{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T12:29:35Z","timestamp":1781008175619,"version":"3.54.1"},"reference-count":45,"publisher":"MDPI AG","issue":"10","license":[{"start":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T00:00:00Z","timestamp":1778198400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>A central open question in automotive intrusion detection is not merely whether relational representations of Controller Area Network (CAN) traffic improve performance, but which aspects of CAN traffic structure transfer robustly across attacks and which do not transfer across vehicle platforms, and why. To investigate this question systematically, we develop a lightweight intrusion-detection framework combining statistical traffic descriptors, structural identifier transition features, and graph topology representations extracted from sliding windows of CAN frames. Because CAN is a broadcast-only bus with no request\u2013response mechanism, each ECU independently transmits its identifiers at fixed periodic rates; accordingly, the structural and graph-based features capture the temporal scheduling regularity of identifier broadcasts, not directed inter-ECU communication dependencies. Stress-testing the framework under cross-attack and cross-dataset transfer reveals a clear four-level hierarchy: (1) statistical features collapse under cross-attack transfer (ROC-AUC as low as 0.009), failing to generalise beyond the attack type seen during training; (2) structural transition features are the most robust form of representation, maintaining high cross-attack performance (ROC-AUC &gt; 0.999) across all evaluated scenarios within the same vehicle platform; (3) graph topology features are scenario-dependent, achieving high robustness in DoS-trained scenarios but producing sub-random results in Fuzzy-trained scenarios, exposing a sensitivity to injection density profiles; and (4) the hybrid combination provides the strongest overall operational package, consistently across four classifiers. Cross-dataset transfer to the ROAD dataset reveals the precise boundary conditions of transferability: structural representations transfer only when an attack perturbs identifier transition regularity (correlated signal attacks, ROC-AUC = 0.81\u20130.83), while attacks that affect only payload semantics (speedometer) or exploit identifier\u2013space novelty (fuzzing) lie outside the detection scope of transition-based features, regardless of the vehicle platform. A vehicle-specific calibration experiment further shows that the correlated-attack generalization gap can be closed with as little as 10% of target-vehicle normal traffic, whereas speedometer attacks remain structurally invisible by design. A key contribution of this work is therefore a transparent approach for identifying when relational CAN representations transfer and when they do not\u2014a finding that is more scientifically valuable than a uniformly optimistic performance claim and which provides concrete guidance for practitioners designing cross-platform automotive IDS.<\/jats:p>","DOI":"10.3390\/s26102964","type":"journal-article","created":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T19:10:52Z","timestamp":1778267452000},"page":"2964","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Relational Modelling for Automotive Cybersecurity: Structural Transition and Graph-Topology-Based CAN Intrusion Detection"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-0312-9022","authenticated-orcid":false,"given":"Mohammad Khalaf","family":"Khreasat","sequence":"first","affiliation":[{"name":"Expert Systems and Applications Laboratory (ESALab), Faculty of Science, University of Salamanca, 37008 Salamanca, Spain"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6536-2251","authenticated-orcid":false,"given":"Gabriel Villarrubia","family":"Gonz\u00e1lez","sequence":"additional","affiliation":[{"name":"Expert Systems and Applications Laboratory (ESALab), Faculty of Science, University of Salamanca, 37008 Salamanca, Spain"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,5,8]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"82","DOI":"10.1007\/s42154-023-00266-9","article-title":"Review of Electrical and Electronic Architectures for Autonomous Vehicles: Topologies, Networking and Simulators","volume":"7","author":"Wang","year":"2024","journal-title":"Automot. Innov."},{"key":"ref_2","first-page":"100639","article-title":"Security assessment of in-vehicle communication protocols","volume":"44","author":"Anwar","year":"2023","journal-title":"Veh. Commun."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"13820","DOI":"10.1038\/s41598-025-98433-x","article-title":"Securing the CAN bus using deep learning for intrusion detection in vehicles","volume":"15","author":"Rai","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_4","unstructured":"Tron, A.D.F., Longari, S., Carminati, M., Polino, M., and Zanero, S. (2022). CANflict. Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, Association for Computing Machinery."},{"key":"ref_5","first-page":"103646","article-title":"EF-IDS: An efficient intrusion detection system with enriched features for CAN bus in modern vehicles","volume":"171","author":"Wang","year":"2025","journal-title":"J. Syst. Archit."