{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,22]],"date-time":"2026-02-22T08:01:52Z","timestamp":1771747312322,"version":"3.50.1"},"reference-count":36,"publisher":"Springer Science and Business Media LLC","issue":"4","license":[{"start":{"date-parts":[[2026,2,22]],"date-time":"2026-02-22T00:00:00Z","timestamp":1771718400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,2,22]],"date-time":"2026-02-22T00:00:00Z","timestamp":1771718400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"name":"Changsha Automobile Innovation Research Institute Free Exploration Program","award":["CAIRIZT20220104"],"award-info":[{"award-number":["CAIRIZT20220104"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Supercomput"],"DOI":"10.1007\/s11227-026-08325-8","type":"journal-article","created":{"date-parts":[[2026,2,22]],"date-time":"2026-02-22T07:41:36Z","timestamp":1771746096000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Online clustering-based unsupervised intrusion detection system for in-vehicle networks"],"prefix":"10.1007","volume":"82","author":[{"given":"Wentao","family":"Wang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Guihe","family":"Qin","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yutao","family":"Bie","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yanhua","family":"Liang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yingqing","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiang","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,2,22]]},"reference":[{"key":"8325_CR1","doi-asserted-by":"publisher","unstructured":"Song HM Kim HR Kim HK (2016) Intrusion detection system based on the analysis of time intervals of can messages for in-vehicle network. In: 2016 International Conference on Information Networking (ICOIN), pp 63\u201368. https:\/\/doi.org\/10.1109\/ICOIN.2016.7427089","DOI":"10.1109\/ICOIN.2016.7427089"},{"key":"8325_CR2","unstructured":"HPL SC (2002) Introduction to the controller area network (can). Application Report SLOA101, pp 1\u201317"},{"key":"8325_CR3","doi-asserted-by":"publisher","first-page":"4133","DOI":"10.1109\/TIFS.2021.3098162","volume":"16","author":"M Jedh","year":"2021","unstructured":"Jedh M, Ben Othmane L, Ahmed N, Bhargava B (2021) Detection of message injection attacks onto the can bus using similarities of successive messages-sequence graphs. IEEE Trans Inf Forensics Secur 16:4133\u20134146. https:\/\/doi.org\/10.1109\/TIFS.2021.3098162","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"8325_CR4","doi-asserted-by":"publisher","DOI":"10.1016\/j.adhoc.2019.101974","volume":"95","author":"J Zhang","year":"2019","unstructured":"Zhang J, Li F, Zhang H, Li R, Li Y (2019) Intrusion detection system using deep learning for in-vehicle security. Ad Hoc Netw 95:101974. https:\/\/doi.org\/10.1016\/j.adhoc.2019.101974","journal-title":"Ad Hoc Netw"},{"key":"8325_CR5","doi-asserted-by":"publisher","unstructured":"Desta AK, Ohira S, Arai I, Fujikawa K (2020) Id sequence analysis for intrusion detection in the can bus using long short term memory networks. In: 2020 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops), pp 1\u20136. https:\/\/doi.org\/10.1109\/PerComWorkshops48775.2020.9156250","DOI":"10.1109\/PerComWorkshops48775.2020.9156250"},{"issue":"11","key":"8325_CR6","doi-asserted-by":"publisher","first-page":"3698","DOI":"10.1109\/TCAD.2020.3012749","volume":"39","author":"VK Kukkala","year":"2020","unstructured":"Kukkala VK, Thiruloga SV, Pasricha S (2020) Indra: intrusion detection using recurrent autoencoders in automotive embedded systems. IEEE Trans Comput Aided Des Integr Circuits Syst 39(11):3698\u20133710. https:\/\/doi.org\/10.1109\/TCAD.2020.3012749","journal-title":"IEEE Trans Comput Aided Des Integr Circuits Syst"},{"issue":"11","key":"8325_CR7","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3570954","volume":"55","author":"S Rajapaksha","year":"2023","unstructured":"Rajapaksha S, Kalutarage H, Al-Kadri MO, Petrovski A, Madzudzo G, Cheah M (2023) Ai-based intrusion detection systems for in-vehicle networks: a survey. ACM Comput Surv 55(11):1. https:\/\/doi.org\/10.1145\/3570954","journal-title":"ACM Comput