A Hybrid EKF–CUSUM Framework for Real-Time Anomaly Detection in Multi-Sensor Fusion Systems

Abstract

This paper proposes a hybrid model-based anomaly detection framework that integrates the Extended Kalman Filter (EKF) and the Cumulative Sum (CUSUM) algorithm for real-time cyberattack detection in autonomous vehicle sensor networks. The framework utilizes GPS and LiDAR data streams to perform nonlinear state estimation and generate residual signals, which are statistically analyzed for anomaly detection. Unlike data-driven approaches, the proposed method does not rely on prior training and is capable of detecting zero-day attacks through deviation analysis of system behavior. A multi-level detection architecture is introduced, consisting of sensor-level detectors and a fusion-level detector to improve robustness and reduce false alarms. Additionally, a rule-based isolation mechanism is employed to identify compromised sensors using detector consensus. Experimental results demonstrate a detection accuracy of 91.6% and a false positive rate of 6.2%, with low computational overhead suitable for real-time applications. The results highlight the effectiveness of combining model-based estimation with statistical detection for scalable and interpretable cybersecurity solutions in autonomous systems.