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Radivilova, T., Kirichenko, L., Alghawli, A.S., Ageyev, D., Mulesa, O., Baranovskyi, O., Ilkov, A., Kulbachnyi, V., and Bondarenko, O. (2022). Statistical and Signature Analysis Methods of Intrusion Detection. Lecture Notes on Data Engineering and Communications Technologies, Springer.","DOI":"10.1007\/978-3-030-95161-0_5"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"148613","DOI":"10.1109\/ACCESS.2025.3600984","article-title":"Adversarial Challenges in Network Intrusion Detection Systems: Research Insights and Future Prospects","volume":"13","author":"Ennaji","year":"2025","journal-title":"IEEE Access"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"286","DOI":"10.1007\/s44443-025-00273-2","article-title":"Driveshield: Unmasking stealthy attacks on CAN bus via adversarial spatiotemporal feature learning","volume":"37","author":"Jia","year":"2025","journal-title":"J. King Saud Univ. Comput. Inf. Sci."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"104108","DOI":"10.1016\/j.adhoc.2025.104108","article-title":"RAG-HIDS: A multi-relational graph-based hierarchical intrusion detection system for in-vehicle networks","volume":"183","author":"Lin","year":"2025","journal-title":"Ad Hoc Netw."},{"key":"ref_10","first-page":"15","article-title":"Performance Comparison of Timing-Based Anomaly Detectors for Controller Area Network: A Reproducible Study","volume":"8","author":"Pollicino","year":"2023","journal-title":"ACM Trans. Cyber-Phys. Syst."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Donadel, D., Balasubramanian, K., Brighente, A., Cleaveland, R., Conti, M., and Poovendran, R. (2025). CANTXSec: A Deterministic Intrusion Detection and Prevention System for CAN Bus Monitoring ECU Activations. Lecture Notes in Computer Science, Springer.","DOI":"10.1007\/978-3-031-95764-2_17"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"591","DOI":"10.1007\/s11227-025-07116-x","article-title":"GDT-IDS: Graph-based decision tree intrusion detection system for controller area network","volume":"81","author":"Ye","year":"2025","journal-title":"J. Supercomput."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"31","DOI":"10.1145\/3737294","article-title":"Assessing the Resilience of Automotive Intrusion Detection Systems to Adversarial Manipulation","volume":"9","author":"Longari","year":"2025","journal-title":"ACM Trans. Cyber-Phys. Syst."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"567","DOI":"10.1007\/s11263-024-02196-3","article-title":"A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinking","volume":"133","author":"Liu","year":"2024","journal-title":"Int. J. Comput. Vis."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"185","DOI":"10.1016\/j.future.2022.08.011","article-title":"TAD: Transfer learning-based multi-adversarial detection of evasion attacks against network intrusion detection systems","volume":"138","author":"Debicha","year":"2022","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"625","DOI":"10.1038\/s42254-021-00348-9","article-title":"Variational quantum algorithms","volume":"3","author":"Cerezo","year":"2021","journal-title":"Nat. Rev. Phys."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"33952","DOI":"10.1038\/s41598-025-10637-3","article-title":"Optimal attention deep learning based in-vehicle intrusion detection and classification model on CAN messages","volume":"15","author":"Saravanan","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"1554","DOI":"10.1038\/s41598-025-85248-z","article-title":"An optimized LSTM-based deep learning model for anomaly network intrusion detection","volume":"15","author":"Dash","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"22111","DOI":"10.1109\/JIOT.2023.3303271","article-title":"CANShield: Deep-Learning-Based Intrusion Detection Framework for Controller Area Networks at the Signal Level","volume":"10","author":"Shahriar","year":"2023","journal-title":"IEEE Internet Things J."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"53","DOI":"10.1186\/s40537-021-00444-8","article-title":"Review of deep learning: Concepts, CNN architectures, challenges, applications, future directions","volume":"8","author":"Alzubaidi","year":"2021","journal-title":"J. Big Data"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"8507","DOI":"10.1038\/s41598-026-38317-w","article-title":"Anomaly-based intrusion detection on benchmark datasets for network security: A comprehensive evaluation","volume":"16","author":"Kumar","year":"2026","journal-title":"Sci. Rep."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Yin, T., Naqvi, S.A.R., Nandanoori, S.P., and Kundu, S. (2024). Advancing Cyber-Attack Detection in Power Systems: A Comparative Study of Machine Learning and Graph Neural Network Approaches. 2024 Resilience Week (RWS), IEEE.","DOI":"10.1109\/RWS62797.2024.10799283"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Zola, F., Medina, J.A., Venturi, A., Gil, A., and Orduna-Urrutia, R. (2025). A Graph Machine Learning Approach for Detecting Topological Patterns in Transactional Graphs. arXiv.","DOI":"10.1109\/ICDMW69685.2025.00025"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"1726","DOI":"10.1038\/s41598-025-85866-7","article-title":"Signature-based intrusion detection using machine learning and deep learning approaches empowered with fuzzy clustering","volume":"15","author":"Ahmed","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"64","DOI":"10.1186\/s42400-024-00249-1","article-title":"Renyi entropy-driven network traffic anomaly detection with dynamic threshold","volume":"7","author":"Yu","year":"2024","journal-title":"Cybersecurity"},{"key":"ref_26","unstructured":"de Heij, V., Niazi, M.U.B., Ahmed, S., and Johansson, K.H. (2025). Distributed Traffic State Estimation in V2X-Enabled Connected Vehicle Networks. arXiv."