Frenken, Robert (The Ohio State University), Bhatti, Sidra Ghayour (OHIO State University), Hanqin, Zhang (The Ohio State University), Ahmed, Qadeer (Ohio State University)

KD-GAT: Combining Knowledge Distillation and Graph Attention Transformer for a Controller Area Network Intrusion Detection System

Scheduled for presentation during the Regular Session "S37c-Reliable Perception and Robust Sensing for Intelligent Vehicles" (FR-LA-T37), Friday, November 21, 2025, 16:20−16:40, Coolangata 1

2025 IEEE 28th International Conference on Intelligent Transportation Systems (ITSC), November 18-21, 2025, Gold Coast, Australia

This information is tentative and subject to change. Compiled on October 18, 2025

Abstract

The Controller Area Network (CAN) protocol is widely adopted for in-vehicle communication but lacks inherent security mechanisms, making it vulnerable to cyber- attacks. This paper introduces KD-GAT, an intrusion detection framework that combines Graph Attention Networks (GATs) with knowledge distillation (KD) to enhance detection accuracy while reducing computational complexity. In our approach, CAN traffic is represented as graphs using a sliding window to capture temporal and relational patterns. A multi-layer GAT with jumping knowledge aggregation acts as the teacher model, while a compact student GAT—only 6.32% the size of the teacher—is trained via a two-phase process involving supervised pretraining and knowledge distillation with both soft and hard label supervision. Experiments on three bench- mark datasets—Car-Hacking, Car-Survival, and can-train-and- test—demonstrate that both teacher and student models achieve strong results, with the student model attaining 99.97% and 99.31% accuracy on Car-Hacking and Car-Survival, respec- tively. However, significant class imbalance in can-train-and-test led to reduced performance for both models on this dataset. Addressing this imbalance remains an important direction for future work.