Surv"},{"key":"8325_CR8","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2023.103570","volume":"77","author":"S Rajapaksha","year":"2023","unstructured":"Rajapaksha S, Kalutarage H, Al-Kadri MO, Petrovski A, Madzudzo G (2023) Beyond vanilla: improved autoencoder-based ensemble in-vehicle intrusion detection system. J Inf Secur Appl 77:103570. https:\/\/doi.org\/10.1016\/j.jisa.2023.103570","journal-title":"J Inf Secur Appl"},{"issue":"6","key":"8325_CR9","doi-asserted-by":"publisher","first-page":"5112","DOI":"10.1109\/TIE.2019.2924870","volume":"67","author":"M Al-Saud","year":"2020","unstructured":"Al-Saud M, Eltamaly AM, Mohamed MA, Kavousi-Fard A (2020) An intelligent data-driven model to secure intravehicle communications based on machine learning. IEEE Trans Indus Electron 67(6):5112\u20135119. https:\/\/doi.org\/10.1109\/TIE.2019.2924870","journal-title":"IEEE Trans Indus Electron"},{"key":"8325_CR10","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2023.111235","volume":"284","author":"MY Iqbal Basheer","year":"2024","unstructured":"Iqbal Basheer MY, Mohd Ali A, Abdul Hamid NH, Mohd Ariffin MA, Osman R, Nordin S, Gu X (2024) Autonomous anomaly detection for streaming data. Knowl Based Syst 284:111235. https:\/\/doi.org\/10.1016\/j.knosys.2023.111235","journal-title":"Knowl Based Syst"},{"issue":"10","key":"8325_CR11","doi-asserted-by":"publisher","first-page":"10880","DOI":"10.1109\/TVT.2021.3106940","volume":"70","author":"H Sun","year":"2021","unstructured":"Sun H, Chen M, Weng J, Liu Z, Geng G (2021) Anomaly detection for in-vehicle network using CNN-LSTM with attention mechanism. IEEE Trans Veh Technol 70(10):10880\u201310893. https:\/\/doi.org\/10.1109\/TVT.2021.3106940","journal-title":"IEEE Trans Veh Technol"},{"issue":"7","key":"8325_CR12","doi-asserted-by":"publisher","first-page":"6123","DOI":"10.1109\/TITS.2021.3078740","volume":"23","author":"HJ Jo","year":"2022","unstructured":"Jo HJ, Choi W (2022) A survey of attacks on controller area networks and corresponding countermeasures. IEEE Trans Intell Transp Syst 23(7):6123\u20136141. https:\/\/doi.org\/10.1109\/TITS.2021.3078740","journal-title":"IEEE Trans Intell Transp Syst"},{"key":"8325_CR13","doi-asserted-by":"publisher","unstructured":"Koscher K, Czeskis A, Roesner F, Patel S, Kohno T, Checkoway S, McCoy D, Kantor B, Anderson D, Shacham H, Savage S (2010) Experimental security analysis of a modern automobile. In: 2010 IEEE Symposium on Security and Privacy, pp 447\u2013462. https:\/\/doi.org\/10.1109\/SP.2010.34","DOI":"10.1109\/SP.2010.34"},{"key":"8325_CR14","unstructured":"Wen H, Chen QA, Lin Z (2020) Plug-N-Pwned: comprehensive vulnerability analysis of OBD-II dongles as a new Over-the-Air attack surface in automotive IoT. In: 29th USENIX Security Symposium (USENIX Security 20), USENIX Association, Berkeley, CA, USA, pp 949\u2013965. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/wen"},{"key":"8325_CR15","doi-asserted-by":"crossref","unstructured":"Wen H, Zhao Q Chen QA, Lin Z (2020) Automated cross-platform reverse engineering of can bus commands from mobile apps. In: Proceedings 2020 Network and Distributed System Security Symposium (NDSS\u201920)","DOI":"10.14722\/ndss.2020.24231"},{"key":"8325_CR16","doi-asserted-by":"publisher","first-page":"91","DOI":"10.4271\/11-01-02-0005","volume":"1","author":"J D\u00fcrrwang","year":"2018","unstructured":"D\u00fcrrwang J, Braun J, Rumez M, Kriesten R, Pretschner A (2018) Enhancement of automotive penetration testing with threat analyses results. SAE Int J Transp Cybersecur Privacy 1:91\u2013112","journal-title":"SAE Int J Transp Cybersecur Privacy"},{"key":"8325_CR17","unstructured":"Checkoway S, McCoy D, Kantor B, Anderson D, Shacham H, Savage S, Koscher K, Czeskis A, Roesner F, Kohno T (2011) Comprehensive experimental analyses of automotive attack surfaces. In: 20th USENIX Security Symposium (USENIX Security 11). USENIX Association, San Francisco, CA . https:\/\/www.usenix.org\/conference\/usenix-security-11\/comprehensive-experimental-analyses-automotive-attack-surfaces"},{"key":"8325_CR18","unstructured":"Miller C (2015) Remote exploitation of an unaltered passenger vehicle. Black