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Redhu, A., Choudhary, P., Srinivasan, K., and Das, T.K. (2024). Deep learning-powered malware detection in cyberspace: A contemporary review. Front. Phys., 12.","DOI":"10.3389\/fphy.2024.1349463"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"100349","DOI":"10.1016\/j.array.2024.100349","article-title":"Network intrusion detection leveraging multimodal features","volume":"22","author":"Kiflay","year":"2024","journal-title":"Array"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"100406","DOI":"10.1016\/j.array.2025.100406","article-title":"A comparative study of machine learning and deep learning models in binary and multiclass classification for intrusion detection systems","volume":"26","author":"Alharthi","year":"2025","journal-title":"Array"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"103777","DOI":"10.1016\/j.cose.2024.103777","article-title":"can-train-and-test: A curated CAN dataset for automotive intrusion detection","volume":"140","author":"Lampe","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Jiang, W., Zhang, T., Liu, S., Ji, W., Zhang, Z.C., and Xiao, G. (2023). Exploring the Physical-World Adversarial Robustness of Vehicle Detection. Electronics, 12.","DOI":"10.3390\/electronics12183921"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Cantone, M., Marrocco, C., and Bria, A. (2024). On the Cross-Dataset Generalization of Machine Learning for Network Intrusion Detection. arXiv.","DOI":"10.1109\/ACCESS.2024.3472907"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"13429","DOI":"10.1007\/s00500-024-10313-0","article-title":"Attention-CNN-LSTM based intrusion detection system (ACL-IDS) for in-vehicle networks","volume":"28","author":"Taneja","year":"2024","journal-title":"Soft Comput."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"263","DOI":"10.1145\/3729420","article-title":"A Survey of Autonomous Driving from a Deep Learning Perspective","volume":"57","author":"Zhao","year":"2025","journal-title":"ACM Comput. Surv."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"111359","DOI":"10.1016\/j.jss.2022.111359","article-title":"Data management for production quality deep learning models: Challenges and solutions","volume":"191","author":"Munappy","year":"2022","journal-title":"J. Syst. Softw."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"22329","DOI":"10.1038\/s41598-024-73643-x","article-title":"A Data-Centric Approach to improve performance of deep learning models","volume":"14","author":"Bhatt","year":"2024","journal-title":"Sci. Rep."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"113378","DOI":"10.1016\/j.asoc.2025.113378","article-title":"Deep learning: Historical overview from inception to actualization, models, applications and future trends","volume":"181","author":"Ekundayo","year":"2025","journal-title":"Appl. Soft Comput."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"35477","DOI":"10.1109\/JIOT.2024.3435833","article-title":"ByCAN: Reverse Engineering Controller Area Network (CAN) Messages From Bit to Byte Level","volume":"11","author":"Lin","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Seo, E., Song, H.M., and Kim, H.K. (2018). GIDS: GAN Based Intrusion Detection System for In-Vehicle Network. Proceedings of the 2018 16th Annual Conference on Privacy, Security and Trust (PST), IEEE.","DOI":"10.1109\/PST.2018.8514157"},{"key":"ref_40","first-page":"100198","article-title":"In-vehicle network intrusion detection using deep convolutional neural network","volume":"21","author":"Song","year":"2020","journal-title":"Veh. Commun."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"185489","DOI":"10.1109\/ACCESS.2020.3029307","article-title":"LSTM-Based Intrusion Detection System for In-Vehicle Can Bus Communications","volume":"8","author":"Hossain","year":"2020","journal-title":"IEEE Access"},{"key":"ref_42","first-page":"100471","article-title":"A Hybrid Deep Learning Based Intrusion Detection System Using Spatial-Temporal Representation of In-Vehicle Network Traffic","volume":"35","author":"Lo","year":"2022","journal-title":"Veh. Commun."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"45","DOI":"10.1007\/s12559-023-10179-8","article-title":"Interpreting Black-Box Models: A Review on Explainable Artificial Intelligence","volume":"16","author":"Hassija","year":"2023","journal-title":"Cogn. Comput."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"3726","DOI":"10.1038\/s41598-026-35238-6","article-title":"Efficient feature ranked hybrid framework for android Iot malware detection","volume":"16","author":"Saeed","year":"2026","journal-title":"Sci. Rep."},{"key":"ref_45","unstructured":"Verma, M.E., Bridges, R.A., Iannacone, M.D., Hollifield, S.C., Moriano, P., Hespeler, S.C., Kay, B., and Combs, F.L. (2020). A comprehensive guide to CAN IDS data & introduction of the ROAD dataset. arXiv."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/10\/2964\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,10]],"date-time":"2026-05-10T04:32:18Z","timestamp":1778387538000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/10\/2964"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,8]]},"references-count":45,"journal-issue":{"issue":"10","published-online":{"date-parts":[[2026,5]]}},"alternative-id":["s26102964"],"URL":"https:\/\/doi.org\/10.3390\/s26102964","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,5,8]]}}}