kd-gat-can-intrusion-detection

KD-GAT: Knowledge Distillation and Graph Attention Networks for CAN Intrusion Detection

A lightweight, deployable intrusion detection system (IDS) for the Controller Area Network (CAN) bus — the protocol nearly every in-vehicle ECU communicates over, with no built-in security. KD-GAT represents CAN traffic as graphs over a sliding window and trains a large Graph Attention Network (GAT) teacher, then distills it into a compact student model small enough for resource-constrained, real-time in-vehicle deployment.

Fig. 1: KD-GAT framework — a multi-head GAT teacher (h=8 attention heads) and compact GAT student (h=4) both use jumping-knowledge (JK) aggregation across layers and a fully-connected (FC) head to classify each graph as benign or attack; the student is trained via knowledge distillation from the teacher's logits, combined with the ground-truth (hard) loss.

Role & Attribution

Sidra Ghayour Bhatti — supervisory/co-advising role on methodology and evaluation. Lead author and primary implementation: Robert Frenken. Co-author: Hanqin Zhang. PI: Qadeer Ahmed. OSU Center for Automotive Research (Mobility Systems Lab).

Method

CAN-to-graph representation. Each sliding window of CAN messages becomes one graph: nodes are the unique CAN IDs observed in the window (node features = mean payload values + message-occurrence count, a 10-dimensional vector per node); edges connect CAN ID pairs that appear sequentially within the window, weighted by how often that pair co-occurs. A window is labeled attack (1) if any message in it is malicious, benign (0) otherwise.

Teacher/student architecture (GATWithJK). Both models stack GAT ("multi-head GAT") layers with jumping-knowledge (JK) aggregation across all layer outputs (LSTM-based), global mean pooling, and a fully-connected classification head.

Knowledge distillation. Training is two-stage: (1) warm up the student with binary cross-entropy only; (2) fine-tune with a mixed loss combining the student's own task loss with a temperature-scaled (τ=2.0) KL-divergence distillation loss against the teacher's softened logits: L_total = α · L_hard + (1 − α) · L_KD (α=0.5). Focal loss (FL(p_t) = -(1-p_t)^γ log(p_t), γ=1.0) is used in place of plain BCE to address the extreme class imbalance present in one of the three benchmark datasets.

Datasets

Evaluated on three public automotive CAN IDS benchmarks: Car-Hacking (Hyundai YF Sonata, 4 attack types: DoS, fuzzing, RPM spoofing, gear spoofing), Car-Survival (3 vehicles, 3 attack types), and can-train-and-test (4 vehicle sets across 2 manufacturers — this paper is, to the authors' knowledge, the first deep learning study to evaluate the entire can-train-and-test dataset).

Results

Student model (6.32% the size of the teacher) matches or nearly matches teacher performance on most benchmarks:

Performance drops on can-train-and-test, where class imbalance ranges from 36:1 to 927:1 across subsets — both teacher and student see reduced precision/recall/F1 on the held-out test sets there, which the paper identifies explicitly as an open problem: "addressing this imbalance remains an important direction for future work." Reporting this limitation rather than only the favorable results is itself part of the paper's honest empirical contribution.

Paper: Frenken, R., Bhatti, S.G., Zhang, H., & Ahmed, Q. (2025). "KD-GAT: Combining Knowledge Distillation and Graph Attention Transformer for a Controller Area Network Intrusion Detection System." arXiv:2507.19686 [abs] [pdf] Code: github.com/OSU-CAR-MSL/KD-GAT (MIT license)

Citation

@article{frenken2025kdgat,
  author  = {Frenken, Robert and Bhatti, Sidra Ghayour and Zhang, Hanqin and Ahmed, Qadeer},
  title   = {KD-GAT: Combining Knowledge Distillation and Graph Attention Transformer for a Controller Area Network Intrusion Detection System},
  journal = {arXiv preprint arXiv:2507.19686},
  year    = {2025}
}