Multi-Stage Knowledge-Distilled VGAE and GAT for Robust Controller-Area-Network Intrusion Detection

TL;DR

This paper introduces a multi-stage graph-based intrusion detection framework for vehicle CAN networks, combining unsupervised anomaly detection with knowledge-distilled supervised learning to improve accuracy and efficiency.

Contribution

It proposes a novel multi-stage architecture integrating VGAE and KD-GAT for robust CAN intrusion detection, with significant parameter reduction and improved performance on imbalanced datasets.

Findings

Achieved 96% parameter reduction with GAT model.

Improved F1-score by 16.2% over existing methods.

Performed well on highly imbalanced datasets with up to 55% F1-score improvement.

Abstract

The Controller Area Network (CAN) protocol is a standard for in-vehicle communication but remains susceptible to cyber-attacks due to its lack of built-in security. This paper presents a multi-stage intrusion detection framework leveraging unsupervised anomaly detection and supervised graph learning tailored for automotive CAN traffic. Our architecture combines a Variational Graph Autoencoder (VGAE) for structural anomaly detection with a Knowledge-Distilled Graph Attention Network (KD-GAT) for robust attack classification. CAN bus activity is encoded as graph sequences to model temporal and relational dependencies. The pipeline applies VGAE-based selective undersampling to address class imbalance, followed by GAT classification with optional score-level fusion. The compact student GAT achieves 96% parameter reduction compared to the teacher model while maintaining strong predictive performance. Experiments on six public CAN intrusion datasets--Car-Hacking, Car-Survival, and can-train-and-test--demonstrate competitive accuracy and efficiency, with average improvements of 16.2% in F1-score over existing methods, particularly excelling on highly imbalanced datasets with up to 55% F1-score improvements.