Heterogeneous Multilink Fusion-Enabled Anomaly Detection for Centralized In-Vehicle Network Architectures

With the advancement of connected vehicle technologies, the cybersecurity of in-vehicle networks (IVNs) has gained growing attention. However, the evolution of IVN architectures and the increasing stealthiness of cyberattacks pose significant challenges to anomaly detection. To this end, a heterogeneous multilink fusion-enabled anomaly detection system (HMLF-ADS) for centralized IVNs is proposed. In this anomaly detection system (ADS), a spatiotemporal feature parallel encoder (STFPE) is designed to capture fine-grained dynamic contextual features within each heterogeneous network link. Unlike existing approaches that focus exclusively on intralink traffic features, a relational graph encoder (RGE) based on the interdomain information interaction mechanism in centralized IVNs is constructed, enabling the adaptive learning of implicit interlink correlations and enhancing the detection of highly stealthy attacks. Real-world experiments have demonstrated its superiority, achieving a 6.10% improvement in detection accuracy over state-of-the-art (SOTA) methods for highly stealthy tampering attacks.