Defending Against State-Inducing Spoofing Attacks in Intelligent Connected Vehicles: A Real-Time Temporal Feature Fusion Framework

Digital Twin-Based Intrusion Detection for Vehicle Powertrain CAN Bus Systems

A DT-based IDS that jointly models physical relationships among decoded powertrain signals and identifies attacks through residuals between predicted and observed behavior shows promise for detecting stealthy payload-level CAN attacks that preserve normal communication patterns, supporting behavior-based cybersecurity for connected and automated vehicles.

ASDS: Adaptive Stackelberg Defense Scheme for Cyber-Physical Intrusion Detection in Cloudified Transportation Systems

Cloud-enabled Intelligent Transportation Systems (ITS) leverage Vehicle-to-Everything (V2X) communications to support scalable data processing and real-time traffic management. However, this integration significantly expands the cyber-physical attack surface. Conventional intrusion detection systems (IDSs) that rely on static signatures or offline-trained models are often ill-suited to counter adaptive attackers. This paper presents the Adaptive Stackelberg Defense Scheme (ASDS), a proactive intrusion detection system that models attacker-defender interactions as a hierarchical Bayesian Stackelberg game with incomplete information. ASDS employs Bayesian filtering to jointly estimate system states and attacker types in real time, enabling adaptive defense strategies. Evaluated against False Data Injection (FDI), Denial-of-Service (DoS), and spoofing attacks, ASDS achieves detection accuracy between 94% and 98%, false positive rates ranging from 0.02 to 0.08, and response latency under 50 ms. These results underscore its effectiveness in securing cloud-enabled ITS environments.

Behavioral Residualization for Unsupervised Intrusion Detection in Automotive CAN Networks

Per-ID behavioral residualization is presented, a CAN-specific representation that extracts fourteen temporal, protocol, and payload features from sliding windows and residualizes them against each arbitration ID's normal baseline, which improves mean F1 in the majority of evaluations.

Resilient control and Markov-enhanced hybrid multi-feature intrusion detection for cyber-physical wind farms under SCADA delays and coordinated cyber-attacks

Simulating Cyber Attacks and Countermeasures in Vehicular Ad-Hoc Networks Using Cyber Operations Research Gym (CybORG)

Vehicular Ad-Hoc Networks (VANETs) enable realtime communication for safety-critical applications including collision avoidance and traffic control. Their decentralized, dynamic architecture, however, makes them vulnerable to multiple attack classes, including Sybil, spoofing, Denial-of-Service (DoS), and other cyber threats. Existing defenses typically address cyber and physical layers independently, limiting their ability to capture the interplay between mobility patterns and attack propagation. This paper presents a cyber-physical simulation framework integrating vehicular mobility with the CybORG environment for multi-class attack mitigation. A Road Side Unit (RSU) acts as the infrastructure-based defender, monitoring vehicle behavior, maintaining trust scores, and executing defense actions via a Dueling Double Deep Q-Network with Prioritized Experience Replay (D3QN-PER). The agent learns optimal policies through environment interaction rather than static labeled data. Evaluation against two unsupervised baselines, Exponentially Weighted Moving Average (EWMA) and Trust-Gated Isolation Forest, demonstrates perfect detection performance (Recall = 100%, $\mathbf{F} \mathbf{1} \boldsymbol{=} \mathbf{1. 0 0 0 0})$ with zero false positives and zero false negatives, compared to 95.12% recall (EWMA) and 84.95% recall (Isolation Forest). The framework handles up to six concurrent attackers within the RSU's 200 m range with sub-millisecond latency, establishing a foundation for intelligent, adaptive security in vehicular networks.

Adaptive utility-aware event-triggered reinforcement learning for hybrid attack scheduling against remote state estimation.

Remote state estimation plays an important role in connected vehicle platoons, industrial automation systems, and other networked Cyber-Physical Systems (CPSs), where reliable state information is essential for monitoring, feedback control, and decision-making. However, due to the openness and unreliability of wireless communication links, remote estimation systems are vulnerable to eavesdropping and Denial-of-Service (DoS) attacks, which may cause information leakage, packet loss, and estimation performance degradation. This issue becomes more critical in time-varying wireless environments, where channel conditions and attack opportunities evolve dynamically over time, making conventional static or periodic attack models insufficient for characterizing practical security risks. To address this problem, this paper investigates a utility-aware event-triggered reinforcement learning framework for hybrid attack scheduling against remote state estimation over time-varying wireless channels. The attacker can select among eavesdropping, DoS, and silence actions to balance estimation disruption, information acquisition, and attack resource consumption. The hybrid attack scheduling problem is formulated as a partially observable Markov decision process (POMDP), and a utility-aware event-triggered mechanism is designed to activate attack decisions only when the estimated attack utility is sufficiently significant. At the triggered decision instants, a proximal policy optimization (PPO) algorithm is employed to learn an adaptive hybrid attack mode selection policy. The structural properties of the resulting policy are also analyzed theoretically, showing that the optimal belief-space policy has a piecewise constant structure and that the proposed adaptive threshold preserves a monotone triggering property with respect to the attack utility indicator. Simulation results in a connected vehicle platoon scenario demonstrate that, compared with several benchmark methods, the proposed method achieves a better trade-off among remote estimation degradation, attacker-side information acquisition, and energy consumption. These results indicate that the proposed event-triggered reinforcement learning framework can improve the adaptability and resource efficiency of hybrid attack scheduling under time-varying wireless channels. The study also provides useful insights for security vulnerability assessment, resilient estimation design, and defense strategy development for practical remote estimation systems.