Outlier-Ratio Feature Augmentation for Graph-based Intrusion Detection in CAN Networks

In-Vehicle networks such as the Controller Area Network (CAN) are highly vulnerable to cyberattacks due to the absence of encryption and authentication mechanisms. Intrusion detection systems (IDSs) have therefore become a critical line of defense. Among them, graph-based IDSs that model message sequences as graphs have attracted attention for their effectiveness against attacks that disrupt communication structures. However, replication experiments show that a representative method, GDTIDS, performs poorly against masquerade attacks, which preserve structural properties while manipulating payload contentsTo address this limitation, we propose a new feature, the outlier ratio, which incorporates payload-level information into the IDS. We define three variants of the feature based on value range, Hamming distance, and Mahalanobis distance. Evaluations on three publicly available CAN datasets demonstrate that the proposed method, particularly the Mahalanobis-Distance based variant, significantly improves detection of masquerade attacks while maintaining high performance against other attack types.