GUARD-CAN: Graph-Understanding and Recurrent Architecture for CAN Anomaly Detection

Huy Kang Kim; Hyeong Seon Kim

REVIEW 3 major objections 5 minor 13 references

GUARD-CAN: Graph-Understanding and Recurrent Architecture for CAN Anomaly Detection

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A graph-plus-recurrent model spots four types of CAN bus attacks with 0.993 AUC, using only packet payload and length.

desk verdict Useful architecture, weak evaluation: the GCN+GRU combination is novel, but the reported AUC is likely inflated by unspecified split procedures and hyperparameter selection. read the letter →

arxiv 2507.21640 v1 pith:JWRAZCG6 submitted 2025-07-29 cs.CR cs.AI

Hyeong Seon Kim , Huy Kang Kim This is my paper · ORCID

classification cs.CRcs.AI

keywords ControllerAreaNetworkCANbusintrusiondetectionGraphConvolutionalGatedRecurrentUnitanomalyin-vehiclesecurityCarHackingChallengedatasetembedding

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that a CAN bus anomaly detector can work without the database of arbitration IDs (DBC) that most intrusion detection systems treat as essential, and without hand-built features. It does this by splitting raw CAN traffic into fixed-size windows, turning each window into an order-preserving graph whose node features are only the packet's Data Length Code and eight payload bytes, and learning graph embeddings with an overcomplete autoencoder paired with a Graph Convolutional Network. The embeddings are fed in sliding-window sequences to a Gated Recurrent Unit, which labels both sequences and individual windows as normal or anomalous. On the Car Hacking Challenge 2020 dataset the model reports 0.9702 accuracy and 0.9930 AUC at a window size of 50 and sequence length of 50, and the authors argue from Shannon-entropy analysis that small windows give the graph enough structure without diluting the signal. If true, the contribution is a practically deployable in-vehicle intrusion detection system that attaches to raw CAN traffic without private vehicle specifications.

What carries the argument

The load-bearing mechanism is the ordered graph built from each CAN message window, combined with an overcomplete autoencoder and GCN that produce a 32-dimensional embedding per window, and a GRU that reads these embeddings as sequences. The graph edges preserve message arrival order so GCN can capture temporal structure without explicit timing features; the GRU then captures dependencies across windows. The overcomplete AE (9-dimensional input expanded to 16 dimensions) stabilizes GCN training by reconstructing the original node features.

What would settle it

Re-run the experiment with a strictly temporal split (for example, first 60% of each attack session for training, last 20% for test, forbidding any window that straddles the boundary) and compare AUC; if the 0.993 AUC drops substantially, the original result relied on temporal leakage.

Watch

Extended reading notes

Core claim

The central claim is that time-aware and structure-aware anomaly detection for CAN can be combined in a single pipeline that uses only the DLC and Data field of each packet. GUARD-CAN constructs one graph per fixed-size window by connecting consecutive packets in timestamp order; node features are the normalized DLC and the binarized payload bytes. An overcomplete autoencoder pre-processes these features, a three-layer GCN produces a 32-dimensional graph embedding via global mean pooling, and a two-layer GRU over sliding windows of embeddings outputs anomaly probabilities. The paper reports the best results at window size 50 and sequence length 50, with sequence-level detection achieving 0.9702 accuracy and 0.9930 AUC, and finds that these degrade as window size grows. The paper also claims that binarizing payload bytes outperforms normalized float bytes, because dense value distributions inflate the autoencoder's reconstruction error.

Load-bearing premise

The model's reported performance rests on the assumption that the 6:2:2 split is temporally disjoint, so no message used to train the GCN or GRU appears in the windows being tested.

