PaperlayerView exact revision on arXiv

Source-linked AI summary

MTH-IDS: A Multi-Tiered Hybrid Intrusion Detection System for Internet of Vehicles

Li Yang, Abdallah Moubayed, Abdallah Shami

arXiv:2105.13289v1cs.CRcs.AIcs.LGcs.NI

TL;DR

Vehicular networks face challenging intrusion-detection demands across intra-vehicle and external networks, including known and zero-day attacks. The paper proposes a multi-tiered hybrid IDS combining staged machine-learning processing with signature- and anomaly-based detection, achieving high known-attack accuracy and zero-day F1-scores across two datasets.

  • Problem

    Intrusion detection remains challenging in vehicular networks because CAN constraints, high traffic volumes, many features, and varied cyber-attacks limit conventional security mechanisms and existing IDSs.

  • Method

    The paper proposes a multi-tiered hybrid IDS with data preprocessing, feature engineering, supervised known-attack detection, and anomaly-based processing of suspicious instances for zero-day detection.

  • Results

    The system detects known attacks with accuracies of 99.99% and 99.88% and unknown attacks with average F1-scores of 0.963 and 0.800 on the CAN-intrusion-dataset and CICIDS2017, respectively.

  • Takeaways & Limitations

    Evaluation on two public datasets indicates that the proposed system can detect known and unknown attacks across intra-vehicle and external vehicular networks and is feasible for real-time environments.

Abstract

from arXiv · show

Modern vehicles, including connected vehicles and autonomous vehicles, nowadays involve many electronic control units connected through intra-vehicle networks to implement various functionalities and perform actions. Modern vehicles are also connected to external networks through vehicle-to-everything technologies, enabling their communications with other vehicles, infrastructures, and smart devices. However, the improving functionality and connectivity of modern vehicles also increase their vulnerabilities to cyber-attacks targeting both intra-vehicle and external networks due to the large attack surfaces. To secure vehicular networks, many researchers have focused on developing intrusion detection systems (IDSs) that capitalize on machine learning methods to detect malicious cyber-attacks. In this paper, the vulnerabilities of intra-vehicle and external networks are discussed, and a multi-tiered hybrid IDS that incorporates a signature-based IDS and an anomaly-based IDS is proposed to detect both known and unknown attacks on vehicular networks. Experimental results illustrate that the proposed system can detect various types of known attacks with 99.99% accuracy on the CAN-intrusion-dataset representing the intra-vehicle network data and 99.88% accuracy on the CICIDS2017 dataset illustrating the external vehicular network data. For the zero-day attack detection, the proposed system achieves high F1-scores of 0.963 and 0.800 on the above two datasets, respectively. The average processing time of each data packet on a vehicle-level machine is less than 0.6 ms, which shows the feasibility of implementing the proposed system in real-time vehicle systems. This emphasizes the effectiveness and efficiency of the proposed IDS.

I. INTRODUCTION

Modern IoV combines intra-vehicle and external connectivity, expanding attack surfaces and motivating a hybrid IDS for known and zero-day attacks. The proposed MTH-IDS combines preprocessing, feature engineering, supervised detection, unsupervised detection, and learner optimization.

  • IoV architecture: IoV comprises intra-vehicle networks linking ECUs through CAN buses and external networks connecting vehicles through V2X technologies.External communications include vehicles, roadside infrastructures, and road users.
  • Security challenges: CAN networks face message injection risks, while external vehicular networks face attacks including DoS, sniffing, and GPS spoofing.The stated risks arise from CAN broadcast communication without authentication and numerous potential entry points in external networks.
  • Security challenges: Traditional authentication and cryptographic mechanisms may be unsuitable for CAN because they lack support or violate communication timing constraints.The paper therefore presents IDSs as an essential component for identifying malicious threats on vehicular networks.
  • Proposed approach: The MTH-IDS uses two traditional machine-learning stages and four learning tiers to identify known and zero-day attacks on intra-vehicle and external networks.Its tiers include supervised known-attack classifiers, optimization methods, CL k-means for zero-day detection, and optimized biased classifiers.
  • Evaluation: The study evaluates MTH-IDS on CAN-intrusion-dataset and CICIDS2017 using accuracy, detection rates, false alarm rates, F1-scores, and execution time.The datasets represent intra-vehicle and external network traffic, respectively.
  • Contributions: The paper claims a hybrid IDS that optimizes learning models for existing and zero-day attack detection across both intra-vehicle and external vehicular networks.Its contributions include feature engineering, anomaly-based detection, Bayesian optimization, and evaluation of real-world feasibility.

