A Locality-Enhanced Differential Attention Network for Robust Anomaly Detection in Consumer Vehicles

Modern consumer vehicles rely on time series sensor data to operate safely. However, this reliance creates a critical vulnerability, as cyberattacks can directly compromise navigation and safety functions, thereby endangering drivers and passengers. Existing security methods often perform poorly in real-world driving environments. They struggle to distinguish malicious attacks from benign sensor noise, which reduces their reliability. To address this consumer safety challenge, we propose a new AI-based security framework called the Locality-Enhanced Differential Attention Network (LEDANet). Specifically, a dual-layer stacked Long Short-Term Memory (LSTM) network is designed to capture long-term dependency features with high quality. Based on this design, a differential anomaly attention mechanism is introduced. It includes the Local-Focused Dependency (LFD) and Differentially Enhanced Dependency (DED) modules, which model local dependency relationships and amplify attention differences between normal and anomalous patterns, respectively. In addition, a comprehensive anomaly scoring framework is developed. This framework combines dynamic weighting and region-sensitive scoring strategies to improve detection performance. Experimental results show that LEDANet achieves an average F1-score of 98.76% across four attack detection tasks on the F2MD simulation platform, significantly outperforming existing methods. Moreover, LEDANet demonstrates strong robustness to noise on cross-domain datasets, including the real-world vehicle scenario dataset SPMD and other datasets such as MSL. These results indicate that LEDANet provides an effective solution for anomaly detection in high-noise IoV environments.