To address the difficulty of detecting silent inconsistencies in Train Real-time Data Protocol implementations, we propose TRDP-Guard, an automated protocol consistency checking architecture based on large language model (LLM)-driven semantic analysis. TRDP-Guard extracts structured rules from the IEC 61375 standard, localizes relevant implementation logic via LLM guided program slicing, and performs semantic consistency analysis between rules and code to identify latent deviations. Experiments on real-world TRDP implementations show that TRDP-Guard effectively detects representative defects such as timer mismanagement, PULL/PUSH misuse, and missing field validation, achieving 86.4% precision and 95.0% recall, significantly outperforming existing static analysis tools. Furthermore, we model three classes of consistency breaking attacks timing, scheduling, and semantic confusion attacks and design corresponding defense mechanisms. Simulation results demonstrate that the proposed defenses effectively mitigate protocol inconsistency-induced threats, enhancing the robustness of train communication systems.
Jiewei Du, Bo Ai, Yunlong Lu et al.· IEEE Transactions on Cogniti...· 0 citations
As intelligent connected vehicles (ICVs) integrate advanced driver-assistance systems (ADAS) and autonomous-driving functions, CAN bus attacks have become more diverse in mechanism and safety impact. Beyond flooding or direct command injection, state-inducing spoofing attacks inject falsified CAN frames to manipulate vehicle-state signals. Rather than directly controlling vehicle behavior, they mislead ADAS state estimation, potentially triggering inappropriate control responses and threatening driving safety. Existing intrusion detection methods mainly target conventional CAN attacks and limited operating states, leaving limited detection generalization in complex attack scenarios. Accordingly, this paper proposes MTFF, a multi-scale temporal feature fusion framework for CAN intrusion detection. MTFF builds two complementary CAN streams: an intra-ID kinematic sequence capturing short-term state continuity under the same identifier and an inter-ID scheduling sequence capturing timing relationships among neighboring frames, thereby characterizing CAN traffic from state-continuity and scheduling-relation perspectives. Multi-scale 1-D convolutions extract local temporal features, while positional self-attention and symmetric cross-attention model long-range dependencies and fuse the streams to detect contextual temporal and state inconsistencies. Experiments on multi-vehicle CAN datasets covering representative operating states show that, in the most challenging setting, MTFF achieves F1-scores above 0.94 on two production vehicles, with per-frame latency below 0.006 ms.
Chen Dong, Hao Wu, Cheng Li· Italian National Conference...· 0 citations