# HP-LSTM: Hawkes Process-LSTM-Based Detection of DDoS Attack for In-Vehicle Network
## 2 Related Work  
### Review of Existing Research on DDoS Detection for In-Vehicle Network  
In the development of CAVs, the automotive security domain continues to grapple with the prevalent yet challenging threat posed by Distributed Denial-of-Service (DDoS) attacks. This ongoing concern has spurred significant research efforts in the field. In or der to detect DDoS attacks in vehicular networks, researchers have proposed a series of intrusion detection systems. In 2020, [PERSON] et al. [15] introduced a hybrid detection algorithm based on AnovaDot and RBFDot SVM kernel methods for detecting DDoS attacks in VANETs. In 2021, [PERSON] et al. [16] proposed a novel Hybrid KSVM scheme based on the KNN and SVM algorithms to build a secure framework to detect DDoS attack. In 2023, [PERSON] et al. [17] proposed a Controller Area Network (CAN) bus intrusion detection system based on Multi-Observation Hidden Markov Models (MOHIDS), which effectively detects four types of attacks including DDoS attacks. In fact, relying solely on the aforementioned statistical-based detection methods and traditional machine learning has proven insufficient in adapting to complex attack scenarios and varying attack intensities, presenting a significant challenge in this research field.  
On the other hand, with the advancement of deep learning, an increasing number of researchers have begun to utilize deep learning to detect DDoS attacks. [PERSON] et al. [18] proposed a detection model integrating Generative Adversarial Networks (GANs) and Deep Belief Networks (DBN) for detecting intrusions in vehicular networks, including DDoS attacks. The proposed model significantly improves the detection performance of a small number of network attack samples. [PERSON] et al. [19] proposed a novel distributed multi-layer perceptron classifier (MLPC) for DDoS detection and evaluated the performance of the proposed detection scheme in vehicular communication systems. In order to achieve a higher detection accuracy, more scholars are now using LSTM to detect intrusions in vehicular networks [20]. A Long Short-Term Memory network (LSTM), as an improved version of an RNN, is capable of more effectively capturing long-term dependencies when processing long sequential data, effectively mitigating the issues of vanishing and exploding gradients encountered in traditional RNNs. A deep learning architecture-based LSTM autoencoder algorithm, proposed by [PERSON] et al. [21], has been employed for the identification of intrusion events from the central network gateways of autonomous vehicles (AVs). This algorithm showcases detection accuracies of 99% and 98% on real and simulated datasets, respectively. Similarly, [PERSON] et al. [3] verified, through extensive comparative experiments, that in vehicular network attack detection, LSTM models outperform other deep learning models (such as CNNs and RNNs) in terms of performance. As an intelligent decision-making method, reinforcement learning combined with a neural network is widely used in in-vehicle network detection to achieve intelligent detection in complex attack environments. [PERSON] et al. [22] presented a reinforcement learning-based feature adaptation method named FAST. They elaborately designed a combination action space and devised a reward function based on the Kalman filter method and historical data traffic flows, enabling FAST to identify DDoS attacks in vehicular networks more quickly and accurately.