US 12,488,049 B2
Federated graph neural network for fast anomaly detection in controller area networks
Hengrun Zhang, Fairfax, VA (US); and Kai Zeng, Fairfax, VA (US)
Assigned to George Mason University, Fairfax, VA (US)
Filed by George Mason University, Fairfax, VA (US)
Filed on Jul. 28, 2023, as Appl. No. 18/227,474.
Claims priority of provisional application 63/393,336, filed on Jul. 29, 2022.
Prior Publication US 2024/0064160 A1, Feb. 22, 2024
Int. Cl. G06F 16/901 (2019.01); G06N 3/044 (2023.01); G06N 3/088 (2023.01); H04L 9/40 (2022.01); H04L 12/40 (2006.01); H04L 41/16 (2022.01)
CPC G06F 16/9024 (2019.01) [G06N 3/044 (2023.01); G06N 3/088 (2013.01); H04L 12/40 (2013.01); H04L 41/16 (2013.01); H04L 63/1425 (2013.01); H04L 2012/40215 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method comprising:
generating graph data from a sequence of messages in a communication network, each message including data content and a message identifier, the graph data denoting:
a node for each message identifier in the sequence of messages; and
an edge for each pair of consecutive message identifiers in the sequence of messages, the edge linking two nodes;
for edges in the graph data, generating a pair count as a number of times the associated pair of consecutive message identifiers occurs in the sequence of messages;
for nodes in the graph data, generating an input feature vector including:
data content of messages that include the message identifier associated with the node; and
a pair count for each edge connected to the node;
processing the input feature vectors through a first graph neural network, based on the graph data, to produce first output feature vectors; and
classifying the sequence of messages as containing an anomaly or not, including processing the first output feature vectors through one or more first output layers.