PaperlayerView exact revision on arXiv

Source-linked AI summary

A Transfer Learning and Optimized CNN Based Intrusion Detection System for Internet of Vehicles

Li Yang, Abdallah Shami

arXiv:2201.11812v1cs.CRcs.AIcs.CVcs.LGcs.NI

TL;DR

Increasing connectivity and missing authentication or encryption expose vehicular networks to cyber-attacks, motivating intrusion detection. The paper combines transfer learning, ensembles, and optimized CNNs, reporting 100% F1-scores on Car-Hacking and 99.925% on CICIDS2017.

Abstract

from arXiv · show

Modern vehicles, including autonomous vehicles and connected vehicles, are increasingly connected to the external world, which enables various functionalities and services. However, the improving connectivity also increases the attack surfaces of the Internet of Vehicles (IoV), causing its vulnerabilities to cyber-threats. Due to the lack of authentication and encryption procedures in vehicular networks, Intrusion Detection Systems (IDSs) are essential approaches to protect modern vehicle systems from network attacks. In this paper, a transfer learning and ensemble learning-based IDS is proposed for IoV systems using convolutional neural networks (CNNs) and hyper-parameter optimization techniques. In the experiments, the proposed IDS has demonstrated over 99.25% detection rates and F1-scores on two well-known public benchmark IoV security datasets: the Car-Hacking dataset and the CICIDS2017 dataset. This shows the effectiveness of the proposed IDS for cyber-attack detection in both intra-vehicle and external vehicular networks.

I. INTRODUCTION

Increasing connectivity and missing authentication or encryption expose intra-vehicle and external vehicular networks to cyber-attacks. The paper proposes an optimized CNN-based IDS combining transfer learning, ensemble learning, and hyper-parameter optimization.

I. INTRODUCTION

  • Connectivity expands vehicular attack surfaces, while CAN packets lack authentication and encryption, leaving intra-vehicle and external networks vulnerable to attacks.The introduction identifies DoS, fuzzy, and spoofing attacks against intra-vehicle networks and conventional cyber-attacks against external networks.Source: §I · p. 1
  • The proposed IDS combines CNNs, transfer learning, ensemble learning, and particle swarm optimization, evaluating the framework on Car-Hacking and CICIDS2017.Five CNN architectures are trained as base learners; confidence averaging and concatenation integrate them.Source: §I · p. 1
  • The paper contributes a traffic-to-image transformation intended to make attack patterns easier to distinguish and evaluates the framework on benchmarks representing intra-vehicle and external networks.It also compares performance with state-of-the-art methods.Source: §I · p. 1

II. RELATED WORK

Prior IoV intrusion-detection work includes neural and tree-based approaches, as well as CNN models for in-vehicle networks. The paper positions its approach as an effort to improve performance and training efficiency.

II. RELATED WORK

  • Rosay et al. evaluated an MLP-based connected-vehicle IDS on CICIDS2017, while Yang et al. used tree-based stacking for IoV traffic analysis.The stacking method is reported to perform well on IoV and CICIDS2017 datasets.Source: §II · p. 2
  • CNN-based in-vehicle IDS examples include P-LeNet with a 97.83% F1-score on Car-Hacking, a 1D-CNN, and a reduced-InceptionResnet DCNN.The cited work reports high accuracy for the DCNN on Car-Hacking.Source: §II · p. 2
  • The paper identifies room to improve existing methods and proposes CNNs optimized with HPO and ensemble learning, with transfer learning used to improve training efficiency.The cited related work is described as already achieving high accuracy in IoV attack detection.Source: §II · p. 2

III. PROPOSED FRAMEWORK

The proposed IDS targets attacks on both in-vehicle and external vehicular networks, with deployment points suited to each network. Its pipeline transforms traffic into images, optimizes CNN base learners, and combines the strongest models for detection.

A. System Overview

  • The IDS is intended for both in-vehicle and external vehicular networks, covering internal attacks through OBD II and external attacks through wireless interfaces.The proposed deployment is on top of the CAN bus for IVNs and in gateways for external networks.Source: A. System Overview · p. 2
  • Time-based chunks of network traffic are quantile-transformed into images, then used to train five CNN architectures whose hyperparameters are tuned by PSO.The five models are VGG16, VGG19, Xception, Inception, and InceptionResnet.Source: A. System Overview · p. 2
  • The three best-performing CNNs are selected as base learners and integrated using confidence averaging or concatenation for final detection.Source: A. System Overview · p. 2

B. Data Description and Transformation

The study uses Car-Hacking data for intra-vehicle traffic and CICIDS2017 data for external-network traffic. It normalizes and groups traffic into time-based chunks, converts the chunks into images, and labels them by their attack patterns.

