Enhanced Intrusion Detection in In-Vehicle Networks Using Advanced Feature Fusion and Stacking-Enriched Learning

Abstract

Modern vehicles rely heavily on interconnected electronic control units (ECUs) through in-vehicle networks to perform crucial functions such as braking and monitoring engine RPMs. However, the increased number of ECUs and their connectivity to the in-vehicle network poses a security risk due to the lack of encryption and authentication protocols such as the controller area network (CAN). To address this problem, machine learning (ML) based intrusion detection systems (IDSs) have been proposed. However, existing IDSs suffer from low detection accuracy, limited real-time response, and high resource requirements. This study proposes an accurate and low-complexity IDS for in-vehicle networks based on feature fusion and ensemble learning called the Feature Fusion and Stacking-based IDS (FFS-IDS). FFS-IDS fuses multiple features extracted from raw network traffic and then classifies traffic instances into intrusive and non-intrusive categories using a stacking ensemble learning of basic machine learning classifiers. Specifically, a decision tree is employed as a base classifier, and random forest is used as a meta-learner. This work implements and validates the FFS-IDS using real-time car hacking data sets and achieves better performance than individual decision tree classifiers and popular ensemble learning methods such as Random Forest, LightGBM, AdaBoost, and ExtraTree algorithms. The results demonstrate that FFS-IDS can detect Denial of Service (DoS), Gear spoofing, and RPM spoofing attacks with up to 99% accuracy and Fuzzy attacks with up to 97.5% accuracy using benchmark datasets. Overall, this study shows the effectiveness and practicality of FFS-IDS in detecting intrusions in in-vehicle networks, which is essential for ensuring the cybersecurity and safety of modern vehicles. Future work in this area could involve exploring additional feature extraction techniques and fine-tuning hyperparameters to improve the performance of IDSs further.