Hat USA"},{"issue":"6","key":"8325_CR19","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1371\/journal.pone.0155781","volume":"11","author":"M-J Kang","year":"2016","unstructured":"Kang M-J, Kang J-W (2016) Intrusion detection system using deep neural network for in-vehicle network security. PLoS ONE 11(6):1\u201317. https:\/\/doi.org\/10.1371\/journal.pone.0155781","journal-title":"PLoS ONE"},{"issue":"9","key":"8325_CR20","doi-asserted-by":"publisher","first-page":"16833","DOI":"10.1109\/TITS.2021.3113638","volume":"23","author":"Y He","year":"2022","unstructured":"He Y, Jia Z, Hu M, Cui C, Cheng Y, Yang Y (2022) The hybrid similar neighborhood robust factorization machine model for can bus intrusion detection in the in-vehicle network. IEEE Trans Intell Transp Syst 23(9):16833\u201316841. https:\/\/doi.org\/10.1109\/TITS.2021.3113638","journal-title":"IEEE Trans Intell Transp Syst"},{"key":"8325_CR21","doi-asserted-by":"publisher","unstructured":"Thiruloga SV, Kukkala VK, Pasricha S (2022) Tenet: temporal CNN with attention for anomaly detection in automotive cyber-physical systems. In: 2022 27th Asia and South Pacific Design Automation Conference (ASP-DAC), pp 326\u2013331. https:\/\/doi.org\/10.1109\/ASP-DAC52403.2022.9712524","DOI":"10.1109\/ASP-DAC52403.2022.9712524"},{"key":"8325_CR22","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2021.107048","volume":"91","author":"A Tomlinson","year":"2021","unstructured":"Tomlinson A, Bryans J, Shaikh SA (2021) Using internal context to detect automotive controller area network attacks. Comput Electr Eng 91:107048. https:\/\/doi.org\/10.1016\/j.compeleceng.2021.107048","journal-title":"Comput Electr Eng"},{"issue":"7","key":"8325_CR23","doi-asserted-by":"publisher","first-page":"4478","DOI":"10.1109\/TITS.2020.3015143","volume":"22","author":"A Kavousi-Fard","year":"2021","unstructured":"Kavousi-Fard A, Dabbaghjamanesh M, Jin T, Su W, Roustaei M (2021) An evolutionary deep learning-based anomaly detection model for securing vehicles. IEEE Trans Intell Transp Syst 22(7):4478\u20134486. https:\/\/doi.org\/10.1109\/TITS.2020.3015143","journal-title":"IEEE Trans Intell Transp Syst"},{"issue":"3","key":"8325_CR24","doi-asserted-by":"publisher","first-page":"1445","DOI":"10.1109\/COMST.2023.3264928","volume":"25","author":"A Buscemi","year":"2023","unstructured":"Buscemi A, Turcanu I, Castignani G, Panchenko A, Engel T, Shin KG (2023) A survey on controller area network reverse engineering. IEEE Commun Surv Tutor 25(3):1445\u20131481. https:\/\/doi.org\/10.1109\/COMST.2023.3264928","journal-title":"IEEE Commun Surv Tutor"},{"key":"8325_CR25","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2020.114066","volume":"166","author":"BI Kwak","year":"2021","unstructured":"Kwak BI, Han ML, Kim HK (2021) Cosine similarity based anomaly detection methodology for the can bus. Expert Syst Appl 166:114066. https:\/\/doi.org\/10.1016\/j.eswa.2020.114066","journal-title":"Expert Syst Appl"},{"issue":"2","key":"8325_CR26","doi-asserted-by":"publisher","first-page":"1185","DOI":"10.1109\/TII.2022.3202539","volume":"19","author":"Z Yu","year":"2023","unstructured":"Yu Z, Liu Y, Xie G, Li R, Liu S, Yang LT (2023) Tce-ids: time interval conditional entropy- based intrusion detection system for automotive controller area networks. IEEE Trans Indus Inf 19(2):1185\u20131195. https:\/\/doi.org\/10.1109\/TII.2022.3202539","journal-title":"IEEE Trans Indus Inf"},{"key":"8325_CR27","doi-asserted-by":"publisher","unstructured":"Gu X, Angelov P (2017) Autonomous anomaly detection. In: 2017 Evolving and Adaptive Intelligent Systems (EAIS), pp 1\u20138. https:\/\/doi.org\/10.1109\/EAIS.2017.7954831","DOI":"10.1109\/EAIS.2017.7954831"},{"key":"8325_CR28","doi-asserted-by":"publisher","DOI":"10.1016\/j.vehcom.2019.100198","volume":"21","author":"HM Song","year":"2020","unstructured":"Song HM, Woo J, Kim HK (2020) In-vehicle network intrusion detection using deep convolutional neural network. Veh Commun 21:100198. https:\/\/doi.org\/10.1016\/j.vehcom.2019.100198","journal-title":"Veh Commun"},{"key":"8325_CR29","doi-asserted-by":"publisher","first-page":"52","DOI":"10.1016\/j.vehcom.2018.09.004","volume":"14","author":"ML