RepCAN: A Lightweight Intrusion Detection Method for In-Vehicle Networks Integrating Temporal Graph Re-parameterization

WANG Kai; LIU Hengyang; WANG Bailing

doi:10.11999/JEIT260403

Article Contents

Article Navigation > Journal of Electronics & Information Technology > 2026 >

WANG Kai, LIU Hengyang, WANG Bailing. RepCAN: A Lightweight Intrusion Detection Method for In-Vehicle Networks Integrating Temporal Graph Re-parameterization[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260403

Citation:

WANG Kai, LIU Hengyang, WANG Bailing. RepCAN: A Lightweight Intrusion Detection Method for In-Vehicle Networks Integrating Temporal Graph Re-parameterization[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260403

Citation:

PDF( 1561 KB)

RepCAN: A Lightweight Intrusion Detection Method for In-Vehicle Networks Integrating Temporal Graph Re-parameterization

doi: 10.11999/JEIT260403 cstr: 32379.14.JEIT260403

WANG Kai^{1
,
,},
LIU Hengyang^1
,,
WANG Bailing^2
,

1.
School of Computer Science and Technology, Harbin Institute of Technology, Weihai 264209, China
2.
Harbin Institute of Technology Qingdao Research Institute, Qingdao 266109, China

Funds: The National Natural Science Foundation of China(62272129), Taishan Scholar Foundation of Shandong Province, China (tsqn202408112)

