# An Intelligent Ensemble-Based Detection of In-Vehicle Network Intrusion
## 5 Results and Discussion
The stacking model with feature selection has the highest performance for the replay attack, with precision, recall, and F1-score values of 0.97, 1.00, and 0.99, respectively. With precision, recall, and F1-scores of 0.94, 1.00, and 0.97, respectively, the XGBoost model with feature selection has the second-best performance. The stacking model with feature selection achieves the highest performance in detecting all types of attacks, making it the best model among those considered. The XGBoost model with feature selection is the second-best model, as it detects all types of attacks effectively. The performance of the RF and DT models is comparable across all attacks, with the exception of the fuzzing attack, where they perform slightly worse. The bagging and voting methods have the lowest performance among those evaluated. The evaluation results for each attack using the supervised models and ensemble methods without and with feature selection are shown in Tables 6 and 7, respectively. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Model** & **Attacks** & **Precision** & **Recall** & **F1-Score** \\ \hline \multirow{4}{*}{RF} & Flooding & 1.00 & 1.00 & 1.00 \\ \cline{2-5}  & Fuzzing & 0.99 & 1.00 & 1.00 \\ \cline{2-5}  & Normal & 1.00 & 0.92 & 0.96 \\ \cline{2-5}  & Replay & 0.92 & 0.99 & 0.96 \\ \cline{2-5}  & Spoofing & 1.00 & 1.00 & 1.00 \\ \hline \multirow{4}{*}{DT} & Flooding & 1.00 & 1.00 & 1.00 \\ \cline{2-5}  & Fuzzing & 1.00 & 0.99 & 0.99 \\ \cline{2-5}  & Normal & 1.00 & 0.92 & 0.96 \\ \cline{2-5}  & Replay & 0.92 & 0.99 & 0.95 \\ \cline{2-5}  & Spoofing & 0.99 & 1.00 & 0.99 \\ \hline \multirow{4}{*}{XGBoost} & Flooding & 1.00 & 1.00 & 1.00 \\ \cline{2-5}  & Fuzzing & 1.00 & 1.00 & 1.00 \\ \cline{2-5}  & Normal & 1.00 & 0.92 & 0.96 \\ \cline{2-5}  & Replay & 0.93 & 1.00 & 0.96 \\ \cline{2-5}  & Spoofing & 1.00 & 1.00 & 1.00 \\ \hline \multirow{4}{*}{Stacking} & Flooding & 1.00 & 1.00 & 1.00 \\ \cline{2-5}  & Flooding & 1.00 & 1.00 & 1.00 \\ \cline{1-1} \cline{2-5}  & Fuzzing & 0.99 & 1.00 & 0.99 \\ \cline{1-1} \cline{2-5}  & Normal & 0.99 & 0.92 & 0.96 \\ \cline{1-1} \cline{2-5}  & Replay & 0.92 & 0.98 & 0.95 \\ \cline{1-1} \cline{2-5}  & Spoofing & 1.00 & 1.00 & 1.00 \\ \hline \multirow{4}{*}{Bagging} & Flooding & 1.00 & 1.00 & 1.00 \\ \cline{1-1} \cline{2-5}  & Fuzzing & 0.99 & 1.00 & 0.99 \\ \cline{1-1} \cline{2-5}  & Normal & 0.99 & 0.92 & 0.96 \\ \cline{1-1} \cline{2-5}  & Replay & 0.92 & 0.98 & 0.95 \\ \cline{1-1} \cline{2-5}  & Spoofing & 1.00 & 1.00 & 1.00 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: The evaluation results for each attack using the supervised models and ensemble methods without feature selection. Figure 9 shows that incorporating feature selection into models and ensemble methods demonstrates that it reduces training and testing time for all models. The additional training time required for the stacking method with feature selection is a trade-off for improved performance. The stacking strategy requires the longest training time. Stacking is a technique that requires two distinct stages of training. In our experiment, there are three base classifiers and one meta-learner. Incorporating feature selection into models and ensemble methods reduces training and testing time. The use of tree-based models (RF, \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Model** & **Attacks** & **Precision** & **Recall** & **F1-Score** \\ \hline \multirow{6}{*}{Voting} & Flooding & 0.99 & 1.00 & 0.99 \\ \cline{2-5}  & Fuzzing & 1.00 & 0.99 & 0.99 \\ \cline{2-5}  & Normal & 1.00 & 0.89 & 0.94 \\ \cline{2-5}  & Replay & 0.90 & 0.99 & 0.95 \\ \cline{2-5}  & Spoofing & 1.00 & 1.00 & 1.00 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: _Cont._