Han","year":"2018","unstructured":"Han ML, Kwak BI, Kim HK (2018) Anomaly intrusion detection method for vehicular networks based on survival analysis. Veh Commun 14:52\u201363. https:\/\/doi.org\/10.1016\/j.vehcom.2018.09.004","journal-title":"Veh Commun"},{"key":"8325_CR30","doi-asserted-by":"publisher","first-page":"266","DOI":"10.1016\/j.future.2022.10.020","volume":"140","author":"P Cheng","year":"2023","unstructured":"Cheng P, Han M, Liu G (2023) Desc-ids: towards an efficient real-time automotive intrusion detection system based on deep evolving stream clustering. Futur Gener Comput Syst 140:266\u2013281. https:\/\/doi.org\/10.1016\/j.future.2022.10.020","journal-title":"Futur Gener Comput Syst"},{"issue":"13","key":"8325_CR31","doi-asserted-by":"publisher","first-page":"1","DOI":"10.3390\/electronics14132572","volume":"14","author":"Y Cai","year":"2025","unstructured":"Cai Y, Zuo J, Fan M, Zhao C, Lu Y (2025) An intrusion detection system for the can bus based on locality-sensitive hashing. Electronics 14(13):1. https:\/\/doi.org\/10.3390\/electronics14132572","journal-title":"Electronics"},{"issue":"7","key":"8325_CR32","doi-asserted-by":"publisher","first-page":"1","DOI":"10.3390\/fi12070119","volume":"12","author":"VS Barletta","year":"2020","unstructured":"Barletta VS, Caivano D, Nannavecchia A, Scalera M (2020) Intrusion detection for in-vehicle communication networks: an unsupervised kohonen som approach. Future Internet 12(7):1. https:\/\/doi.org\/10.3390\/fi12070119","journal-title":"Future Internet"},{"issue":"2","key":"8325_CR33","doi-asserted-by":"publisher","first-page":"1098","DOI":"10.1109\/TVT.2021.3051026","volume":"70","author":"HM Song","year":"2021","unstructured":"Song HM, Kim HK (2021) Self-supervised anomaly detection for in-vehicle network using noised pseudo normal data. IEEE Trans Veh Technol 70(2):1098\u20131108. https:\/\/doi.org\/10.1109\/TVT.2021.3051026","journal-title":"IEEE Trans Veh Technol"},{"key":"8325_CR34","doi-asserted-by":"publisher","unstructured":"Taylor A, Japkowicz N, Leblanc S (2015) Frequency-based anomaly detection for the automotive can bus. In: 2015 World Congress on Industrial Control Systems Security (WCICSS), pp 45\u201349. https:\/\/doi.org\/10.1109\/WCICSS.2015.7420322","DOI":"10.1109\/WCICSS.2015.7420322"},{"issue":"9","key":"8325_CR35","doi-asserted-by":"publisher","first-page":"1","DOI":"10.3390\/app8091468","volume":"8","author":"T Amarbayasgalan","year":"2018","unstructured":"Amarbayasgalan T, Jargalsaikhan B, Ryu KH (2018) Unsupervised novelty detection using deep autoencoders with density based clustering. Appl Sci 8(9):1. https:\/\/doi.org\/10.3390\/app8091468","journal-title":"Appl Sci"},{"issue":"1","key":"8325_CR36","doi-asserted-by":"publisher","first-page":"616","DOI":"10.1109\/JIOT.2021.3084796","volume":"9","author":"L Yang","year":"2022","unstructured":"Yang L, Moubayed A, Shami A (2022) Mth-ids: a multitiered hybrid intrusion detection system for internet of vehicles. IEEE Internet Things J 9(1):616\u2013632. https:\/\/doi.org\/10.1109\/JIOT.2021.3084796","journal-title":"IEEE Internet Things J"}],"container-title":["The Journal of Supercomputing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11227-026-08325-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11227-026-08325-8","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11227-026-08325-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,22]],"date-time":"2026-02-22T07:41:37Z","timestamp":1771746097000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11227-026-08325-8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2,22]]},"references-count":36,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2026,3]]}},"alternative-id":["8325"],"URL":"https:\/\/doi.org\/10.1007\/s11227-026-08325-8","relation":{},"ISSN":["1573-0484"],"issn-type":[{"value":"1573-0484","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,2,22]]},"assertion":[{"value":"6 August 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"10 February 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"22 February 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"193"}}