Source-linked AI summary
Tree-based Intelligent Intrusion Detection System in Internet of Vehicles
Li Yang, Abdallah Moubayed, Ismail Hamieh, Abdallah Shami
TL;DR
AV and IoV communications are exposed to diverse external and CAN-bus attacks, motivating an IDS that covers both network settings. The paper develops a tree-based machine-learning system with stacking, feature selection, and data preparation, and reports stronger performance than literature methods on two datasets. Its conclusion reports 2-3% higher accuracy, detection rate, and F1 score, along with a lower false alarm rate.
Problem
AV and IoV networks face diverse external and intra-vehicle attacks, requiring IDS protection across CAN-bus and external communications.
Method
The IDS combines tree-based models, stacking ensemble learning, averaging feature selection, SMOTE oversampling, and network-traffic preparation.
Results
2-3% higher accuracy, detection rate, and F1 score and a lower false alarm rate than literature methods were reported on two datasets.
Takeaways & Limitations
The proposed system identifies intrusions across CAN-bus and external networks while targeting high detection performance and reduced computational cost.
Abstract
from arXiv · showhide
The use of autonomous vehicles (AVs) is a promising technology in Intelligent Transportation Systems (ITSs) to improve safety and driving efficiency. Vehicle-to-everything (V2X) technology enables communication among vehicles and other infrastructures. However, AVs and Internet of Vehicles (IoV) are vulnerable to different types of cyber-attacks such as denial of service, spoofing, and sniffing attacks. In this paper, an intelligent intrusion detection system (IDS) is proposed based on tree-structure machine learning models. The results from the implementation of the proposed intrusion detection system on standard data sets indicate that the system has the ability to identify various cyber-attacks in the AV networks. Furthermore, the proposed ensemble learning and feature selection approaches enable the proposed system to achieve high detection rate and low computational cost simultaneously.
I. INTRODUCTION
AVs and IoV enable broad vehicle and infrastructure connectivity but remain exposed to external and intra-vehicle cyber-attacks. The paper proposes a tree-based IDS with ensemble learning, feature selection, and traffic-data preparation to detect attacks efficiently.
- V2X connects vehicles, pedestrians, infrastructures, and networks, supporting wireless communication across local and wide-area systems.
- AV and IoV networks face DoS, spoofing, sniffing, brute-force, web, and CAN-bus message-injection attacks.CAN-bus threats include DoS, spoofing, and fuzzy attacks that exploit unvalidated message origins.
- The proposed IDS targets both CAN buses in AVs and external IoV networks using decision trees, random forests, extra trees, XGBoost, and stacking.Stacking is used to improve accuracy, while feature selection is used to reduce computational time.
- The paper presents a comprehensive framework for preparing network-traffic data for IDS development.
- An averaging feature-selection method based on tree-structure models is proposed to improve IDS efficiency and analyze network attributes and attacks.
II. SYSTEM DESIGN
The system is designed to detect common attacks across intra-vehicle CAN-bus and external communication networks. It prioritizes broad attack coverage together with high detection rate and low computational time.
- The proposed IDS covers CAN-bus and external-network attacks to protect vehicle components and IoT devices across the IoV.
- The target attacks include DoS, fuzzy, and spoofing attacks on CAN buses, plus sniffing, brute-force, and web attacks on external networks.
- The design requirement is a high detection rate with low computational time for efficient intrusion identification.
B. IDS system overview and architecture
The IDS is placed at CAN-bus and gateway locations so traffic can be checked before reaching vehicle or intranet nodes. Its tree-based pipeline collects traffic, addresses imbalance, selects features, trains base models, and classifies data through stacking.
- The IDS can monitor CAN-bus traffic or operate inside the gateway to secure external communication networks.
- Messages transmitted on the CAN bus or from an external network to the intranet pass through the IDS for checking.
- The framework collects network traffic, applies oversampling when classes are imbalanced, and selects features using averaged feature importance.
- Four base models feed a stacking ensemble whose final model classifies the traffic.
III. PROPOSED IDS FRAMEWORK
The framework gathers attack-relevant traffic features for CAN and external networks, then preprocesses them through encoding, normalization, and minority-class oversampling. Feature selection addresses the computational burden of high-dimensional external-network data.
- CAN-bus IDS data emphasizes CAN IDs and frame data fields because the main threats are message-injection attacks.
- External-network IDS data includes packet length, transfer rate, throughput, inter-arrival time, TCP flags, segment size, and active or idle time.
- One-hot encoding separates normal data from anomalies, while numerical features are normalized to the range 0.0 to 1.0.The normalization uses each feature's original value together with its maximum and minimum values.