Editorial extensions

If this is right

An intrusion detection system for CAN can be deployed without a DBC, since only DLC and payload bytes are used; this removes the need for manufacturer-specific arbitration ID maps.
Window size around 50 and sequence length around 50 give the best accuracy and AUC, so a lightweight temporal context is sufficient for these attack types.
Binarized payload bytes are preferable to normalized floats, suggesting the detector keys on the presence or absence of byte patterns rather than their magnitudes.
Both sequence-level and window-level (mean and max) outputs are usable as detection decisions, giving the operator a choice of granularity.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper does not state whether the 6:2:2 split is temporal; if training windows overlap test windows in time, the AUC partly reflects memorized normal patterns, so reproducing the experiment with a strictly temporal split is the natural next check.
Because a window is labeled anomalous if any packet in it is an attack, sparse attacks create mostly-normal positive windows; the model may be learning attack co-occurrence across a window rather than per-packet maliciousness.
The Shannon-entropy argument could be turned into a design rule: choose the smallest window size whose entropy growth rate has plateaued, which here points to 50; this is testable on other CAN datasets.
Applying the same graph-plus-GRU pipeline to other in-vehicle protocols (CAN-FD, LIN) or to synthetically replayed real-vehicle traces would test whether the DBC-free design transfers beyond the Challenge dataset.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The core idea is genuinely useful. GUARD-CAN encodes fixed-size windows of CAN traffic as chain graphs over payload bytes and DLC, embeds them with an AE-pretrained GCN, then feeds sequences of embeddings to a GRU. That combination is not in the cited literature, and dropping arbitration IDs means no DBC file is needed. If it generalizes, that's a real practical win for automotive security monitoring.

The evaluation is where I part ways with the authors' confidence. The headline number (0.9702 accuracy, 0.9930 AUC) is selected from 5 window sizes × 5 sequence lengths × 3 scoring variants, with no model-selection protocol and no variance estimate across splits. Worse, there is no baseline comparison at all, so it's hard to say whether the GRU over graph embeddings beats a plain MLP on the same features or even a simple frequency-based detector. The reader's stress-test about split leakage is also fair: the paper never says the GCN pretraining set (179,346 normal records) is disjoint from the anomaly-detection set (1,799,046 normal records), nor whether windows and sequences are constructed separately within train/validation/test. On a dataset of long normal segments followed by attack bursts, overlapping windows can easily leak context into test sequences. These are not fatal design flaws—the architecture is coherent and the losses are standard—but the empirical claims are weaker than the abstract implies.

Credit where due: the entropy analysis for window sizing is a nice touch, the two-level detection (sequence/window) is a thoughtful evaluation angle, and the paper is transparent about its hyperparameters. The related work is fine, a bit heavy on the authors' own group but not egregiously so. No circular derivation.

This paper is for people working on CAN intrusion detection, especially those who want a DBC-free detector. It deserves a serious referee, but the referee should demand a proper evaluation protocol: temporal split documentation, multiple runs with variance, baselines, and ideally a cross-dataset check. I would conditionally accept after major revision.

Referee Report

3 major / 5 minor

Summary. GUARD-CAN is a CAN-bus anomaly detection framework that works directly from DLC and payload bytes without arbitration IDs or DBC files. The method: (1) pads and splits payload bytes into eight columns; (2) builds non-overlapping packet windows and represents each window as a timestamp-ordered path graph; (3) trains an overcomplete autoencoder plus three-layer GCN on normal graphs to produce 32-dimensional graph embeddings via global mean pooling; (4) forms overlapping sequences of embeddings and feeds them to a two-layer GRU with binary cross-entropy loss; and (5) scores anomalies at sequence level and at window level by mean/max aggregation of overlapping sequence scores. Experiments on the Car Hacking Challenge 2020 dataset report a best sequence-level accuracy of 0.9702 and AUC of 0.9930 at window size 50 and sequence length 50, with additional results for other window sizes and sequence lengths, and an entropy analysis intended to justify window size selection.