Received Date: 2026-04-07
Accepted Date: 2026-09-17
Rev Recd Date: 2026-09-17

Available Online: 2026-09-24

Abstract

Abstract

Objective With the rapid popularization of Intelligent Connected Vehicles (ICVs), the interaction between the inherently closed In-Vehicle Network (IVN) and external environments occurs increasingly frequently. Consequently, vehicles are exposed to open network environments, facing severe threats from external cyberattacks such as message injection and semantic manipulation. Once a vehicle is remotely compromised, devastating consequences, including core control system hijacking, sensitive data leakage, and fatal accidents, can occur. As a critical security measure, Intrusion Detection Systems (IDS) are widely recognized by both academia and industry due to their protocol-independent and non-intrusive deployment characteristics. Furthermore, the R155 regulation issued by the UN/WP.29 explicitly requires that vehicles on the market must possess IVN intrusion detection capabilities. While deep learning-based models possess powerful feature extraction capabilities and have become the mainstream direction for IVN intrusion detection, traditional deep Graph Neural Networks (GNNs) and large-parameter Transformers face severe computational and memory constraints when deployed on vehicle edge devices. To address these challenges, RepCAN, a novel lightweight intrusion detection technology for IVNs integrating temporal graph re-parameterization, is proposed in this paper. The primary objective is to balance high-generalization detection capabilities and low resource consumption through a unique "ghost node" mechanism and lossless architecture transformations, specifically targeting the Controller Area Network (CAN) protocol under a vehicle-cloud collaborative architecture. Methods The proposed RepCAN framework is constructed as an efficient lightweight intrusion detection model suitable for real-world automotive environments, comprising three core modules. First, a graph structure construction and data augmentation module is developed. To transform the unstructured raw CAN message stream into semantic tensors processable by GNNs, a hierarchical sliding window strategy is employed. Within each window, dual features encompassing statistical patterns and deep payload semantics are extracted. Statistical features include message entropy, average periodicity, and periodicity jitter to capture fuzzing noise and temporal conflicts. For payload semantics, first-order differences of the payload are calculated to capture non-continuous jumps, and discrete wavelet transforms are utilized to extract the energy spectrum of detail coefficients. This approach successfully identifies disguised attacks without relying on explicit semantic decoding. In terms of graph topology, a lightweight dual-stream graph and a "ghost node" mechanism are designed. A learnable global static adjacency matrix is constructed to learn physical topology control priors, while a dynamic adjacency matrix is generated based on communication frequencies. The ghost node mechanism redirects sudden out-of-distribution messages to a virtual node, transforming traffic bursts into structural feature evolutions. Second, a re-parameterized spatiotemporal feature extraction module is designed. In the training phase, a multi-branch Re-parameterized Graph Convolutional Network (RepGCN) and a Re-parameterized Temporal Convolutional Network (RepTCN) are utilized to capture complex spatiotemporal dependencies. RepGCN handles the spatial stream using a multi-head aggregation structure, allowing the model to capture dependencies among Electronic Control Units (ECUs) from different subspaces. RepTCN employs multi-branch temporal convolutions with varying kernel sizes to capture multi-scale long- and short-term temporal patterns. During the inference phase, structural re-parameterization techniques mathematically collapse these multi-branch architectures into highly efficient single-path structures. Third, an unsupervised anomaly detection module is implemented. Deep Support Vector Data Description (Deep SVDD) is adopted to map the extracted deep spatiotemporal features into a minimum enclosing hypersphere. Anomalies are systematically detected in a completely unsupervised manner by calculating the Euclidean distance between the test sample and the hypersphere center. Results and Discussions Extensive experiments are conducted on the widely recognized Car-Hacking dataset, which includes normal traffic and four attack types: DoS, Fuzzy, Gear, and RPM (Table 1). Comparative evaluations against mainstream supervised and unsupervised baseline methods demonstrate the superiority of the proposed RepCAN model. Under an unsupervised setting, RepCAN achieves an Accuracy of 0.9840, an F1-score of 0.9798, and an Area Under the Curve (AUC) of 0.9942, outperforming all unsupervised baselines and rivaling classic supervised models (Table 2). Notably, RepCAN maintains a False Positive Rate (FPR) of 0.0117 while achieving a Recall of 0.9774, indicating a strong ability to balance missed detection and false alarm risks in highly imbalanced vehicular network scenarios. Comprehensive ablation studies are performed to validate the contribution of specific components. The integration of statistical and payload semantic features significantly enhances defense robustness, increasing the F1-score to 0.9798 compared to relying on a single feature domain (Table 3). Furthermore, topological ablation experiments confirm that removing the ghost node mechanism drops the F1-score to 0.8902, highlighting its necessity for the adaptive perception of unknown threats. The removal of the dual-stream structure or the multi-branch re-parameterization module similarly degrades overall performance (Table 4). To verify practical deployment feasibility, the framework is evaluated in a vehicle-cloud collaborative environment utilizing an NVIDIA Jetson Orin Nano edge computing device (Fig. 2). Through structural re-parameterization, the model's parameters are reduced by 64.15% and Floating-Point Operations (FLOPs) are decreased by 59.32% during inference (Table 5). Experimental results indicate that RepCAN achieves an overall inference latency of 0.004827 ms/message on the vehicle-end device (Fig. 3). This latency is significantly lower than the shortest physical transmission time limit of a CAN message (approximately 0.1 to 0.15 ms), effectively avoiding competition for computing power with core driving tasks. Additionally, the operational memory overhead of RepCAN is restricted to approximately 360 MB, substantially lower than many baseline models, proving its exceptional lightweight characteristics and adaptability to strictly constrained storage resources (Fig. 4). Further verification on the full Car-Hacking test set (Table 6) validates the lossless re-parameterization mechanism, with deep feature errors at the 10^-4 level and ΔAUC below 0.0007 across all attack scenarios. Additional evaluation on ROAD dataset masquerade attacks (Table 7) reveals notable performance degradation, as pure semantic attacks without timing disturbances remain a limitation of this lightweight framework. Conclusions A lightweight intrusion detection technology for CAN buses, RepCAN, integrating temporal graph re-parameterization, is proposed in this study. The innovatively designed ghost node mechanism maps out-of-distribution anomalous traffic to a virtual node, enhancing structural representation and model generalization without expanding the graph scale. Moreover, structural re-parameterization resolves the conflict between high-capacity multi-scale training requirements and low-latency inference constraints. Evaluations on the benchmark dataset and hardware platform confirm that RepCAN achieves a compelling balance between state-of-the-art detection performance and minimal resource consumption. Future investigations will target stealthy camouflage attacks, such as the Masquerade Attack, by incorporating fine-grained semantic analysis mechanisms to eliminate feature perception blind spots.
- In-vehicle Network,
- Intrusion Detection,
- Structural Re-parameterization,
- Lightweight Neural Network

FullText(HTML)

References(47)

