  As an important component of internet of vehicles (IoV), intelligent
connected vehicles (ICVs) have to communicate with external networks
frequently. In this case, the resource-constrained in-vehicle network (IVN) is
facing a wide variety of complex and changing external cyber-attacks,
especially the masquerade attack with high difficulty of detection while
serious damaging effects that few counter measures can identify successfully.
Moreover, only coarse-grained recognition can be achieved in current mainstream
intrusion detection mechanisms, i.e., whether a whole data flow observation
window contains attack labels rather than fine-grained recognition on every
single data item within this window. In this paper, we propose StatGraph: an
Effective Multi-view Statistical Graph Learning Intrusion Detection to
implement the fine-grained intrusion detection. Specifically, StatGraph
generates two statistical graphs, timing correlation graph (TCG) and coupling
relationship graph (CRG), based on data streams. In given message observation
windows, edge attributes in TCGs represent temporal correlation between
different message IDs, while edge attributes in CRGs denote the neighbour
relationship and contextual similarity. Besides, a lightweight shallow layered
GCN network is trained based graph property of TCGs and CRGs, which can learn
the universal laws of various patterns more effectively and further enhance the
performance of detection. To address the problem of insufficient attack types
in previous intrusion detection, we select two real in-vehicle CAN datasets
that cover four new attacks never investigated before. Experimental result
shows StatGraph improves both detection granularity and detection performance
over state-of-the-art intrusion detection methods.