B. Data Description and Transformation

  • Car-Hacking represents intra-vehicle CAN traffic and includes DoS, fuzzy, gear-spoofing, and RPM-spoofing attacks; CICIDS2017 represents external traffic and includes five attack types.CICIDS2017 attack types are DoS, port-scan, brute-force, web-attacks, and botnets.Source: B. Data Description and Transformation · p. 2
  • Quantile normalization is used to map feature values to the image range and handle outliers, whereas min-max normalization may leave most values extremely small.The passages describe quantile normalization as transforming feature distributions toward a normal distribution and recalculating feature values.Source: B. Data Description and Transformation · pp. 2–3
  • Timestamp-based chunks become color images: Car-Hacking uses 27 samples across 9 features for 9×9×3 images, while CICIDS2017 uses 60 samples across 20 features for 20×20×3 images.The timestamp-based grouping retains time-series correlations in the original data.Source: B. Data Description and Transformation · p. 3
  • Each image is labeled Normal when all its samples are normal; otherwise, it receives the most frequent attack type in the chunk.Source: B. Data Description and Transformation · p. 3
  • The transformed images show distinct attack patterns, including random-looking fuzzy samples and high-frequency empty DoS messages rendered as black patterns in Car-Hacking.The passage also describes gear- and RPM-spoofing images as having patterns and reports that CICIDS2017 attacks are visually distinguishable.Source: B. Data Description and Transformation · p. 3

C. CNN and Transfer Learning

The section explains CNN processing and transfer learning, then describes the pretrained CNNs used as base models. Fine-tuning adapts selected higher-level features to the vehicle-network datasets.

C. CNN and Transfer Learning

  • CNNs process images through convolutional layers that extract patterns, pooling layers that reduce complexity, and fully connected layers that generate outputs.The section notes that CNN inputs need no additional feature extraction or data reconstruction.Source: C. CNN and Transfer Learning · p. 3
  • Transfer learning transfers a DNN’s weights from one dataset to another, while fine-tuning freezes most layers and retrains a few top layers on the target dataset.This lets higher-order features be updated to better fit the target task.Source: C. CNN and Transfer Learning · pp. 3–4
  • ImageNet-pretrained VGG16, VGG19, Xception, Inception, and InceptionResnet are fine-tuned on vehicle-network datasets, and the top three performers are selected as ensemble base learners.The models were chosen for their success in image classification problems.Source: C. CNN and Transfer Learning · p. 4
  • Inception combines convolutional feature extractors across contexts; Xception replaces standard convolutions with depthwise separable ones, while InceptionResnet adds residual connections.Xception’s memory requirement is slightly smaller than Inception’s; InceptionResnet requires twice Inception’s computational operations and memory.Source: C. CNN and Transfer Learning · p. 4
  • VGG16 and VGG19 achieved a 7.3% reduced error rate on the ImageNet Challenge, and VGG19 has three more convolutional layers than VGG16.VGG16 has five convolutional blocks and three fully connected layers.Source: C. CNN and Transfer Learning · p. 4

D. Proposed Ensemble Learning Models

The section describes confidence averaging and concatenation as two ensemble strategies. Confidence averaging combines class probabilities, while concatenation integrates features and requires retraining.

D. Proposed Ensemble Learning Models

  • Confidence averaging combines base learners’ class probabilities and returns the class with the highest average confidence.In the proposed IDS, the ensemble uses three selected base CNN learners; unlike label voting, confidence averaging can use classification confidence to correct misclassified samples.Source: D. Proposed Ensemble Learning Models · p. 4
  • Confidence averaging calculates each class’s mean probability from the base learners’ softmax outputs before selecting the final class label.The class confidence values are calculated using softmax.Source: D. Proposed Ensemble Learning Models · p. 4
  • The confidence-averaging step has time complexity O(NKC), where N is the number of instances, K the number of base CNNs, and C the number of classes.The section states that K and C are usually small, so this step’s execution speed is usually high.Source: D. Proposed Ensemble Learning Models · p. 4
  • Concatenation integrates the highest-order features from base CNNs into a new layer, followed by dropout and softmax, and requires retraining on the entire dataset.The section gives its computational complexity as O(NF), where N is the number of samples and F is the total number of extracted features.Source: D. Proposed Ensemble Learning Models · p. 4

E. Hyper-Parameter Optimization (HPO)

The section presents particle swarm optimization (PSO) as the method for tuning CNN hyper-parameters. It distinguishes model-design parameters from model-training parameters and describes how PSO updates particle velocities.

