Temporal Graph Neural Network-Based Anomaly Detection in in-Vehicle CAN-Bus Sensor Data

Abstract

Modern vehicles rely on Controller Area Network (CAN) communication, where detecting anomalies in multivariate sensor data is vital for safety and reliability. To capture diverse anomalies in multivariate time series, models must learn both temporal and spatial dependencies. Graph neural network (GNN)-based approaches have shown strong capability in this regard, yet existing models such as GDN insufficiently capture temporal dynamics. We propose the Temporal Graph Deviation Network (TGDN), which enhances GDN with temporal encoders-LSTM and Conv1D. In addition, we introduce a graph smoothness regularizer to encourage consistency among related sensors during prediction. We evaluate two TGDN variants on a proprietary CAN dataset and the public X-CANIDS benchmark, and compare them against several baselines, including AE, LSTM-VAE, and GDN. Experimental results show that both TGDN variants outperform GDN on both datasets and achieve higher F1-scores than LSTM-VAE on average over the evaluated anomaly types. Furthermore, for X-CANIDS, where multiple independent normal subsets are available, we employ an ensemble strategy that trains separate models on different normal subsets and combines their decisions through voting. This approach performs substantially better than training a single model on the concatenated normal data, indicating that preserving subsetspecific normal patterns leads to a more robust anomaly detection decision.