Federated graph neural network for fast anomaly detection in controller area networks

An apparatus comprising:

• one or more computers configured to receive a sequence of messages from a communication network, each message including data content and a message identifier;
• a non-transitory computer-readable medium coupled to the one or more computers and having instructions stored thereon, which, when executed by the one or more computers, cause the one or more computers to:
• generate graph data from the sequence, the graph data denoting:
• a node for each message identifier in the sequence of messages;
• and
• an edge for each pair of consecutive message identifiers in the sequence of messages, the edge linking two nodes;
• for edges in the graph data, generate a pair count as a number of times the associated pair of consecutive message identifiers occurs in the sequence of messages;
• for nodes in the graph data, generate an input feature vector including:
• data content of messages that include the message identifier associated with the node;
• and
• a pair count for each edge connected to the node;
• process the input feature vectors using a first graph neural network, based on the graph data, to produce first output feature vectors;
• and
• classify the sequence of messages as containing an anomaly or not, including processing the first output feature vectors through one or more first output layers.

An apparatus comprising:

• a memory
• a message graph generator configured to receive a sequence of messages of a communication network, each message including data content and a message identifier, and generate therefrom:
• graph data denoting:
• a node for each message identifier in the sequence of messages;
• and an edge for each pair of consecutive message identifiers in the sequence of messages, the edge linking two nodes;
• a pair count for each edge in the graph data denoting a number of times an associated pair of consecutive message identifiers occurs in the sequence of messages;
• an input feature vector for each node in the graph data, the input feature vector denoting:
• data content of messages that include the message identifier associated with the node;
• and
• a pair count for each edge connected to the node;
• an anomaly detector configured to:
• process the input feature vectors using a first graph neural network, based on the graph data, to produce first output feature vectors;
• and
• classify the sequence of messages as containing an anomaly or not, including processing the first output feature vectors through one or more first output layers.