WSG-InV: Weighted State Graph Model for Intrusion Detection on In-Vehicle Network

The paper presents WSG-InV, a novel weighted state graph (WSG) model for lightweight IDS on in-vehicle network. By capitalizing on historical in-vehicle data of timestamps, message identifiers, and data field, WSG-InV constructs offline a weighted state graph G=(V, E) where distinct message identifiers constitute the set V of vertices and the edges in E define the time-varying state transitions of the CAN frames. The iconic constituents of given in-vehicle data are condensed into a collection of ordered triples (the vectorized weight) that are further assigned to the edges in E. In the mean time, several kinds of intrusion data are evoked and the random forest model is deployed to conduct intrusion classification. WSG-InV then segments the online data stream into a slice of sliding windows and extracts a weighted state subgraph S for each of them. Bv consulting G as a benchmarking as well as optimizing a particular 3-variable programming, WSG-InV assesses the subgraph S and thereby recognizes the corresponding traffic as normal or anomaly. Besides, WSG-InV can distinguish which type of attack the anomaly gears toward. Experimental results demonstrate almost optimal performance.