GSTR-IDSFormer: Graph Spatial-Temporal Representation Embeddings for In-vehicle Network Intrusion Detection System based on Transformer Network

The utilization of Electronic Control Units (ECUs) in current vehicles has experienced a significant increase, establishing the Controller Area Network (CAN) as the widely used standard in the automotive field. It provides an efficient broadcast-based protocol for facilitating serial data exchange between ECUs. However, it lacks provisions for authentication. The attackers have exploited these weaknesses to launch various attacks on CAN-based IVN. Time series methods such as Recurrent Neural Networks (RNNs) and Long Short-Term Memory (LSTM) have emerged as prominent approaches in the evolution of IDS. However, these methods have limitations in feature extraction. In response to these challenges, we propose a novel self-attention mechanism based on the Transformer model, denoted as the “GSTR-IDSFormer” Graph Spatial-Temporal Representation Embeddings for In-vehicle Network Intrusion Detection System based on Transformer Network. It comprises three modules: a graph spatial-temporal embedding module, a spatial-temporal learning module, and a classification module. The first module aims to convert the row CAN messages into latent graph representations that simultaneously preserve spatial and temporal dependencies. The second module utilizes a transformer network to capture and learn the spatial-temporal dependencies between CAN messages. The last module classifies the learned features into either normal or attack messages. The model tested on the CAR-hacking dataset, and the results demonstrate that our proposed model enhanced the accuracy of detecting performance and the rate of false alarms for identifying intrusions in-vehicle networks than SOTA studies.