References

[1]	韩乔妮, 马建国, 李鹏, 等. 混合网络攻击下车辆队列的无模型自适应弹性控制[J]. 电子与信息学报, 2026, 48(5): 2066–2076. doi: 10.11999/JEIT251135. HAN Qiaoni, MA Jianguo, LI Peng, et al. Model-free adaptive resilient control of vehicle platoons against hybrid cyberattacks[J]. Journal of Electronics & Information Technology, 2026, 48(5): 2066–2076. doi: 10.11999/JEIT251135.
[2]	WANG Kai, ZHANG Aiheng, SUN Haoran, et al. Analysis of recent deep-learning-based intrusion detection methods for in-vehicle network[J]. IEEE Transactions on Intelligent Transportation Systems, 2023, 24(2): 1843–1854. doi: 10.1109/TITS.2022.3222486.
[3]	YING Xuhang, SAGONG S U, CLARK A, et al. Shape of the cloak: Formal analysis of clock skew-based intrusion detection system in controller area networks[J]. IEEE Transactions on Information Forensics and Security, 2019, 14(9): 2300–2314. doi: 10.1109/TIFS.2019.2895957.
[4]	MÜTER M and ASAJ N. Entropy-based anomaly detection for in-vehicle networks[C]. 2011 IEEE Intelligent Vehicles Symposium (IV), Baden-Baden, Germany, 2011: 1110–1115. doi: 10.1109/IVS.2011.5940552.
[5]	CHO K T and SHIN K G. Fingerprinting electronic control units for vehicle intrusion detection[C]. Proceedings of the 25th USENIX Conference on Security Symposium, Austin, USA, 2016: 911–927.
[6]	GROZA B and MURVAY P S. Efficient intrusion detection with bloom filtering in controller area networks[J]. IEEE Transactions on Information Forensics and Security, 2019, 14(4): 1037–1051. doi: 10.1109/TIFS.2018.2869351.
[7]	张瑞丰, 杨荣妮. 拒绝服务攻击下信息物理系统的数据驱动安全控制: 一种在线模态依赖的切换-Q-学习策略[J]. 电子与信息学报, 2026, 48(4): 1424–1433. doi: 10.11999/JEIT250746. ZHANG Ruifeng and YANG Rongni. Data-driven secure control for cyber-physical systems under denial-of-service attacks: An online mode-dependent switching-Q-learning algorithm[J]. Journal of Electronics & Information Technology, 2026, 48(4): 1424–1433. doi: 10.11999/JEIT250746.
[8]	XIE Guoqi, YANG L T, YANG Yuanda, et al. Threat analysis for automotive CAN networks: A GAN model-based intrusion detection technique[J]. IEEE Transactions on Intelligent Transportation Systems, 2021, 22(7): 4467–4477. doi: 10.1109/TITS.2021.3055351.
[9]	MCHERGUI A, MOULAHI T, and ZEADALLY S. Survey on artificial intelligence (AI) techniques for vehicular ad-hoc networks (VANETs)[J]. Vehicular Communications, 2022, 34: 100403. doi: 10.1016/j.vehcom.2021.100403.
[10]	RAJAPAKSHA S, KALUTARAGE H, AL-KADRI M O, et al. AI-based intrusion detection systems for in-vehicle networks: A survey[J]. ACM Computing Surveys, 2023, 55(11): 237. doi: 10.1145/3570954.
[11]	LAMPE B and MENG Weizhi. A survey of deep learning-based intrusion detection in automotive applications[J]. Expert Systems with Applications, 2023, 221: 119771. doi: 10.1016/j.eswa.2023.119771.
[12]	AL-AQL N and AL-SHAMMARI A. Hybrid RNN-LSTM networks for enhanced intrusion detection in vehicle CAN systems[J]. Journal of Electrical Systems, 2024, 20(6s): 3019–3031. doi: 10.52783/jes.3318.
[13]	XU He, WU Di, LU Yufeng, et al. Models on the move: Towards feasible embedded AI for intrusion detection on vehicular CAN bus[C]. Proceedings of the 2024 USENIX Conference on Usenix Annual Technical Conference, Santa Clara, USA, 2024: 64.
[14]	HOSSAIN M D, INOUE H, OCHIAI H, et al. An effective in-vehicle CAN bus intrusion detection system using CNN deep learning approach[C]. GLOBECOM 2020-2020 IEEE Global Communications Conference, Taipei, China, 2020: 1–6. doi: 10.1109/GLOBECOM42002.2020.9322395.
[15]	JAVED A R, UR REHMAN S, KHAN M U, et al. CANintelliIDS: Detecting in-vehicle intrusion attacks on a controller area network using CNN and attention-based GRU[J]. IEEE Transactions on Network Science and Engineering, 2021, 8(2): 1456–1466. doi: 10.1109/TNSE.2021.3059881.
[16]	ZHANG Hengrun, ZENG Kai, and LIN Shuai. Federated graph neural network for fast anomaly detection in controller area networks[J]. IEEE Transactions on Information Forensics and Security, 2023, 18: 1566–1579. doi: 10.1109/TIFS.2023.3240291.
