 , 宁兆龙 , 等 . 基于数据增强和多解释方法融合的入侵检测方法 [J ] . 通信学报 , 2025 , 46 ( 10 ): 191 - 206 .

Xiong X R , Guo X Y , Ning Z L , et al . Intrusion detection method based on data augmentation and multi-explanation method fusion [J ] . Journal on Communications , 2025 , 46 ( 10 ): 191 - 206 .

Xun Y J , Deng Z Y , Liu J J , et al . Side channel analysis: a novel intrusion detection system based on vehicle voltage signals [J ] . IEEE Transactions on Vehicular Technology , 2023 , 72 ( 6 ): 7240 - 7250 .

Levy E , Shabtai A , Groza B , et al . CAN-LOC: spoofing detection and physical intrusion localization on an in-vehicle CAN bus based on deep features of voltage signals [J ] . IEEE Transactions on Information Forensics and Security , 2023 , 18 : 4800 - 4814 .

Deng Z Y , Liu J J , Xun Y J , et al . IdentifierIDS: a practical voltage-based intrusion detection system for real in-vehicle networks [J ] . IEEE Transactions on Information Forensics and Security , 2024 , 19 : 661 - 676 .

Aljabri W , Hamid M A , Mosli R . Enhancing real-time intrusion detection system for in-vehicle networks by employing novel feature engineering techniques and lightweight modeling [J ] . Ad Hoc Networks , 2025 , 169 : 103737 .

Han M L , Kwak B I , Kim H K . Event-triggered interval-based anomaly detection and attack identification methods for an in-vehicle network [J ] . IEEE Transactions on Information Forensics and Security , 2021 , 16 : 2941 - 2956 .

Halder S , Conti M , Das S K . COIDS: a clock offset based intrusion detection system for controller area networks [C ] // Proceedings of the 21st International Conference on Distributed Computing and Networking . New York : ACM Press , 2020 : 1 - 10 .

Zhao Y L , Xun Y J , Liu J J . ClockIDS: a real-time vehicle intrusion detection system based on clock skew [J ] . IEEE Internet of Things Journal , 2022 , 9 ( 17 ): 15593 - 15606 .

Lee S , Choi W , Jo H J , et al . ErrIDS: an enhanced cumulative timing error-based automotive intrusion detection system [J ] . IEEE Transactions on Intelligent Transportation Systems , 2023 , 24 ( 11 ): 12406 - 12421 .

刘奇旭 , 肖聚鑫 , 谭耀康 , 等 . 工业互联网流量分析技术综述 [J ] . 通信学报 , 2024 , 45 ( 8 ): 221 - 237 .

Liu Q X , Xiao J X , Tan Y K , et al . Survey of industrial Internet traffic analysis technology [J ] . Journal on Communications , 2024 , 45 ( 8 ): 221 - 237 .

Refat R U D , Elkhail A A , Hafeez A , et al . Detecting CAN bus intrusion by applying machine learning method to graph based features [C ] // Proceedings Of SAI intelligent systems conference . Cham : Springer International Publishing. Berlin: Springer , 2021 : 730 - 748 .

Korium M S , Saber M , Beattie A , et al . Intrusion detection system for cyberattacks in the Internet of Vehicles environment [J ] . Ad Hoc Networks , 2024 , 153 : 103330 .

刘涛涛 , 付钰 , 王坤 , 等 . 基于VAE-CWGAN和特征统计重要性融合的网络入侵检测方法 [J ] . 通信学报 , 2024 , 45 ( 2 ): 54 - 67 .

Liu T T , Fu Y , Wang K , et al . Network intrusion detection method based on VAE-CWGAN and fusion of statistical importance of feature [J ] . Journal on Communications , 2024 , 45 ( 2 ): 54 - 67 .

Zhang H R , Zeng K , Lin S . Federated graph neural network for fast anomaly detection in controller area networks [J ] . IEEE Transactions on Information Forensics and Security , 2023 , 18 : 1566 - 1579 .

King I J , Bowman B , Huang H H . Fine-grained graph-based anomaly detection on vehicle controller area networks [C ] // Proceedings of the 2024 IEEE International Conference on Big Data (BigData) . Piscataway : IEEE Press , 2024 : 1346 - 1351 .

Xiao J C , Yang L , Zhong F L , et al . Robust anomaly-based intrusion detection system for in-vehicle network by graph neural network framework [J ] . Applied Intelligence , 2023 , 53 ( 3 ): 3183 - 3206 .

Vaswani A , Shazeer N , Parmar N , et al . Attention is all you need [C ] // Proceedings of the 31st International Conference on Neural Information Processing Systems (NeurIPS) . New York : ACM Press , 2017 : 6000 - 6010 .

Lee H , Jeong S H , Kim H K . OTIDS: a novel intrusion detection system for in-vehicle network by using remote frame [C ] // Proceedings of the 2017 15th Annual Conference on Privacy, Security and Trust (PST) . Piscataway : IEEE Press , 2017 : 57 - 5709 .

Du Y , Li Y L , Cheng P , et al . UGL: a comprehensive hybrid model integrating GCN and LSTM for enhanced intrusion detection in UAV controller area networks [J ] . Computer Networks , 2025 , 262 : 111157 .

Stocker S N , Gasteiger J , Becker F , et al . How robust are modern graph neural network potentials in long and hot molecular dynamics simulations? [J ] . Machine Learning (Science and Technology) , 2022 , 3 ( 4 ): 8 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据