Defending Against State-Inducing Spoofing Attacks in Intelligent Connected Vehicles: A Real-Time Temporal Feature Fusion Framework

As intelligent connected vehicles (ICVs) integrate advanced driver-assistance systems (ADAS) and autonomous-driving functions, CAN bus attacks have become more diverse in mechanism and safety impact. Beyond flooding or direct command injection, state-inducing spoofing attacks inject falsified CAN frames to manipulate vehicle-state signals. Rather than directly controlling vehicle behavior, they mislead ADAS state estimation, potentially triggering inappropriate control responses and threatening driving safety. Existing intrusion detection methods mainly target conventional CAN attacks and limited operating states, leaving limited detection generalization in complex attack scenarios. Accordingly, this paper proposes MTFF, a multi-scale temporal feature fusion framework for CAN intrusion detection. MTFF builds two complementary CAN streams: an intra-ID kinematic sequence capturing short-term state continuity under the same identifier and an inter-ID scheduling sequence capturing timing relationships among neighboring frames, thereby characterizing CAN traffic from state-continuity and scheduling-relation perspectives. Multi-scale 1-D convolutions extract local temporal features, while positional self-attention and symmetric cross-attention model long-range dependencies and fuse the streams to detect contextual temporal and state inconsistencies. Experiments on multi-vehicle CAN datasets covering representative operating states show that, in the most challenging setting, MTFF achieves F1-scores above 0.94 on two production vehicles, with per-frame latency below 0.006 ms.