Significance. The architecture is genuinely distinctive: it is arbitration-ID-independent, avoids DBC parsing, combines graph-structural and recurrent-temporal modeling, and evaluates detection at two granularities. The use of an external dataset and explicit descriptions of the GCN/AE/GRU configuration are strengths. However, the empirical support is incomplete: no temporal-separation protocol is described, no baseline or variance estimate is reported, and the headline number is a selected maximum over 75 configurations. If the split-leakage issues are resolved and the method is compared with at least one prior CAN IDS, the paper would make a useful contribution to intrusion detection for in-vehicle networks.

major comments (3)

[Section 5.1, Section 4.3, Section 4.4] The experimental protocol does not establish temporal disjointness between the data used to train GCN and the train/validation/test splits for the GRU. Section 5.1 only says the anomaly-detection dataset was split into training, validation, and test sets in a 6:2:2 ratio, and Section 4.3 says GCN uses only normal data; the paper does not state whether the split is random or by contiguous time ranges, whether the 179,346 normal records in Table 1 are disjoint from the 1,799,046 normal records in the anomaly-detection set, or whether windows and sequences are generated separately within each split. If the split is random or if the overlapping sequences from Section 4.4 cross split boundaries, the reported AUC can be inflated by repeated normal byte patterns and by fragments of the same attack burst appearing in both training and test sets. Please provide an explicit split description (e.g., timestamp ranges or indices) and rerun the evaluation with strict temporal separation, generating windows and sequences independently within train, validation, and test.
[Section 5.3, Table 2] The headline result is selected as the best among five window sizes, five sequence lengths, and three scoring variants, yet no validation-based selection rule, no run-to-run variance, and no comparison with existing CAN IDSs are reported. Because AUC values from a single split can vary substantially with random initialization and because the 75-configuration search makes the reported maximum optimistic, the absolute numbers do not by themselves support the claim that GUARD-CAN detects attacks 'effectively.' At minimum, report mean and standard deviation over multiple training seeds for the chosen configuration on a fixed test set, and include at least one baseline method (e.g., a frequency/statistical detector or a published deep learning IDS) evaluated on the same chronological split.
[Section 5.2, Figure 2] The entropy analysis is described in terms of how evenly arbitration IDs appear within a window ('when the IDs appear more evenly...'), but the model deliberately does not use arbitration IDs as features. Please state exactly what quantity the entropy is computed over; if it is ID entropy, the analysis is not a valid justification for the window sizes chosen for a model whose node features are DLC and payload bytes. If it is byte-level or graph-level entropy, the text and figure description should be corrected accordingly.

minor comments (5)

[Section 4.3, Section 4.1] The binarization step is underspecified. Section 4.1 says byte values are normalized to [0,1], while Section 5.3 refers to 'binarized byte values (integer values of 0 or 1)'. Please define the exact mapping used to obtain the 9-dimensional node features, because the comparison between Tables 2 and 3 depends on it.
[Section 4.4] The sequence indexing is imprecise: for sequence length 3, the last sequence should start at h_{m-2}, and the subscript n is not defined. Rewrite the formula with an explicit range such as i=0,...,m-L.
[Figure 3] The x-axis is labeled only 50, 100, 150, but the experiment uses sequence lengths 30, 50, 100, 120, 150; add all tick values or clarify the plot.
[Table 1] The paper should explain the provenance and relationship of the 179,346-record GCN training set to the 1,799,046-record anomaly-detection normal set (e.g., different sessions, different files, or a subset). Currently this distinction is unclear.
[General presentation] There are several typos and formatting issues, including 'T able 1' and 'T able 2' captions, 'GUARD-' spacing in the abstract, and inconsistent use of 'binarized' vs. 'normalized' byte features. These should be cleaned up.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the empirical evaluation is self-contained against an external dataset, and no equation or fitted parameter is repackaged as a prediction.

full rationale

The paper's central claim is an empirical result on the Car Hacking Challenge 2020 dataset, which is external to the paper and contains independent attack and normal records. The methodology is a standard pipeline: preprocessing, graph construction, GCN-AE embedding, and GRU sequence classification. No parameter reported in the results section is fitted to the test set and then renamed as a prediction; the reported accuracy and AUC are evaluated on a held-out portion of an external dataset. The only self-citations are to the authors' own prior dataset and IDS papers, and these are used for background and data provenance, not as evidence that GUARD-CAN's architecture is forced or unique. The window-size and sequence-length choices are justified by an entropy analysis and by ablation-style comparison, not by a derivation that assumes the reported outcome. Therefore, the derivation chain is not circular: the model's inputs are CAN packet features, and its outputs are anomaly scores evaluated against external labels. Concerns about possible temporal split leakage or window-boundary overlap are validity risks about experimental protocol, not circularity in the sense of a claim reducing to its own inputs by construction.