E. Hyper-Parameter Optimization (HPO)

  • CNN hyper-parameters include model-design choices—frozen-layer percentage, learning rate, and dropout rate—and training choices—batch size, epochs, and early-stop patience.The section says these parameters affect CNN structure, effectiveness, and efficiency.Source: E. Hyper-Parameter Optimization (HPO) · pp. 4–5
  • PSO updates each particle’s velocity using its own best position and the swarm’s global best, moving particles toward promising regions to identify a global optimum.The velocity update also uses acceleration constants and continuous uniform distributions.Source: E. Hyper-Parameter Optimization (HPO) · p. 5
  • PSO is selected for its support for different hyper-parameter types and its O(NlogN) time complexity.The section defines HPO as automated hyper-parameter tuning using optimization techniques and describes PSO as a swarm-based metaheuristic.Source: E. Hyper-Parameter Optimization (HPO) · p. 5

A. Experimental Setup

The experiments use two benchmark vehicle-network datasets and fivefold cross-validation. They assess classification performance with four metrics and monitor training and testing time on different machines.

A. Experimental Setup

  • Models are trained on a Dell Precision 3630 with an i7-8700 processor and 16 GB memory, then tested on a Raspberry Pi 3 with a BCM2837B0 64-bit CPU and 1 GB memory.The machines represent a central server and a vehicle-level local machine, respectively.Source: A. Experimental Setup · p. 5
  • The proposed models are evaluated on Car-Hacking and CICIDS2017 using fivefold cross-validation, with accuracy, precision, recall, and F1-score as performance metrics.The section motivates these metrics by noting that network traffic is usually highly imbalanced, with a small percentage of attack samples.Source: A. Experimental Setup · p. 5
  • Training time on the server-level machine and testing time on the vehicle-level machine are monitored to evaluate efficiency.The experiments use Scikit-learn and Keras in Python.Source: A. Experimental Setup · p. 5

B. Experimental Results and Discussion

The optimized CNN ensembles perform strongly on both benchmark datasets. Confidence averaging combines high F1-scores with shorter training time, and packet-level prediction times fall below the stated real-time requirement.

B. Experimental Results and Discussion

  • PSO hyper-parameter optimization was applied only to CICIDS2017 because default CNNs already achieve near-100% accuracy on Car-Hacking.The optimized CNNs were then used as ensemble base learners; Table I presents the hyper-parameter search ranges and optimal values.Source: B. Experimental Results and Discussion · p. 5, Table I · p. 5
  • 100% F1-scores and at least 0.09% F1-score improvements over compared methods are reported for the proposed ensembles on Car-Hacking.The authors note that most compared approaches also achieve high accuracy on this dataset because its patterns are simple to distinguish.Source: Table II · p. 5, B. Experimental Results and Discussion · p. 6
  • 99.925% F1-score for confidence averaging exceeds the concatenation model’s 99.899% on CICIDS2017, and both ensembles outperform recent methods.Confidence averaging also has lower total training time than concatenation.Source: Table III · p. 5, B. Experimental Results and Discussion · p. 6
  • 1.5–3.2 ms per packet on a Raspberry Pi is below the stated 10 ms real-time analysis requirement.The authors interpret these prediction times as indicating feasibility for real-time IoV systems.Source: B. Experimental Results and Discussion · p. 6

V. CONCLUSION

The paper proposes an IoV intrusion-detection framework using optimized CNNs, transfer learning, ensemble learning, and chunk-based traffic-to-image transformation. It reports strong F1-scores on two benchmark datasets and vehicle-level testing that supports real-time feasibility.

V. CONCLUSION

  • The framework combines transfer learning, ensemble learning, optimized CNNs, and chunk-based transformation of vehicle traffic into CNN image inputs.The datasets represent intra-vehicle and external network data, respectively.Source: §V · p. 6
  • 100% F1-score on Car-Hacking and 99.925% on CICIDS2017 are reported as higher than the compared state-of-the-art methods.Source: §V · p. 6
  • Vehicle-level machine testing supports the feasibility of the proposed IDS in real-time vehicle networks.Source: §V · p. 6
  • Future work will extend the framework toward online adaptive learning to address concept drift in time-series vehicle data.Source: §V · p. 6
Loading 2201.11812v1…