II. RELATED WORK

Prior IoV IDS research covers intra-vehicle or external networks, often focuses on known or specific attacks, and provides limited evidence about vehicle-level real-time feasibility. The paper positions MTH-IDS as addressing these combined detection and deployment gaps through sampling, feature engineering, and optimization.

  • CAN intrusion detection: Prior CAN intrusion studies use SVM, KNN, distance-based, specification-based, and statistical anomaly-detection methods, with some reporting high performance or low delay.The cited distance-based approach is described as computationally complex, while the statistical method is described as detecting intrusions with low delay.
  • CAN intrusion detection: Deep-learning approaches have also been applied to CAN-bus anomaly and attack detection, including stacked sparse autoencoders and convolutional neural networks.The passage identifies these as intra-vehicle IDS methods and mentions high detection performance for one approach.
  • External vehicular IDS: External-network studies include back-propagation, MLP, DBN, decision-tree, and distributed IDS methods, but several consider only Botnet or DoS attacks.These studies use datasets including Kyoto 2006+, CICIDS2017, NSL-KDD, and UNSW-NB15.
  • Literature gap: The literature gap is that most vehicular IDSs target known attacks on either intra-vehicle or external networks, whereas real-world systems face varied existing and new attack patterns across both.The paper states that only one cited technique considers both known and unknown attacks, and another considers both CAN bus and external networks.
  • Deployment feasibility: Only five cited studies performed vehicle-level testing or real-time analysis, leaving the feasibility of other techniques in real-world IoVs unproven.The paper evaluates its proposed IDS on a vehicle-level machine to address this feasibility concern.
  • Design requirements: Effective IoV IDSs require high detection and low false-alarm rates together with low computational complexity and high efficiency.The paper implements data sampling, feature engineering, and model optimization to improve attack-detection efficiency and accuracy.

III. VEHICULAR NETWORKS, VULNERABILITIES, AND IDS DEPLOYMENT

Vehicular networks span vulnerable intra-vehicle CAN buses and externally connected V2X networks, motivating IDS deployment across both domains.

  • A. Vulnerabilities of Intra-vehicle Networks: CAN buses connect vehicle ECUs but remain vulnerable because broadcast transmission lacks authentication and encryption.Modern vehicles often contain 70–100 ECUs connected through CAN.
  • A. Vulnerabilities of Intra-vehicle Networks: Message injection attacks exploit CAN data fields and include denial-of-service, fuzzy, and spoofing attacks.Injected messages can compromise nodes or trigger unintended vehicle behaviors.
  • B. Vulnerabilities of External Vehicular Networks: External V2X networks expose vehicles and connected devices to attacks including DoS, GPS spoofing, jamming, sniffing, brute-force, botnets, infiltration, and web attacks.Vehicles, pedestrians, infrastructures, smart devices, and network systems participate in these interactions.
  • C. Attack Scenarios and IDS Deployment: Internal attackers can inject CAN messages through OBD-II, while external attackers can exploit wireless interfaces such as WiFi, cellular networks, and Bluetooth.The described attack paths target vehicle systems through distinct internal and external access points.
  • C. Attack Scenarios and IDS Deployment: The IDS can monitor CAN-bus messages or external traffic inside central gateways, with captured packets analyzed before forwarding.Detected attacks trigger alarms on CAN nodes, while gateway placement monitors external network traffic.

D. Real-Time Requirements of Vehicle Systems

The MTH-IDS combines preprocessing, feature engineering, and tiered learning models to improve vehicular attack-detection efficiency while addressing large traffic datasets.

