Intrusion Detection in CAN Networks Using Graph and Transformer Models

Abstract

Modern vehicles rely heavily on in-vehicle communication networks such as the Controller Area Network (CAN) protocol to coordinate multiple Electronic Control Units (ECUs) responsible for safety-critical functions. Although CAN ensures efficient communication, it lacks built-in security mechanisms such as authentication and encryption, making it vulnerable to cyberattacks including spoofing, replay attacks, and denial-of-service. This paper proposes a hybrid intrusion detection framework that integrates graph-based modeling and Transformer-based deep learning for accurate identification of malicious CAN traffic. The proposed system extracts both structural relationships among ECUs and temporal patterns from message sequences, combines them using feature fusion, and classifies traffic using an attention-based Transformer model. The approach emphasizes accuracy, computational efficiency, and real-world deployability without modifying the CAN protocol. Experimental analysis using public CAN datasets demonstrates promising improvements in detection performance compared to traditional machine learning techniques.