{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,30]],"date-time":"2026-07-30T10:33:43Z","timestamp":1785407623735,"version":"3.56.0"},"reference-count":31,"publisher":"MDPI AG","issue":"15","license":[{"start":{"date-parts":[[2026,7,27]],"date-time":"2026-07-27T00:00:00Z","timestamp":1785110400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62221001"],"award-info":[{"award-number":["62221001"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"award":["62221001"],"award-info":[{"award-number":["62221001"]}],"id":[{"id":"https:\/\/ror.org\/01h0zpd94","id-type":"ROR","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["2022JBQY004"],"award-info":[{"award-number":["2022JBQY004"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"name":"The Science and Technology Project of Jiangxi Provincial Department of Transportation","award":["2024YB042"],"award-info":[{"award-number":["2024YB042"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>As intelligent connected vehicles (ICVs) integrate advanced driver-assistance systems (ADAS) and autonomous-driving functions, CAN bus attacks have become more diverse in mechanism and safety impact. Beyond flooding or direct command injection, state-inducing spoofing attacks inject falsified CAN frames to manipulate vehicle-state signals. Rather than directly controlling vehicle behavior, they mislead ADAS state estimation, potentially triggering inappropriate control responses and threatening driving safety. Existing intrusion detection methods mainly target conventional CAN attacks and limited operating states, leaving limited detection generalization in complex attack scenarios. Accordingly, this paper proposes MTFF, a multi-scale temporal feature fusion framework for CAN intrusion detection. MTFF builds two complementary CAN streams: an intra-ID kinematic sequence capturing short-term state continuity under the same identifier and an inter-ID scheduling sequence capturing timing relationships among neighboring frames, thereby characterizing CAN traffic from state-continuity and scheduling-relation perspectives. Multi-scale 1-D convolutions extract local temporal features, while positional self-attention and symmetric cross-attention model long-range dependencies and fuse the streams to detect contextual temporal and state inconsistencies. Experiments on multi-vehicle CAN datasets covering representative operating states show that, in the most challenging setting, MTFF achieves F1-scores above 0.94 on two production vehicles, with per-frame latency below 0.006 ms.<\/jats:p>","DOI":"10.3390\/s26154758","type":"journal-article","created":{"date-parts":[[2026,7,27]],"date-time":"2026-07-27T08:15:56Z","timestamp":1785140156000},"page":"4758","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Defending Against State-Inducing Spoofing Attacks in Intelligent Connected Vehicles: A Real-Time Temporal Feature Fusion Framework"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9781-7193","authenticated-orcid":false,"given":"Chen","family":"Dong","sequence":"first","affiliation":[{"name":"School of Electronic and Information Engineering, Beijing Jiaotong University (BJTU), Beijing 100044, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4733-0125","authenticated-orcid":false,"given":"Hao","family":"Wu","sequence":"additional","affiliation":[{"name":"School of Electronic and Information Engineering, Beijing Jiaotong University (BJTU), Beijing 100044, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5673-4757","authenticated-orcid":false,"given":"Cheng","family":"Li","sequence":"additional","affiliation":[{"name":"School of Electronic and Information Engineering, Beijing Jiaotong University (BJTU), Beijing 100044, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,7,27]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"703","DOI":"10.1109\/TASE.2025.3639251","article-title":"Integrating Torque Vectoring and Active Suspension Systems Using a Game Theory-Based Control Framework","volume":"23","author":"Liang","year":"2026","journal-title":"IEEE Trans. Autom. Sci. Eng."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"9230","DOI":"10.1109\/TSMC.2025.3615943","article-title":"Robust Game-Theory Control for All-Wheel Steering to Enhance Vehicle Handling Stability Performance","volume":"55","author":"Liang","year":"2025","journal-title":"IEEE Trans. Syst. Man Cybern. Syst."