## 1 Introduction
The anomaly deviation of in-vehicle sensor signals caused by malicious behavior is the key indicator of different attacks or faults occurrence. In order to exploit the characteristics of the deviation and detect anomalies, we used CWT to transform in-vehicle sensor signals into a vehicle state image, i.e., wavelet transform scalogram (CWTS), by calculating the wavelet coefficients. Due to CWT's powerful capability of decomposing a signal in different segments locally, the image features contain more complete time and frequency domain properties of in-vehicle sensor signals so that it can provide more hidden aspects of the vehicle behavior characteristics. We employed the CNN method to learn normal/abnormal vehicle sensor behaviors from the constructed CWTS due to CNN's classification ability of two-dimensional data. CNN extracts features automatically by exploiting the time and frequency characteristics of the in-vehicle sensor data to detect anomaly events with a higher accuracy. The proposed model not only fully exploits the individual advantages of CWT and CNN, but also forms an overall anomaly detection method with more excellent performance due to the integrated configuration. For CWT, the inherent powerful capabilities of signal time-frequency process can provide more complete information for the in-vehicle sensor for anomaly analyses. In addition, CWT converts the raw sensor data into two-dimensional CWTS as the input of the CNN rather than inputting the raw sensor signals; thus, the influence of noise and different frequency components in the vehicle sensor signal can be reduced, which allows for our model to inherit the advantages of deep learning. For CNN, its powerful abilities of feature exaction and classification of two-dimensional signals help build the explicit relationship between CWTS and normal/anomaly driving states, so that the information contained in the CWTS can be fully exploited. We implemented our anomaly detection model on a real-world vehicle driving dataset to evaluate its detection performance. The experimental results demonstrate the superior performance of the proposed model under different anomaly scenarios with various evaluation criteria. Compared with the related research, the average accuracy and F1 score of the anomaly detection are improved by 2.51% and 2.46%, respectively. The contributions of this paper are as follows:  
1. We present a novel vehicle anomaly detection model (CWT-CNN) that integrates CWT with CNN, which is expected to detect various anomaly types through the use of the time and frequency domain characteristics of in-vehicle sensor signals. This model takes full advantage of the CWT and CNN methods and forms an overall anomaly detection model with excellent performance. 2. We propose a data preprocessing method that converts the raw in-vehicle sensor signal into a two-dimensional CWTS. The constructed CWTS can provide more complete local time and frequency characteristics of a signal and can make the detection model inherit the advantages of deep learning so that anomaly deviations caused by different anomalies or faults can be detected. 3. We exploit the CNN model to learn vehicle behavior patterns automatically from the constructed CWTS. Its powerful capability of feature extraction on two-dimensional data enables the model to exploit sufficient characteristics of CWTS to detect anomaly events. 4. We conduct an extensive experiment and evaluate the detection performance of the proposed model with a real-world vehicle dataset. The experimental results demonstrate that our model can detect various anomalies with high accuracy, sensitivity, and F1 score. Compared with the related work, the average accuracy and F1 score of anomaly detection are increased by 2.51% and 2.46%, respectively. In the remainder of this paper, we first provide the related work in Section 2. In Section 3, we introduce preliminaries and anomaly scenarios. Section 4 describes the proposed CWT-CNN model. In Section 5, we show the experimental evaluations and result analysis.