![Student Publications [Scholarly]](../../assets/md5images/3a606fc6d4271534a4192eb383c1615a.jpg)
Student Publications [Scholarly]
Document Type
Article
Abstract
Modern intelligent transportation systems (ITS) increasingly rely on connected electronic control units (ECUs), exposing in-vehicle networks to cyber-attacks such as message injection on the Controller Area Network (CAN) bus. While prior work has focused on post-factum detection, this paper addresses the underexplored task of forecasting cyber-attacks before they occur. We propose a spatio-temporal graph neural network (STGNN) architecture that models CAN traffic as a dynamic graph sequence, where nodes represent active CAN IDs and edges capture statistical co-activation patterns. Each graph snapshot encodes temporal features such as inter-arrival statistics and entropy, and is processed using graph attention layers followed by a multi-head temporal self-attention module. We evaluate the proposed method on two real-world datasets: Car-Hacking and OTIDS, comprising over 6.5 million labeled CAN frames from a Kia Soul under multiple attack scenarios. Experimental results show that STGNN achieves an area under the ROC curve (AUC) of 0.97, F1-score of 0.94, and a Brier score of 0.040 at a 1-second forecasting horizon on Car-Hacking, and maintains strong performance on OTIDS (AUC 0.91, F1 0.87) even though its rule-based labeling may introduce inconsistencies. The model outperforms six baseline methods across all lead times and demonstrates robustness under cross-dataset transfer and architectural variation. These findings confirm the feasibility of accurate, real-time cyberattack forecasting for automotive systems and highlight the utility of spatio-temporal graph learning for predictive cybersecurity in ITS. © 2026 Institute of Electrical and Electronics Engineers Inc.. All rights reserved.
Publication Title
IEEE Open Journal of Intelligent Transportation Systems
Publication Date
2026
ISSN
2687-7813
DOI
10.1109/OJITS.2026.3664301
Keywords
attack forecasting, CAN bus, cybersecurity, graph neural networks, intelligent transportation systems, spatio-temporal modeling, vehicular networks
Repository Citation
Amin, Md Al; Ahsan, Mohammad Shafat; Maua, Jannatul; Eva, Arifa Akter; Mridha, M.F.; and Hossen, Md. Jakir, "Look-Ahead Cyber-Threat Forecasting for Connected and Automated Transport: A Spatio-Temporal Graph Learning Approach" (2026). Student Publications [Scholarly]. 85.
https://commons.clarku.edu/student_publications/85
Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International License.
Copyright Conditions
Al Amin, M., Ahsan, M. S., Maua, J., Eva, A. A., Mridha, M. F., & Hossen, M. J. (2026). Look-Ahead Cyber-Threat Forecasting for Connected and Automated Transport: A Spatio-Temporal Graph Learning Approach. IEEE Open Journal of Intelligent Transportation Systems.