  • D. Real-Time Requirements of Vehicle Systems: Feature engineering applies information-gain and correlation-based selection followed by KPCA to remove irrelevant, redundant, noisy, and high-dimensional features.The preprocessing pipeline also uses SMOTE to address class imbalance.
  • 1) Data Sampling by K-means Clustering:: K-means cluster sampling generates a representative subset of traffic data, reducing training complexity for massive network datasets.Cluster sampling selects data from multiple groups rather than uniformly selecting individual samples.
  • 1) Data Sampling by K-means Clustering:: K-means divides samples into k clusters and minimizes squared distances between samples and their corresponding centroids.Its stated time complexity is O(nkt), where n is data size, k is cluster count, and t is iteration count.
  • 1) Data Sampling by K-means Clustering:: Bayesian optimization tunes the number of k-means clusters using the silhouette coefficient as the clustering objective.BO-GP is selected because k-means has one main discrete hyper-parameter and BO-GP converges quickly for such settings.

2) Reduce Class-Imbalance by Oversampling:

Network traffic datasets often contain far more normal than attack samples, so the proposed IDS uses SMOTE to balance minority classes.

  • 2) Reduce Class-Imbalance by Oversampling:: Class imbalance can bias models and lower detection rates because normal traffic commonly dominates attack traffic.This imbalance is identified as a recurring issue in network traffic data.
  • 2) Reduce Class-Imbalance by Oversampling:: SMOTE synthesizes minority-class instances using nearest-neighbor information rather than merely replicating existing samples.The method is selected to reduce the overfitting concern associated with simple random replication.
  • 2) Reduce Class-Imbalance by Oversampling:: For a minority sample X, SMOTE generates a synthetic instance by adding a random fraction of the difference between X and a selected neighbor Xi.The supplied formulation uses rand(0, 1) as the interpolation factor.

3) Data Normalization:

The preprocessing pipeline normalizes network features and applies information-gain-based selection to retain relevant features while reducing dataset complexity. Features are ranked by relative importance and retained until an optimized correlation threshold is reached.

  • Data Normalization: Z-score normalization transforms network traffic features into normalized values using the original value, mean, and standard deviation.The label encoder first converts categorical features into numerical inputs for machine-learning algorithms.
  • Data Normalization: The combined preprocessing and feature-engineering procedure removes irrelevant, redundant, and noisy features while retaining important features for model training.The pipeline is intended to improve dataset quality and support more accurate and efficient learning.
  • Feature Selection by Information Gain: Information gain measures how much information a feature contributes to the target variable through changes in entropy.For feature X and target T, IG(T|X) compares the target entropy with its conditional entropy given X.
  • Feature Selection by Information Gain: Features with larger IG(T|X) values are considered more important for predicting the target than features with smaller values.The resulting importance scores support ranking and selecting task-relevant features.
  • Feature Selection by Information Gain: Feature importance scores are normalized to sum to 1.0, then features are selected in descending order until the correlation threshold α is reached.The threshold α is optimized using BO-GP, and features below the remaining importance criterion are discarded.

2) Fast Correlation Based Filter (FCBF):

FCBF complements information-gain selection by removing redundant features through pairwise correlation analysis, while KPCA addresses nonlinear and higher-order structure for anomaly detection. The resulting IG-FCBF-KPCA pipeline is tuned for an optimized anomaly-detection dataset.

  • Fast Correlation Based Filter (FCBF): FCBF removes redundant features by measuring feature correlations while retaining informative features, with time complexity O(nlogn).It uses symmetrical uncertainty to quantify correlations in high-dimensional feature spaces.
  • Fast Correlation Based Filter (FCBF): FCBF searches the feature space and retains only one feature from highly correlated pairs, discarding the other as redundant.When correlation exceeds α, the feature with higher importance is retained; α is optimized by BO-GP.
  • Kernel Principal Component Analysis (KPCA): FCBF considers pairwise correlations but can miss noisy features involved in correlations among three or more features.This limitation motivates applying KPCA afterward, especially because anomaly-based models are sensitive to feature selection.
  • Kernel Principal Component Analysis (KPCA): KPCA uses the kernel trick to transform nonlinear data into lower-dimensional principal components, and BO-GP optimizes its extracted-feature count and kernel type.IG-FCBF-KPCA supplies the anomaly-based IDS with an optimized dataset of extracted features.
  • Kernel Principal Component Analysis (KPCA): Signature-based IDSs target known attack patterns, whereas anomaly-based IDSs use unsupervised learning to distinguish unknown attacks from normal data.This distinction explains the use of KPCA in the anomaly-detection pipeline.

