STATGRAPH: Effective in-Vehicle Intrusion Detection via Multi-View Statistical Graph Learning

In-vehicle networks (IVNs) face growing threats from advanced cyber-attacks, particularly stealthy masquerade attacks that mimic legitimate message patterns. This paper proposes STATGRAPH, a fine-grained intrusion detection frame work based on multi-view statistical graph learning over the Controller Area Network (CAN) messages within IVNs. STAT GRAPH constructs two graphs per detection window: a Timing Correlation Graph (TCG) capturing temporal ID dependencies, and a Coupling Relationship Graph (CRG) modeling short term contextual relations. TCG and CRG are further used to generate graph structure encoding payload variations and embedded signal co-occurrence. A lightweight multi-layered Graph Convolutional Network (GCN) is then applied to classify each message, leveraging the expressive representations from TCG and CRG. To ensure effectiveness against diverse attacks, we evaluate STATGRAPH on two real-world CAN datasets featuring five underexplored masquerade attacks. Experimental results show that STATGRAPH significantly improves detection granularity and outperforms state-of-the-art methods, with F1-score gains of 7% and 22%, while maintaining the highest accuracy. Code is available at https://github.com/wangkai-tech23/StatGraph