[17]	HE Yaru, GAO Jiaqi, FAN Mingrui, et al. A&D graph-based graph neural network intrusion detection for in-vehicle controller area network[C]. 2024 IEEE/CIC International Conference on Communications in China (ICCC), Hangzhou, China, 2024: 1281–1286. doi: 10.1109/ICCC62479.2024.10681772.
[18]	ALKHATIB N, MUSHTAQ M, GHAUCH H, et al. CAN-BERT do it? Controller area network intrusion detection system based on BERT language model[C]. 2022 IEEE/ACS 19th International Conference on Computer Systems and Applications (AICCSA), Abu Dhabi, United Arab Emirates, 2022: 1–8. doi: 10.1109/AICCSA56895.2022.10017800.
[19]	WU Zhongqiang and LI Mengting. ResNet-Swin Transformer based intrusion detection system for in-vehicle network[J]. Expert Systems with Applications, 2025, 279: 127547. doi: 10.1016/j.eswa.2025.127547.
[20]	谈名名, 张恒, 王鑫, 等. 一种融合时序与深度特征的二阶段CAN总线攻击识别方法[J]. 电子与信息学报, 2026, 48(4): 1444–1453. doi: 10.11999/JEIT250651. TAN Mingming, ZHANG Heng, WANG Xin, et al. A two-stage framework for CAN bus attack detection by fusing temporal and deep features[J]. Journal of Electronics & Information Technology, 2026, 48(4): 1444–1453. doi: 10.11999/JEIT250651.
[21]	WANG Yingqing, QIN Guihe, ZOU Mi, et al. A lightweight intrusion detection system for internet of vehicles based on transfer learning and MobileNetV2 with hyper-parameter optimization[J]. Multimedia Tools and Applications, 2024, 83(8): 22347–22369. doi: 10.1007/s11042-023-15771-6.
[22]	WANG Shaoqiang, WANG Yizhe, ZHENG Baosen, et al. Intrusion detection system for vehicular networks based on MobileNetV3[J]. IEEE Access, 2024, 12: 106285–106302. doi: 10.1109/ACCESS.2024.3437416.
[23]	JEONG S, LEE S, LEE H, et al. X-CANIDS: Signal-aware explainable intrusion detection system for controller area network-based in-vehicle network[J]. IEEE Transactions on Vehicular Technology, 2024, 73(3): 3230–3246. doi: 10.1109/TVT.2023.3327275.
[24]	WANG Kai, JIANG Qiguang, WANG Bailing, et al. StatGraph: Effective in-vehicle intrusion detection via multi-view statistical graph learning[J]. IEEE Transactions on Mobile Computing, 2026, 25(5): 6335–6351. doi: 10.1109/TMC.2025.3636517.
[25]	ZHANG Aiheng, SUN Zhen, JIANG Qiguang, et al. LiPar: A lightweight parallel learning model for practical in-vehicle network intrusion detection[J]. IEEE Transactions on Intelligent Transportation Systems, 2025, 26(12): 23358–23373. doi: 10.1109/TITS.2025.3605465.
[26]	JIANG Qiguang, WANG Kai, WEI Yuliang, et al. XIPHOS: Adaptive in-vehicle intrusion detection via unsupervised graph contrastive learning[J]. IEEE Transactions on Information Forensics and Security, 2025, 20: 10419–10433. doi: 10.1109/TIFS.2025.3616624.
[27]	LI Sifan, CAO Yue, ZHANG Yu’ang, et al. A cloud collaborative-based intrusion detection and prevention system for IVN[J]. IEEE Transactions on Cognitive Communications and Networking, 2025, 11(4): 2768–2785. doi: 10.1109/TCCN.2024.3516052.
[28]	ALTHUNAYYAN M, JAVED A, and RANA O. A robust multi-stage intrusion detection system for in-vehicle network security using hierarchical federated learning[J]. Vehicular Communications, 2024, 49: 100837. doi: 10.1016/j.vehcom.2024.100837.
[29]	CAO Jinhui, DI Xiaoqiang, LIU Xu, et al. Anomaly detection for in-vehicle network using self-supervised learning with vehicle-cloud collaboration update[J]. IEEE Transactions on Intelligent Transportation Systems, 2024, 25(7): 7454–7466. doi: 10.1109/TITS.2024.3351438.
[30]	DING Xiaohan, ZHANG Xiangyu, MA Ningning, et al. RepVGG: Making VGG-style ConvNets great again[C]. Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Nashville, USA, 2021: 13728–13737. doi: 10.1109/CVPR46437.2021.01352.
