CONTEXT-AWARE, GRAPH-CENTRIC AND ROBUSTNESS-GOVERNED INTRUSION DETECTION FRAMEWORK FOR VEHICULAR NETWORKS

Abstract

An abundance of cyber-physical communication ecosystems can be found in modern automobiles. The interactions between CAN, ECU, and V2X create attack paths that flat intrusion labels or accuracy-only IDS evaluation can't safely handle in the process. The purpose of this research is to provide a five-stage intrusion detection approach for automotive networks that is aware of the context, centered on graphs, and regulated by robustness. Threat-Graph Entropy Mining (TGEM) is the initial component of the framework that has been developed. Attack surfaces, protocol artifacts, ECUs, and observable symptoms are all connected to one another through a multi-layer threat interaction graph in this procedure. Then, entropycentrality scoring finds the main attack families and unsolved defense gaps. The payload, temporal, and topological views are then aligned into a threat-priority-guided latent model via CMV-DD. This is accomplished by having the instructor and students distill the data. The Graph-TCN Transformer with Reliability-Gated Fusion (GTT-RGF) finds threats by combining ECU relationships, short-term temporal deviations, and long-range planned attack patterns. In order to accomplish this, it dynamically reduces the impact of views that are either fraudulent or highly noisy. When a minimum attack is utilized in a manner that is consistent with the graph, Counterfactual Attack-Path Verification (CAPV) monitors the situation to determine whether or not the alarms continue to be reliable. Under the Risk Calibration and Continuous Drift Governance (RCC-DG) system, detection data are converted into practical risk scores that are more precise. Additionally, the technology enables regulated updates to be made after drift has occurred. The findings of tests that were conducted with settings that were influenced by CAN and V2X revealed that F1- scores ranged from 93.9 to 96.2% in highway, urban, intersection, and mixed driving scenarios. Depending on the amount of traffic on the network, this indicates that the percentage of false positives decreases to between 1.9 and 3.1%. The model also has an average detection latency of 18–27 ms, a throughput of nearly 940 windows per second, a robust detection range of 88.9–90.6% under minor coordinated perturbations, an expected calibration error of 0.03 ms, and 95.6% performance retention after drift. Findings such as these demonstrate that the proposed paradigm not only improves the accuracy of detection, but also improves causal robustness, contextual generalization, risk interpretability, and implementation reliability for the next generation of intelligent transportation systems.