- Random oversampling and SMOTE increase minority-class data to address class imbalance and improve anomaly detection support.SMOTE generates new minority-class samples using the idea of K nearest neighbors.
B. The proposed ML approaches
The paper uses tree-based classifiers for intrusion detection, emphasizing ensemble models, nonlinear and high-dimensional data handling, feature importance, and reduced computation through multithreading.
- Tree-based models: The proposed classifiers are decision tree, random forest, extra trees, and XGBoost.DT uses divide-and-conquer classification; RF and ET aggregate randomized trees, while XGBoost combines trees using gradient descent.
- Computational efficiency: Multithreading reduces the computational time of the four tree-based algorithms compared with their original complexity.The paper identifies this reduction as an important reason for choosing these algorithms.
- Model rationale: Tree-based models are selected because they support ensemble learning, nonlinear and high-dimensional data, and feature-importance calculation.
- Decision-tree tuning: CART selects the subtree minimizing empirical risk plus a complexity penalty, making tree depth an important parameter.The penalty depends on subtree cardinality and α, while deeper trees contain more subtrees.
- Hyperparameter effects: RF, ET, and XGBoost performance depends on the number of trees, while XGBoost also depends on tree depth and regularization.Too-small T and D cause underfitting; too-large values cause overfitting and additional computational costs.
- Hyperparameter tuning: Grid search tunes the tree models by increasing tree number and depth while monitoring accuracy for overfitting.The reported settings include depth D = 8 and tree count T = 200.
C. Ensemble learning and feature selection
The system combines four tree-based models through stacking and selects features by averaging feature-importance rankings from those models.
- Ensemble learning: Stacking uses the four tree-based algorithms as first-layer predictors and the highest-accuracy model as the second-layer meta-classifier.Outputs from the base predictors become inputs to the meta-learner.
- Feature selection: The ensemble feature-selection method averages feature-importance lists generated by the four selected tree-based models.Tree models calculate importance during training, and averaging their outputs is intended to make feature selection more reliable.
D. Validation metrics
The proposed models are evaluated with five-fold cross-validation using classification, attack-detection, false-alarm, overall-performance, and execution-time metrics.
- Evaluation protocol: Five-fold cross-validation is applied after splitting each dataset into five subsets.
- Classification metrics: Accuracy, detection rate or recall, false alarm rate, and F1 score are the main classification metrics.Detection rate captures detected attacks, while F1 combines precision and recall.
- Computational metric: Execution time, mainly model training time, measures computational performance.
A. Datasets description
The evaluation uses separate datasets for intra-vehicle CAN-bus communication and external network communication, covering the Car-Hacking Dataset and CICIDS2017.
- Intra-vehicle network: The Car-Hacking Dataset, also called the CAN-intrusion dataset, is used for intrusion-detection development on CAN bus.
- External network: CICIDS2017 is used to evaluate intrusion detection in external communication networks and contains updated attack scenarios.
- Dataset tables: Table I reports the data type and size of the CAN-intrusion dataset.
- Dataset tables: Table II reports the data type and size of the CICIDS2017 dataset.
B. IDS performance analysis
The tree-based IDS outperformed conventional baselines on both datasets, while stacking improved performance and feature selection substantially reduced execution time with limited accuracy loss.
- 100% accuracy, detection rate and F1 score were achieved by stacking on the CAN-intrusion dataset.The ensemble combined DT, RF and ET, using RF as the meta-classifier.
- 1.8-3.2% higher accuracy, detection rate and F1 score were obtained by most tree-based algorithms than KNN and SVM on CICIDS2017, except ET.
- 80.3% and 73.7% execution-time savings were achieved by FS RF and FS Stacking on CAN-intrusion while maintaining 99.99% accuracy.The selected features were CAN ID, DATA[5], DATA[3] and DATA[1].
- 39.2% and 38.6% execution-time savings were achieved by feature-selected XGBoost and stacking on CICIDS2017, with accuracy decreases of 0.08% and 0.04%.Feature selection retained 36 of 78 features.
C. Feature analysis
The feature analysis identifies attack-specific network attributes, showing how feature importance can support targeted intrusion detection and network monitoring.
- Destination port reflects DoS, brute-force, web and botnet attacks, while packet size is important for DoS, port scan and web attacks.
- Forward packet length is related to port scan, brute-force and infiltration attacks, whereas backward packet length reflects DoS, web and botnet attacks.
- Packet-length variance in both directions reflects brute-force attacks, while the count of pushing flags indicates port scan attacks.
- Attack-specific feature-importance lists can guide dedicated single-attack IDS design and identify key attributes for network supervisors to monitor.
- The complete IDS combines attack subsets and detects various attacks rather than only one attack type per run.Across the two datasets, the reported accuracies were 100% and 99.86%, with reduced computational time.