},{"key":"ref_3","unstructured":"(2026, April 10). 360 Research Reports. Connected Car Market Size, Share, Trend | CAGR of 16.35%. Available online: https:\/\/www.360researchreports.com\/market-reports\/connected-car-market-210905."},{"key":"ref_4","unstructured":"(2026, April 10). Fortune Business Insights. Connected Car Market Size, Trends, Report [2034]. Available online: https:\/\/www.fortunebusinessinsights.com\/industry-reports\/connected-car-market-101606."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"5909","DOI":"10.1109\/TII.2026.3673218","article-title":"Fusion Filtering for RIS-Assisted Vehicle Localization with Unknown Inputs: A Privacy-Preserving Output-Mask Strategy","volume":"22","author":"Zhu","year":"2026","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_6","unstructured":"Miller, C., and Valasek, C. (2015, January 1\u20136). Remote exploitation of an unaltered passenger vehicle. Proceedings of the Black Hat USA, Las Vegas, NV, USA."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"825","DOI":"10.1109\/TCE.2023.3297965","article-title":"Cyber Attacks via Consumer Electronics: Studying the Threat of Covert Malware in Smart and Autonomous Vehicles","volume":"69","author":"Farivar","year":"2023","journal-title":"IEEE Trans. Consum. Electron."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"3107","DOI":"10.1109\/TIFS.2020.2983285","article-title":"An Efficient Authentication Scheme for Intra-Vehicular Controller Area Network","volume":"15","author":"Palaniswamy","year":"2020","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_9","first-page":"14756","article-title":"Lightweight encryption and authentication for controller area network of autonomous vehicles","volume":"72","author":"Cui","year":"2023","journal-title":"IEEE Trans. Veh. Technol."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"13916","DOI":"10.1109\/TVT.2020.3016352","article-title":"CNN-Based Adaptive Source Node Identifier for Controller Area Network (CAN)","volume":"69","author":"Jeong","year":"2020","journal-title":"IEEE Trans. Veh. Technol."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"1566","DOI":"10.1109\/TIFS.2023.3240291","article-title":"Federated Graph Neural Network for Fast Anomaly Detection in Controller Area Networks","volume":"18","author":"Zhang","year":"2023","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"76","DOI":"10.1109\/MNET.2024.3367303","article-title":"Open World Intrusion Detection: An Open Set Recognition Method for CAN Bus in Intelligent Connected Vehicles","volume":"38","author":"Du","year":"2024","journal-title":"IEEE Netw."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"1484","DOI":"10.1109\/TVT.2019.2961344","article-title":"SAIDuCANT: Specification-Based Automotive Intrusion Detection Using Controller Area Network (CAN) Timing","volume":"69","author":"Olufowobi","year":"2020","journal-title":"IEEE Trans. Veh. Technol."},{"key":"ref_14","first-page":"306","article-title":"Supervised and Unsupervised Intrusion Detection Based on CAN Message Frequencies for In-vehicle Network","volume":"26","author":"Kuwahara","year":"2018","journal-title":"J. Inf. Process."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Stabili, D., Marchetti, M., and Colajanni, M. (2017, January 20\u201322). Detecting attacks to internal vehicle networks through Hamming distance. Proceedings of the 2017 AEIT International Annual Conference, Cagliari, Italy.","DOI":"10.23919\/AEIT.2017.8240550"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"113","DOI":"10.1109\/MNET.2024.3390937","article-title":"Intrusion Detection for Intelligent Connected Vehicles Based on Bidirectional Temporal Convolutional Network","volume":"38","author":"Mei","year":"2024","journal-title":"IEEE Netw."