Heterogeneous Multi-link Fusion-enabled Anomaly Detection for Centralized In-Vehicle Network Architectures

With the advancement of connected vehicle technologies, the cybersecurity of in-vehicle networks (IVNs) has gained growing attention. However, the evolution of IVN architectures and the increasing stealthiness of cyber-attacks pose significant challenges to anomaly detection. To this end, a heterogeneous multi-link fusion-enabled anomaly detection system (HMLF-ADS) for centralized IVNs is proposed. In this ADS, a spatio-temporal feature parallel encoder (STFPE) is designed to capture fine-grained dynamic contextual features within each heterogeneous network link. Unlike existing approaches that focus exclusively on intra-link traffic features, a relation graph encoder (RGE) based on the inter-domain information interaction mechanism in centralized IVNs is constructed, enabling the adaptive learning of implicit inter-link correlations, and enhancing the detection of highly stealthy attacks. Real-world experiments have demonstrated its superiority, achieving a 6.10% improvement in detection accuracy over state-of-the-art methods for highly stealthy tampering attacks.