1) The Signature-based IDS:

The signature-based IDS uses stacked tree-based supervised learners optimized by BO-TPE for known attacks, while the anomaly-based IDS combines CL-k-means with biased classifiers for zero-day detection. Uncertain or potentially misclassified samples receive additional processing to reduce false decisions.

  • The Signature-based IDS: The signature-based IDS trains an ensemble model on labeled, preprocessed datasets to detect multiple known attack types.Its base learners are decision tree, random forest, extra trees, and XGBoost models.
  • The Signature-based IDS: Decision tree, random forest, extra trees, and XGBoost provide tree-based supervised learners for multi-class known-attack classification.Their stated complexities are O(n2f), O(n2√ft), O(nft), and O(nft), respectively.
  • The Signature-based IDS: Stacking combines the outputs of the four tree-based learners to improve generalizability compared with relying on a single model.The selected ensemble models support nonlinear network-traffic data, parallel execution, and feature-importance calculation.
  • The Signature-based IDS: BO-TPE optimizes the tree-based learners’ hyperparameters by separating relatively good and poor results with density functions l(x) and g(x).The optimization objective is to maximize l(x)/g(x).
  • The Anomaly-based IDS: Samples labeled normal by the signature-based IDS are treated as suspicious because zero-day attacks may be absent from known attack patterns.The anomaly-based IDS then processes these instances to identify previously unseen attacks.
  • The Anomaly-based IDS: CL-k-means assigns cluster labels by majority class, while biased classifiers process difficult samples to reduce false negatives and false positives.Uncertain instances are routed according to their CL-k-means label, using the optimized clustering-probability threshold 0.933.
  • The Anomaly-based IDS: The anomaly-based design assumes future incoming samples are unlabeled and uses training-phase false negatives and false positives to build biased classifiers.This avoids requiring constant data labeling and model updates for new attack patterns.
  • The Anomaly-based IDS: CL-k-means with mini-batch processing is designed for efficient clustering, with k-means training complexity O(nkt) and straightforward adaptation to new samples.Its stated advantages include modeling multiple attack and normal patterns through sufficient clusters.

E. Runtime Complexity

The IDS is designed to keep vehicle-side testing lightweight by shifting training to a faster server and limiting the runtime complexity of inference. Its overall test complexity is expressed in terms of feature, tree, cluster, and depth counts.

  • Runtime Complexity: Training can run on a high-speed server, while testing is implemented in vehicle systems to satisfy real-time requirements.Each test sample passes through the stacking model, CL-k-means, and one biased classifier.
  • Runtime Complexity: The proposed IDS has maximum overall runtime complexity O(2dft + fk), with d, f, t, and k limited to a few dozen at most.The terms represent the bounded dimensions governing the tree-based and clustering components.

F. Validation Metrics

The study evaluates MTH-IDS through cross-validation for known attacks and hold-out validation for unknown attacks, using performance and efficiency metrics. Experiments also assess implementation feasibility on vehicle-level hardware.

  • Validation Design: 10-fold cross-validation evaluates known-attack models after a 70%-30% train-test split, with the test set untouched until final hold-out validation.Each fold trains on 90% and validates on 10% of the original training set.
  • Validation Design: Hold-out validation evaluates zero-day detection by pairing every attack type with an equally sized random sample of normal data.All remaining samples form the training set, allowing validation of each attack type as an unknown attack.
  • Metrics: Accuracy, detection rate, false alarm rate, and F1-score are computed from true-positive, true-negative, false-positive, and false-negative counts.These metrics provide a comprehensive evaluation of IDS performance.
  • Efficiency: Model execution time is averaged across training and validation time in cross-validation or hold-out validation to evaluate efficiency.The study frames an efficient IDS as achieving high F1-score alongside low execution time.
  • Evaluation Scope: The experiments cover known intrusion detection, unknown intrusion detection, and CPU resource usage on a vehicle-level machine.The three parts evaluate the signature-based component, anomaly-based component, and entire model, respectively.