Assumptions & free parameters 6 free parameters · 3 assumptions · 0 invented entities

The reported performance depends on hand-chosen hyperparameters (window size, sequence length, threshold, architecture dimensions) and on a leakage-free split between GCN pretraining and supervised evaluation. The paper introduces no invented physical or mathematical entities. The main unstated assumptions are that the timestamp-ordered path graph retains the signal needed for detection and that attack labels propagate cleanly from packets to windows to sequences.

free parameters (6)

window_size = 50 (best reported)
Fixed-size window converted to a graph; best performance reported at 50. Five values (50 to 150) were searched and the best was selected, so the headline result depends on this choice.
sequence_length = 50 (best reported)
Number of graph embeddings fed to GRU; best reported at 50. Searched over 30 to 150.
anomaly_threshold = 0.5
Fixed decision threshold for sequence and window-level binary outputs; not tuned by validation.
AE_latent_dim = 16
Latent dimension of overcomplete autoencoder chosen by hand; affects the representation GCN receives.
GCN_hidden_dim = 32
Output dimension of the three GCN layers, chosen by hand.
GRU_hidden_dim = 64
Hidden dimension of the two GRU layers, chosen by hand.

assumptions (3)

domain assumption A window graph whose edges connect packets in timestamp order preserves the temporal structure needed for attack detection.
The graph is a path over messages and GCN aggregates immediate neighbors only. The paper asserts this captures temporal dependencies in Section 4.2 but does not validate against alternative graph constructions.
domain assumption An attack-free GCN pretraining set and a disjoint test split avoid message-level leakage.
No temporal split protocol is documented in Section 5.1; the reported AUC assumes this holds.
ad hoc to paper Overcomplete AE reconstruction loss on normal data produces embeddings in which attack windows are separable.
Section 4.3 claims the AE-GCN combination gives 'more generalized representations and improved training stability' but no reconstruction-error analysis or embedding visualization is provided.

how reviews work

0 comments

Cite this review

Pith. "Pith review of GUARD-CAN: Graph-Understanding and Recurrent Architecture for CAN Anomaly Detection." pith.science (2026). https://pith.science/paper/JWRAZCG6

@misc{pith2026250721640,
  author       = {Pith},
  title        = {Pith review of: GUARD-CAN: Graph-Understanding and Recurrent Architecture for CAN Anomaly Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JWRAZCG6}},
  note         = {Machine review of arXiv:2507.21640}
}

read the original abstract

Modern in-vehicle networks face various cyber threats due to the lack of encryption and authentication in the Controller Area Network (CAN). To address this security issue, this paper presents GUARD-CAN, an anomaly detection framework that combines graph-based representation learning with time-series modeling. GUARD-CAN splits CAN messages into fixed-length windows and converts each window into a graph that preserves message order. To detect anomalies in the timeaware and structure-aware context at the same window, GUARD-CAN takes advantage of the overcomplete Autoencoder (AE) and Graph Convolutional Network (GCN) to generate graph embedding vectors. The model groups these vectors into sequences and feeds them into the Gated Recurrent Unit (GRU) to detect temporal anomaly patterns across the graphs. GUARD-CAN performs anomaly detection at both the sequence level and the window level, and this allows multi-perspective performance evaluation. The model also verifies the importance of window size selection through an analysis based on Shannon entropy. As a result, GUARD-CAN shows that the proposed model detects four types of CAN attacks (flooding, fuzzing, replay and spoofing attacks) effectively without relying on complex feature engineering.

Figures

Figures reproduced from arXiv: 2507.21640 by the authors.