[31]	WANG Junyi, LI Zi’ao, LIU Bangli, et al. High-performance inference graph convolutional networks for skeleton-based action recognition[J]. Neurocomputing, 2025, 653: 131078. doi: 10.1016/j.neucom.2025.131078.
[32]	RUFF L, VANDERMEULEN R A, GÖRNITZ N, et al. Deep one-class classification[C]. Proceedings of the 35th International Conference on Machine Learning, Stockholm, Sweden, 2018: 4393–4402.
[33]	DENG Zhouyan, XUN Yijie, LIU Jiajia, et al. A novel intrusion detection system for next generation in-vehicle networks[C]. GLOBECOM 2022-2022 IEEE Global Communications Conference, Rio de Janeiro, Brazil, 2022: 2098–2103. doi: 10.1109/GLOBECOM48099.2022.10000766.
[34]	SONG H M, WOO J, and KIM H K. In-vehicle network intrusion detection using deep convolutional neural network[J]. Vehicular Communications, 2020, 21: 100198. doi: 10.1016/j.vehcom.2019.100198.
[35]	SONG Jiaru, QIN Guihe, LIANG Yanhua, et al. DGIDS: Dynamic graph-based intrusion detection system for CAN[J]. Computers & Security, 2024, 147: 104076. doi: 10.1016/j.cose.2024.104076.
[36]	KALKAN S C and SAHINGOZ O K. In-vehicle intrusion detection system on controller area network with machine learning models[C]. 2020 11th International Conference on Computing, Communication and Networking Technologies (ICCCNT), Kharagpur, India, 2020: 1–6. doi: 10.1109/ICCCNT49239.2020.9225442.
[37]	GOLOVKO V and VAITSEKHOVICH L. Neural network approaches for intrusion detection and recognition[J]. International Journal of Computing, 2014, 5(3): 118–125. doi: 10.47839/ijc.5.3.416.
[38]	BERGER I, RIEKE R, KOLOMEETS M, et al. Comparative study of machine learning methods for in-vehicle intrusion detection[C]. ESORICS 2018 International Workshops Computer Security, Barcelona, Spain, 2018: 85–101. doi: 10.1007/978-3-030-12786-2_6.
[39]	TAN Mingxing and LE Q. EfficientNet: Rethinking model scaling for convolutional neural networks[C]. Proceedings of the 36th International Conference on Machine Learning, Long Beach, USA, 2019: 6105–6114.
[40]	HOWARD A, SANDLER M, CHEN Bo, et al. Searching for MobileNetV3[C]. Proceedings of the 2019 IEEE/CVF International Conference on Computer Vision (ICCV), Seoul, Korea (South), 2019: 1314–1324. doi: 10.1109/ICCV.2019.00140.
[41]	HANSELMANN M, STRAUSS T, DORMANN K, et al. CANet: An unsupervised intrusion detection system for high dimensional CAN bus data[J]. IEEE Access, 2020, 8: 58194–58205. doi: 10.1109/ACCESS.2020.2982544.
[42]	ZONG Bo, SONG Qi, MIN M R, et al. Deep autoencoding gaussian mixture model for unsupervised anomaly detection[C]. 6th International Conference on Learning Representations, Vancouver, Canada, 2018.
[43]	ZHOU Yixuan, XU Xing, SONG Jingkuan, et al. MSFlow: Multiscale flow-based framework for unsupervised anomaly detection[J]. IEEE Transactions on Neural Networks and Learning Systems, 2025, 36(2): 2437–2450. doi: 10.1109/TNNLS.2023.3344118.
[44]	ZHOU Qihang, HE Shibo, LIU Haoyu, et al. Label-free multivariate time series anomaly detection[J]. IEEE Transactions on Knowledge and Data Engineering, 2024, 36(7): 3166–3179. doi: 10.1109/TKDE.2024.3349613.
[45]	YANG Yiyuan, ZHANG Chaoli, ZHOU Tian, et al. DCdetector: Dual attention contrastive representation learning for time series anomaly detection[C]. Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Long Beach, USA, 2023: 3033–3045.
[46]	FANG Yuchen, XIE Jiandong, ZHAO Yan, et al. Temporal-frequency masked autoencoders for time series anomaly detection[C]. 2024 IEEE 40th International Conference on Data Engineering (ICDE), Utrecht, Netherlands, 2024: 1228–1241. doi: 10.1109/ICDE60146.2024.00099.
[47]	苗金钊, 刘金良, 孙乐, 等. 基于虚假数据检测的信息物理系统安全学习控制方法[J]. 电子与信息学报, 2026, 48(4): 1434–1443. doi: 10.11999/JEIT250537. MIAO Jinzhao, LIU Jinliang, SUN Le, et al. A learning-based security control method for cyber-physical systems based on false data detection[J]. Journal of Electronics & Information Technology, 2026, 48(4): 1434–1443. doi: 10.11999/JEIT250537.