CAN-TEMPO: Unsupervised CAN Bus Intrusion Detection via Temporal Multi-Period Oscillation Encoding

The security of Controller Area Network (CAN) systems is critical for modern automotive safety, as their lack of built-in security mechanisms makes them vulnerable to cyberattacks. In this work, we propose CAN-TEMPO, an unsupervised anomaly detection framework that explicitly models the multi-periodic structure of CAN traffic. The proposed approach leverages a Temporal Multi-Periodic Oscillation (TEMPO) block, which uses frequency-domain analysis to transform one-dimensional CAN sequences into multi-scale two-dimensional representations. This design enables the model to capture both intra-period correlations and inter-period temporal variations. We evaluate CAN-TEMPO on multiple public CAN intrusion detection benchmarks under diverse attack scenarios and generalization settings. Experimental results show that CAN-TEMPO consistently outperforms state-of-the-art methods in terms of AUC-ROC and F1-score, while maintaining lower false positive rates and improved robustness across different vehicles and attack types. These findings demonstrate that explicitly modeling periodic structures enables more reliable and generalizable anomaly detection in automotive networks.