**Figure 1.** 3. GCN Encoder 16 32 9 16 16 Normal CAN raw data Mixed CAN raw data 1. Data Preprocessing Data field padding Splitting the Data field (8 columns for each packet) Windowing Byte column Normalization DLC column Normalization 10 col Window size 10 col 2. Initial Graph Generator Graph The number of windows GCN Train (Input = 9dim) Graph Embedding ) : 1 x 32 Sliding window-based sequencing 4. Anomaly Detection GRU Train/… view at source ↗

**Figure 2.** Entropy average and growth rate by window size. This graph shows the values between window sizes 20 and 400, excluding window size 10 for which the growth rate cannot be calculated. graph may still lack enough information for GCN to learn effectively. In addition, it can be observed that for window sizes over 150, the growth rate nearly converges to zero. Therefore, this study conducted performance evaluations of t… view at source ↗

**Figure 3.** AUC variation by sequence length for each window size. The figure shows the anomaly detection results (AUC) for each sequence length with five window size values, including sequence-level, window-level (mean), and window-level (max) [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

13 extracted references · 12 canonical work pages

[1]

Detecting can bus intrusion by applying machine learning method to graph based features

Rafi Ud Daula Refat, Abdulrahman Abu Elkhail, Azeem Hafeez, and Hafiz Malik. Detecting can bus intrusion by applying machine learning method to graph based features. In Intelligent Systems and Applications: Proceedings of the 2021 Intelli- gent Systems Conference (IntelliSys) Volume 3, pages 730–748. Springer, 2022

work page 2021
[2]

Survey of automotive controller area network intrusion detection systems.IEEE Design & Test, 36(6):48–55, 2019

Clinton Young, Joseph Zambreno, Habeeb Olufowobi, and Gedare Bloom. Survey of automotive controller area network intrusion detection systems.IEEE Design & Test, 36(6):48–55, 2019

work page 2019
[3]

Hackers remotely kill a jeep on the highway—with me in it.https:// www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

WIRED. Hackers remotely kill a jeep on the highway—with me in it.https:// www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ . last accessed 2025/07/24

work page 2015
[4]

Free-fall: Hacking tesla from wireless to can bus

Sen Nie, Ling Liu, and Yuefeng Du. Free-fall: Hacking tesla from wireless to can bus. Briefing, Black Hat USA, 25(1):16, 2017

work page 2017
[5]

Car hacking and defense competition on in-vehicle network

Hyunjae Kang, Byung Il Kwak, Young Hun Lee, Haneol Lee, Hwejae Lee, and Huy Kang Kim. Car hacking and defense competition on in-vehicle network. In Workshop on automotive and autonomous vehicle security (AutoSec), volume 2021, page 25. NDSS San Diego, CA, 2021

work page 2021
[6]

Semi-supervised classification with graph con- volutional networks.arXiv preprint arXiv:1609.02907, 2016

Thomas N Kipf and Max Welling. Semi-supervised classification with graph con- volutional networks.arXiv preprint arXiv:1609.02907, 2016

arXiv 2016
[7]

Intrusion detection system based on the analysis of time intervals of can messages for in-vehicle network

Hyun Min Song, Ha Rang Kim, and Huy Kang Kim. Intrusion detection system based on the analysis of time intervals of can messages for in-vehicle network. In 2016 International Conference on Information Networking (ICOIN), pages 63–68, 2016

work page 2016
[8]

Otids: A novel intrusion detectionsystemforin-vehiclenetworkbyusingremoteframe

Hyunsung Lee, Seong Hoon Jeong, and Huy Kang Kim. Otids: A novel intrusion detectionsystemforin-vehiclenetworkbyusingremoteframe. In 2017 15th Annual Conference on Privacy, Security and Trust (PST), pages 57–5709, 2017

work page 2017

Show all 13 references

[9]

In-vehicle network intrusion detection using deep convolutional neural network

Hyun Min Song, Jiyoung Woo, and Huy Kang Kim. In-vehicle network intrusion detection using deep convolutional neural network. Vehicular Communications, 21:100198, 2020

2020
[10]

Gdt-ids: Graph-based decision tree intrusion detection system for controller area network.The Journal of Supercomputing, 81(4):591, 2025

