SCIMI: Semantic-Aware Collaborative Intrusion Detection for Multi-domain In-Vehicle Networks

Modern vehicles integrate multiple in-vehicle networks (IVNs), such as Controller Area Network (CAN), Automotive Ethernet, and host systems, to support advanced automation and connectivity. While these networks enable new functionalities, they also expand attack surface across multiple domains. Sophisticated multi-stage attacks exploit these surfaces to propagate covertly, and existing vehicular IDS systems cannot detect them as these attacks only cause minor changes in IVNs. This paper presents SCIMI, a Semantic-aware Collaborative Intrusion detection system for Multi-domain In-vehicle networks, which learns inter-domain causal relationships to identify subtle, coordinated attacks that evade single domain intrusion detection systems. SCIMI aligns asynchronous traffic patterns through a dual window temporal model, extracts semantic features via domain adaptive encoders, and applies cross domain attention to correlate suspicious behaviors. A dataset is also released for collaborative IDS. Experiments show that SCIMI achieves over 99% F1-score with a 17% improvement over state-of-the-art methods, while maintaining low false positive alarms and real time inference efficiency, underscoring its applicability to real time automotive cyber-security.