TDAN: Triplet depth-aware network with multi-domain fusion for unknown attack detection in autonomous vehicles

Deep learning-based anomaly detection methods of autonomous vehicle (AV) are accurate in detecting cyber attacks in predefined attack scenarios, but face challenges in detecting unknown attacks in real-world driving environments. The core difficulty lies in effectively distinguishing unknown attacks from known samples, as current methods relying on feature space differentiation often fail to account for potential overlaps between the distributions of known and unknown samples. To address this critical limitation, a novel Triplet Depth-Aware Network (TDAN) framework is proposed. Specifically, an Enhanced Cross-Attention Triplet Loss (ECAT Loss) is constructed to optimize compactness within classes and separability between classes, and the Multi-Scale Fusion Feed-Forward Network (MSFFN) is introduced to highlight spatial correlation between data points to separate the overlapping features between classes. The Residual Depth-Aware Attention Block (RDAA-block) is designed to fuse shallow and deep features to enhance sensitivity to unknown anomalies while suppressing redundant features. Experiments on a real-world autonomous vehicle platform show TDAN's superiority, achieving 97.51% accuracy in known attack scenarios and outperforming state-of-the-art methods in detecting unknown attacks.