Pengdong Ye, Yanhua Liang, Yutao Bie, Guihe Qin, Jiaru Song, Yingqing Wang, and Wanning Liu. Gdt-ids: Graph-based decision tree intrusion detection system for controller area network.The Journal of Supercomputing, 81(4):591, 2025

2025
[11]

Dgids: Dynamic graph-based intrusion detection system for can.Computers & Security, 147:104076, 2024

Jiaru Song, Guihe Qin, Yanhua Liang, Jie Yan, and Minghui Sun. Dgids: Dynamic graph-based intrusion detection system for can.Computers & Security, 147:104076, 2024

2024
[12]

Gcnids: Graph convolutional network-based intrusion detection system for can bus.arXiv preprint arXiv:2309.10173, 2023

Maloy Kumar Devnath. Gcnids: Graph convolutional network-based intrusion detection system for can bus.arXiv preprint arXiv:2309.10173, 2023

2023 arXiv
[13]

Car hacking: Attack & defense challenge 2020 dataset.https: //dx.doi.org/10.21227/qvr7-n418

IEEE Dataport. Car hacking: Attack & defense challenge 2020 dataset.https: //dx.doi.org/10.21227/qvr7-n418. last accessed 2025/07/24

2020 doi

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Detecting can bus intrusion by applying machine learning method to graph based features

Rafi Ud Daula Refat, Abdulrahman Abu Elkhail, Azeem Hafeez, and Hafiz Malik. Detecting can bus intrusion by applying machine learning method to graph based features. In Intelligent Systems and Applications: Proceedings of the 2021 Intelli- gent Systems Conference (IntelliSys) Volume 3, pages 730–748. Springer, 2022

work page 2021

[2] [2]

Survey of automotive controller area network intrusion detection systems.IEEE Design & Test, 36(6):48–55, 2019

Clinton Young, Joseph Zambreno, Habeeb Olufowobi, and Gedare Bloom. Survey of automotive controller area network intrusion detection systems.IEEE Design & Test, 36(6):48–55, 2019

work page 2019

[3] [3]

Hackers remotely kill a jeep on the highway—with me in it.https:// www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

WIRED. Hackers remotely kill a jeep on the highway—with me in it.https:// www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ . last accessed 2025/07/24

work page 2015

[4] [4]

Free-fall: Hacking tesla from wireless to can bus

Sen Nie, Ling Liu, and Yuefeng Du. Free-fall: Hacking tesla from wireless to can bus. Briefing, Black Hat USA, 25(1):16, 2017

work page 2017

[5] [5]

Car hacking and defense competition on in-vehicle network

Hyunjae Kang, Byung Il Kwak, Young Hun Lee, Haneol Lee, Hwejae Lee, and Huy Kang Kim. Car hacking and defense competition on in-vehicle network. In Workshop on automotive and autonomous vehicle security (AutoSec), volume 2021, page 25. NDSS San Diego, CA, 2021

work page 2021

[6] [6]

Semi-supervised classification with graph con- volutional networks.arXiv preprint arXiv:1609.02907, 2016

Thomas N Kipf and Max Welling. Semi-supervised classification with graph con- volutional networks.arXiv preprint arXiv:1609.02907, 2016

arXiv 2016

[7] [7]

Intrusion detection system based on the analysis of time intervals of can messages for in-vehicle network

Hyun Min Song, Ha Rang Kim, and Huy Kang Kim. Intrusion detection system based on the analysis of time intervals of can messages for in-vehicle network. In 2016 International Conference on Information Networking (ICOIN), pages 63–68, 2016

work page 2016

[8] [8]

Otids: A novel intrusion detectionsystemforin-vehiclenetworkbyusingremoteframe

Hyunsung Lee, Seong Hoon Jeong, and Huy Kang Kim. Otids: A novel intrusion detectionsystemforin-vehiclenetworkbyusingremoteframe. In 2017 15th Annual Conference on Privacy, Security and Trust (PST), pages 57–5709, 2017

work page 2017