ETFIDS: An Entropy-Driven, Time-Frequency Analysis Framework for In-Vehicle CAN Signal Intrusion Detection

In recent years, cyberattacks against automobiles have exposed significant security threats to in-vehicle networks. The vulnerability of communication signals to malicious interference and manipulation can lead to serious system failures or abnormal behavior. The existing in-vehicle network intrusion detection methods do not fully exploit the time-frequency characteristics of controller area network (CAN) signals. This limitation reduces their effectiveness in capturing subtle changes and signal complexity. Based on the above motivation, from the perspective of signal perception, we propose an entropy-driven, time-frequency analysis framework for in-vehicle network intrusion detection. The framework integrates a signal sampler, a frequency-domain detector, and a time-domain detector. The signal sampler, as the system’s front-end module, extracts real-time physical signal data streams from CAN messages. The frequency-domain detector identifies frequency components, detecting high-frequency disturbances and cyclic variations. Meanwhile, the time-domain detector captures instantaneous changes and sudden anomalies. It analyzes signal complexity and anomalies through both stream and block detection. Experimental results demonstrate that the proposed method performs well under various attack scenarios, offering superior detection and real-time performance. It effectively senses multiple signal anomalies, providing a robust intrusion detection solution for modern in-vehicle networks.