Detecting Cyber-Attacks in Connected Vehicles through Context-Aware Multilevel Graph Modeling

The rapid evolution of connected vehicles and Internet of Things (IoT) technologies has significantly increased the complexity of modern automotive systems while simultaneously expanding their attack surface. In particular, the Controller Area Network (CAN-Bus), which enables communication among Electronic Control Units (ECUs), represents a critical component of in-vehicle networks and a potential target for cyber-attacks. The absence of built-in security mechanisms such as authentication and encryption makes CAN-based communication vulnerable to message injection and manipulation attacks. This paper proposes a context-aware intrusion detection approach based on a Multilevel Graph (MuG) representation to identify anomalous behaviors in connected vehicles. The proposed framework integrates data acquisition from the CAN-Bus, semantic context modeling and probabilistic inference mechanisms to analyze relationships between system components and detect abnormal system states. The architecture is organized into four layers - Acquisition, Knowledge, Inference Engine and Application - allowing structured management of data collection, contextual knowledge representation and anomaly detection. To evaluate the effectiveness of the proposed methodology, a case study focused on automotive cybersecurity was developed using the CARLA simulation environment, where multiple attack scenarios were simulated through the injection of malicious CAN messages. The experimental evaluation was conducted on a dataset generated during simulation runs and analyzed using precision, recall and F1-score metrics. The results demonstrate that the proposed multilevel graph-based approach significantly improves the detection of anomalous behaviors, achieving high accuracy in identifying both normal system conditions and simulated attack scenarios. The findings suggest that integrating context-aware modeling with graph-based inference represents a promising direction for enhancing intrusion detection capabilities in connected vehicle systems.