# An Intelligent Ensemble-Based Detection of In-Vehicle Network Intrusion
## 1 Introduction
Encryption and authentication-based IVN security solutions, firewall structures, and IVN Intrusion Detection Systems (IDSs) are security solutions discussed in [25]. Encryption and authentication are inapplicable due to the limited resources of IVNs, whereas firewalls are impracticable due to a long vehicle lifecycle and numerous attack surfaces. The authors recommend utilizing an IDS for IVNs to defend against intrusions in resource-constrained environments. According to the study in [26], automotive IDS, including those that utilize machine learning algorithms, have the capability to fulfill the requirements of the industry in terms of being cost-effective, lightweight, and working in real time. The study evaluates a variety of intrusion detection technologies, including machine learning approaches, and suggests their implementation in the automotive industry. One of the security mechanisms that has received attention among researchers is the use of IDSs. These mechanisms have been researched and created to advance security against the increasing number of attacks leveled against networks. IDSs monitor networks to identify malicious activities, such as information theft, censorship, or protocol tampering, with the major focus being the detection of anomalous behavior and recording information. IDSs are implemented as network-level defense mechanisms for computer resources. The characteristics and capabilities of IDSs make them suitable for detecting anomalies in common networks. However, in networks that face new and complicated cyberattacks, IDSs need integration with novel technologies to enhance their effectiveness and accuracy in the detection results. For instance, ensemble learning can be used to obtain better detection results for IDSs. The main objective of ensemble learning is to enhance the accuracy of classification by combining multiple classifiers into one model. The ensemble learning method allows for multiple mechanisms of learning with varying strengths to support one another, which leads to increased prediction reliability. In [18; 27; 28; 29; 30; 31], the authors demonstrated that the utilization of ensemble methods has resulted in enhanced accuracy in intrusion detection compared to the utilization of individual classifiers. In this study, we propose a scheme that utilizes well-tuned hyperparameters, feature selection, supervised models, and ensemble methods to build an effective IDS framework for classifying DoS, fuzzing, replay, and spoofing attacks on the CAN bus. We combine Random Forest (RF), Xtreme Gradient Boosting (XGBoost), and Decision Tree (DT) models using stacking, voting, and bagging methods. The following is an illustration of our contributions:  
* We develop and test three supervised models that include hyperparameter tuning, balancing of data, and feature selection. The models are RF, DT, and XGBoost. * With three different ensemble methods, we combine the three supervised models to enhance our scheme's ability to detect DoS, fuzzing, replay, and spoofing attacks. These ensemble methods are stacking, voting, and bagging. * We evaluate our scheme's performance using accuracy, precision, recall, F1-score, and area-under-the-curve receiver operator characteristic (ROC-AUC). Our scheme detected DoS, fuzzing, replay, and spoofing attacks with a higher detection accuracy score of 0.986 compared to the most recent study proposed for detecting attacks in the CAN bus. This study's remaining sections are organized as follows: Section 2 describes CAN's background and attack types. Section 3 discusses the related work. The models proposed are illustrated in Section 4. Section 5 contains the results and analysis. Section 6 finally concludes the paper.