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"45233","DOI":"10.1109\/ACCESS.2018.2865169","article-title":"Sliding Window Optimized Information Entropy Analysis Method for Intrusion Detection on In-Vehicle Networks","volume":"6","author":"Wu","year":"2018","journal-title":"IEEE Access"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"2941","DOI":"10.1109\/TIFS.2021.3069171","article-title":"Event-Triggered Interval-Based Anomaly Detection and Attack Identification Methods for an In-Vehicle Network","volume":"16","author":"Han","year":"2021","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"1185","DOI":"10.1109\/TII.2022.3202539","article-title":"TCE-IDS: Time Interval Conditional Entropy- Based Intrusion Detection System for Automotive Controller Area Networks","volume":"19","author":"Yu","year":"2023","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_20","first-page":"43","article-title":"Field classification, modeling and anomaly detection in unknown CAN bus networks","volume":"9","author":"Markovitz","year":"2017","journal-title":"Veh. Commun."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"1913","DOI":"10.1109\/TNSM.2020.3038991","article-title":"CANnolo: An Anomaly Detection System Based on LSTM Autoencoders for Controller Area Network","volume":"18","author":"Longari","year":"2021","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"136243","DOI":"10.1109\/ACCESS.2021.3117038","article-title":"Anomaly Detection in Vehicular CAN Bus Using Message Identifier Sequences","volume":"9","author":"Donmez","year":"2021","journal-title":"IEEE Access"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Marchetti, M., and Stabili, D. (2017). Anomaly detection of CAN bus messages through analysis of ID sequences. Proceedings of the 2017 IEEE Intelligent Vehicles Symposium (IV), IEEE.","DOI":"10.1109\/IVS.2017.7995934"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"10880","DOI":"10.1109\/TVT.2021.3106940","article-title":"Anomaly detection for In-Vehicle network using CNN-LSTM with attention mechanism","volume":"70","author":"Sun","year":"2021","journal-title":"IEEE Trans. Veh. Technol."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"4467","DOI":"10.1109\/TITS.2021.3055351","article-title":"Threat Analysis for Automotive CAN Networks: A GAN Model-Based Intrusion Detection Technique","volume":"22","author":"Xie","year":"2021","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"2150007","DOI":"10.1142\/S0218126621500079","article-title":"Intrusion detection for in-vehicle network by using single GAN in connected vehicles","volume":"30","author":"Yang","year":"2021","journal-title":"J. Circuits Syst. Comput."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"150","DOI":"10.1109\/JSYST.2023.3337091","article-title":"A Novel Feature Extraction Framework Using Graph Node Attention Network for In-Vehicle Networks Intrusion Detection","volume":"18","author":"Xiao","year":"2024","journal-title":"IEEE Syst. J."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"1909","DOI":"10.1109\/TVT.2024.3402366","article-title":"IoV-BERT-IDS: Hybrid Network Intrusion Detection System in IoV Using Large Language Models","volume":"74","author":"Fu","year":"2025","journal-title":"IEEE Trans. Veh. Technol."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"4740","DOI":"10.1109\/TCE.2026.3665820","article-title":"A Locality-Enhanced Differential Attention Network for Robust Anomaly Detection in Consumer Vehicles","volume":"72","author":"Xu","year":"2026","journal-title":"IEEE Trans. Consum. Electron."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Taylor, A., Leblanc, S., and Japkowicz, N. (2016). Anomaly Detection in Automobile Control Network Data with Long Short-Term Memory Networks. Proceedings of the 2016 IEEE International Conference on Data Science and Advanced Analytics (DSAA), IEEE.","DOI":"10.1109\/DSAA.2016.20"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"25469","DOI":"10.1109\/TITS.2021.3105834","article-title":"An enhanced multi-stage deep learning framework for detecting malicious activities from autonomous vehicles","volume":"23","author":"Khan","year":"2021","journal-title":"IEEE Trans. Intell. Transp. Syst."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/15\/4758\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,27]],"date-time":"2026-07-27T08:19:40Z","timestamp":1785140380000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/15\/4758"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,27]]},"references-count":31,"journal-issue":{"issue":"15","published-online":{"date-parts":[[2026,8]]}},"alternative-id":["s26154758"],"URL":"https:\/\/doi.org\/10.3390\/s26154758","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,27]]}}}