Abstract Anomaly detection in the Controller Area Network (CAN) bus is critical for ensuring the security and reliability of intelligent connected vehicles, which are increasingly prevalent. While existing anomaly detection strategies offer some benefits, they often face challenges such as limited feature extraction and data imbalance, which reduce their effectiveness. To address these issues, in this paper, we propose an unsupervised intrusion detection method based on CAN message graph named CGTS. Specifically, we first construct a message graph based on CAN message sequences. A Graph Transformer is then employed to extract complex structural information, accurately capturing the intrinsic connections between messages. Furthermore, to address the data imbalance problem, we integrate the Support Vector Data Description algorithm after the Graph Transformer model. This algorithm identifies anomalous behaviors efficiently without relying on a priori labels. Experiments conducted on public datasets, including Car-Hacking and CAN-Train-and-Test, demonstrate the efficacy of CGTS. The model achieves an average accuracy exceeding 0.990, precision above 0.995, and an F1-score nearing 0.993. These results highlight CGTS can effectively detect multiple injection attacks and significantly improve the CAN bus intrusion detection performance.

In recent years, cyberattacks against automobiles have exposed significant security threats to in-vehicle networks. The vulnerability of communication signals to malicious interference and manipulation can lead to serious system failures or abnormal behavior. The existing in-vehicle network intrusion detection methods do not fully exploit the time-frequency characteristics of controller area network (CAN) signals. This limitation reduces their effectiveness in capturing subtle changes and signal complexity. Based on the above motivation, from the perspective of signal perception, we propose an entropy-driven, time-frequency analysis framework for in-vehicle network intrusion detection. The framework integrates a signal sampler, a frequency-domain detector, and a time-domain detector. The signal sampler, as the system’s front-end module, extracts real-time physical signal data streams from CAN messages. The frequency-domain detector identifies frequency components, detecting high-frequency disturbances and cyclic variations. Meanwhile, the time-domain detector captures instantaneous changes and sudden anomalies. It analyzes signal complexity and anomalies through both stream and block detection. Experimental results demonstrate that the proposed method performs well under various attack scenarios, offering superior detection and real-time performance. It effectively senses multiple signal anomalies, providing a robust intrusion detection solution for modern in-vehicle networks.