B. Data Description

The study uses CAN-intrusion-dataset traffic for intra-vehicle networks and CICIDS2017 flow data as a representative proxy for external vehicular networks. It then evaluates known-attack detection on both datasets using feature selection and optimized classifiers.

  • Intra-Vehicle Data: CAN-intrusion-dataset records vehicle CAN traffic collected through the OBD-II port during launched CAN attacks.Its features include timestamp, CAN ID, data length code, and eight data-field bytes; timestamp is removed because it can bias models toward attack-simulation periods.
  • External Network Data: CICIDS2017 is selected to represent complex external vehicular network traffic because public IoV benchmark datasets are scarce and it contains many features, instances, and attack types.The study associates its attack classes with external vehicular threats.
  • Evaluation Setup: Known-attack evaluation trains and tests the signature-based IDS on labeled CAN-intrusion and CICIDS2017 traffic using 10-fold cross-validation.The corresponding results are reported in Tables VI and VII.
  • Known Intrusion Results: 99.999% accuracy is achieved on CAN-intrusion-dataset after IG-FCBF selects four features with optimized correlation threshold α = 0.9.The selected features are CAN ID, DATA[5], DATA[3], and DATA[1].
  • Known Intrusion Results: 99.879% F1-score is achieved on CICIDS2017 after selecting 20 of 80 features and optimizing the machine-learning models, while execution time decreases by 70.2%.Binary classification reaches 99.895% accuracy and saves 69.4% execution time.
  • Overall Finding: The experimental results show that the IDS separates normal and malicious traffic and detects various known cyber-attacks in vehicle systems.The study evaluates these outcomes on both intra-vehicle and external vehicular network data.

D. Performance Analysis of Unknown Intrusion Detection

The MTH-IDS detects most unknown attacks across intra-vehicle and external vehicular networks, though performance varies substantially by attack type. Biased classifiers improve CAN-dataset performance, while attacks resembling normal traffic remain difficult to detect.

  • CAN-intrusion-dataset: 0.96307 F1-score is achieved on the CAN-intrusion-dataset with biased classifiers, improving from 0.82643 without them.DoS, gear spoofing, and RPM spoofing reach 100% detection rates with false alarm rates of 0.0%-0.449%, whereas fuzzy attacks perform worse.
  • CAN-intrusion-dataset: 73.053% detection rate and 0.84389 F1-score are reported for fuzzy attacks because some random-valued packets resemble normal packets.The paper identifies this similarity as making unsupervised discrimination difficult.
  • Overall assessment: The authors conclude that zero-day detection remains an unsolved research problem despite relatively high detection and low false alarm rates for most previously unseen attacks.This leaves room for improving anomaly-based detection, particularly for difficult attack distributions.

E. Vehicle-Level Model Evaluation and Discussion

Evaluation on untouched test sets and a Raspberry Pi 3 indicates strong classification performance and real-time feasibility. The paper attributes generalizability partly to large datasets, feature engineering, and stacking ensembles, while proposing further anomaly-detection improvements.

  • Evaluation setup: The system is evaluated on public datasets representing intra-vehicle and external vehicular traffic, including untouched test sets for assessing generalizability.The evaluation also includes confusion matrices for both datasets.
  • Test-set performance: 99.99% and 99.88% F1-scores are obtained on the untouched CAN-intrusion-dataset and CICIDS2017 test sets, respectively.The CAN confusion matrix shows all DoS, RPM spoofing, and gear spoofing samples detected, with two fuzzy-attack false alarms; CICIDS2017 has a 0.12% classification error rate.
  • Discussion: Large datasets, comprehensive feature engineering, and stacking ensembles are presented as reasons for high performance without over-fitting.Feature engineering removes irrelevant or misleading features, while ensembles can reduce estimation variance.
  • System design: The proposed MTH-IDS combines preprocessing and feature engineering with four learning tiers for known and unknown attack detection.The tiers use supervised tree learners, Bayesian optimization and stacking, CL-k-means, and optimized anomaly detection with biased classifiers.
  • Conclusion: The conclusion reports that the system can detect unknown attacks with average F1-scores of 0.963 and 0.800 on the two datasets.Future work is directed toward other unsupervised and online learning methods for the anomaly-based IDS.
Loading 2105.13289v1…