KG-ID: Knowledge Graph-Based Intrusion Detection on In-Vehicle Network

The Controller Area Network (CAN) is a widely adopted communication protocol in the automotive industry, facilitating connectivity among various electronic control units inside vehicles. However, with the growing intelligence and connectivity of modern vehicles, the in-vehicle network (IVN) faces significant security challenges due to the lack of inherent security mechanisms in the CAN protocol. Therefore, it is necessary to develop a monitoring and protection scheme for IVN. In this article, we propose a novel knowledge graph-based intrusion detection methodology, referred to as KG-ID. The proposed KG-ID methodology leverages a knowledge graph to analyze CAN frame and signal features for detecting several types of attacks. To the best of our knowledge, this is the first application of knowledge graph technology for intrusion detection in the IVN. Subsequently, the selection of CAN signal feature, construction of in-vehicle ontology model, knowledge extraction, and robustness against various attacks are explained in detail. In addition, a series of experiments demonstrate that the proposed methodology can accurately detect fabrication, masquerade, and fuzzy attacks. In particular, the time overhead of intrusion detection in a real vehicle supported by XPeng is only 0.031 ms for KG-ID. The code for the methodology proposed in this article is available at: <uri xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">https://github.com/jingzhuwang/KG-ID</uri>.