## 1 Introduction  
With the rapid development of information and communication technology, connected and automated vehicles (CAVs) are becoming more and more popular in the modern vehicle field. CAVs, with plentiful intelligent in-vehicle sensors and electronic control units (ECUs), are capable of monitoring vehicle states and performing complex functions. All of the ECUs transmit messages with each other to harmonize and control the different components of a modern vehicle via in-vehicle networks [1]. Such networks are connected to external networks by vehicle-to-everything (V2X) technologies [2] to provide advanced vehicle features. Though these rapid improvements of complexity and connectivity in CAVs bring convenience to our daily life, increasing attacks surfacing make CAVs more vulnerable to various cyber-attacks and faults. In addition, the in-vehicle network, the controller area network (CAN) bus, lacks security mechanisms by design, which has made CAVs increasingly attacked targets. Malicious adversaries can implement attacks through the approaches of a physical interface or a remote wireless approach. There have been increasing demonstrated attacks on modern CAVs in recent years, which has attracted wide attention on modern vehicle security. In 2019, [PERSON], and [PERSON] hacked a Tesla Model 3 through its infotainment system [3]. In 2020, a security researcher at Belgian university KU Leuven entered a Tesla Model X and drove the car off by utilizing the Bluetooth vulnerability on its key fob [4]. Several security mechanisms such as encryption technologies [5] and message authentication technologies [6] have been proposed to reduce the security hazards of in-vehicle networks. However, these countermeasures are not always practical for the CAVs environment as they all require modifications of the CAN protocol or hardware equipment and will occupy communication and computation resources [1]. Anomaly detection is considered the effective and practical solution for overcoming such limitations due to its capability of detecting anomalies in an early period and due to the backward compatibility of the existing vehicle systems. For instance, [PERSON] et al. [7] proposed a motion-based intrusion detection system (MIDS) by using time domain information, i.e., modeling the vehicle movement states. [PERSON] et al. [8] utilized the replicator neural network to capture the time domain series features of CAN signals. The optimized network was used to reconstruct the signal, and its difference to the input signal was used to identify anomaly behaviors. In fact, considering the nonstationarity in vehicle sensor signals and environmental noises, some features of the vehicle's normal/abnormal state cannot be captured by time domain-based methods [9], so that there may be a risk of anomalies going undetected when only relying on time domain characteristics. In addition, though deep learning technology (e.g., convolutional neural networks (CNN)) has led to considerable success in two-dimensional visual signals feature exaction, its application for non-image signals, including in the vehicle anomaly behavior detection field, introduces new challenges. A naturally conceivable way is to convert the in-vehicle sensor signal into a two-dimensional form after interception [10]. However, since the raw in-vehicle sensor signals are usually composed of different frequency components and have abundant noise, using the raw data can weaken the learning ability of CNN-based anomaly detection methods [11]. Therefore, there is a great desire for a vehicle anomaly detection method that is capable of providing sufficient time and frequency domain information of the in-vehicle sensor signal and one that has the powerful ability of features extraction to obtain a higher detection accuracy. In this paper, we propose a time-frequency domain features-based vehicle anomaly detection model (CWT-CNN) via the integration of continuous wavelet transform (CWT) and convolutional neural network (CNN) methods.