# An Intelligent Ensemble-Based Detection of In-Vehicle Network Intrusion
## 5 Results and Discussion
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Model** & **Attacks** & **Precision** & **Recall** & **F1-Score** \\ \hline \multirow{6}{*}{RF} & Flooding & 1.00 & 1.00 & 1.00 \\ \cline{2-5}  & Fuzzing & 0.99 & 1.00 & 1.00 \\ \cline{2-5}  & Normal & 1.00 & 0.93 & 0.96 \\ \cline{2-5}  & Replay & 0.93 & 1.00 & 0.96 \\ \cline{2-5}  & Spoofing & 1.00 & 1.00 & 1.00 \\ \hline \multirow{6}{*}{DT} & Flooding & 1.00 & 1.00 & 1.00 \\ \cline{2-5}  & Fuzzing & 1.00 & 0.99 & 0.99 \\ \cline{2-5}  & Normal & 1.00 & 0.93 & 0.96 \\ \cline{2-5}  & Replay & 0.99 & 1.00 & 0.99 \\ \cline{2-5}  & Spoofing & 0.93 & 1.00 & 0.96 \\ \hline \multirow{6}{*}{XGBoost} & Flooding & 1.00 & 1.00 & 1.00 \\ \cline{2-5}  & Fuzzing & 1.00 & 1.00 & 1.00 \\ \cline{2-5}  & Normal & 1.00 & 0.94 & 0.97 \\ \cline{2-5}  & Replay & 0.94 & 1.00 & 0.97 \\ \cline{2-5}  & Spoofing & 1.00 & 1.00 & 1.00 \\ \hline \multirow{6}{*}{Stacking} & Flooding & 1.00 & 1.00 & 1.00 \\ \cline{2-5}  & Fuzzing & 1.00 & 1.00 & 1.00 \\ \cline{2-5}  & Normal & 1.00 & 0.97 & 0.98 \\ \cline{2-5}  & Replay & 0.97 & 1.00 & 0.99 \\ \cline{2-5}  & Spoofing & 1.00 & 1.00 & 1.00 \\ \cline{2-5}  & Spoofing & 1.00 & 1.00 & 1.00 \\ \hline \multirow{6}{*}{Bagging} & Flooding & 1.00 & 1.00 & 1.00 \\ \cline{2-5}  & Fuzzing & 0.99 & 1.00 & 0.99 \\ \cline{2-5}  & Normal & 0.99 & 0.92 & 0.95 \\ \cline{2-5}  & Replay & 0.93 & 0.98 & 0.95 \\ \cline{2-5}  & Spoofing & 1.00 & 1.00 & 1.00 \\ \hline \multirow{6}{*}{Voting} & Flooding & 0.99 & 1.00 & 0.99 \\ \cline{2-5}  & Fuzzing & 1.00 & 1.00 & 1.00 \\ \cline{2-5}  & Normal & 1.00 & 0.92 & 0.96 \\ \cline{2-5}  & Replay & 0.93 & 0.99 & 0.96 \\ \cline{2-5}  & Spoofing & 1.00 & 1.00 & 1.00 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: The evaluation results for each attack using the supervised models and ensemble methods with feature selection. DT, and XGBoost) is well-suited for real-time deployment due to their efficient parallel processing capabilities and low inference latency. Although stacking involves a two-stage architecture that incurs a higher training cost, its real-time prediction performance remains practical. In addition, computational overhead is significantly reduced by selecting features, as evidenced by the shorter training and testing times seen in Figure 9. These factors collectively support the suitability of the proposed ensemble IDS for deployment in resource-constrained in-vehicle environments. Table 8 presents the hyperparameter configurations used for each supervised learning model in our study. In Figure 10 for the stacking method, we visualize multiclassification using the AUC-ROC curve at each classification threshold. The False Positive Rate and the True Positive Rate are presented on the x-axis and the y-axis, respectively. It is preferable to have a high AUC-ROC score because this indicates the robustness of the model. Specifically, an AUC-ROC value near 1.0 indicates a robust model. In Figure 10, 0 represents DoS attacks, 1 represents fuzzing attacks, 2 represents normal messages, 3 represents replay attacks, and 4 represents spoofing attacks. Figure 10: The ROC results for stacking method. Figure 9: Comparing training and testing times in (s) for all models with and without feature selection. In Table 9, a comparison is presented of the proposed method and other promising recently proposed methods [53; 54; 55]. Evaluation metrics for the same dataset show promising results for our model. The experimental findings validate the effectiveness of the proposed IDS in detecting and classifying attacks against in-vehicle networks. Ensemble methods based on IDSs improve the efficiency with which these four attacks can be detected in the network's traffic. Bagging, voting, and stacking are the three methods utilized in the development of ensemble classifiers. The results of the evaluation demonstrate that the proposed stacking method achieved the highest multiclassification performance while requiring more training and testing time.