# An Intelligent Ensemble-Based Detection of In-Vehicle Network Intrusion
## 6 Conclusions  
The CAN bus is vulnerable to various attacks as it lacks security features. We proposed a multi-classification intrusion detection system based on an ensemble learning solution to detect common CAN bus attacks (DoS, fuzzing, replay, and spoofing). We design an effective ensemble learning-based IDS scheme for classifying DoS, fuzzing, replay, and spoofing attacks. These are common CAN bus attacks that can threaten the safety of a vehicle's driver, passengers, and pedestrians. Feature selection, data balancing, and hyperparameter tuning were all used to enhance the proposed scheme. The combination of these techniques and the ensemble learning methods resulted in a robust and accurate multi-classification IDS for common CAN bus attacks. With an F1-score of 0.993, precision of 0.993, recall of 0.993, and accuracy of 0.986, the stacking method outperformed other recently proposed methods, achieving the highest performance. However, stacking requires  
\begin{table}
\begin{tabular}{c c c c c c c} \hline
**Citation** & **Attacks** & **Model** & **Precision** & **Recall** & **F1-Score** & **ROC** \\ \hline \multirow{4}{*}{[54]} & Benign & & 0.99 & 1.00 & 99 & 1.00 \\ \cline{2-7}  & Flood & CNN-LSTM & 0.66 & 11 & 18 & 0.77 \\ \cline{2-7}  & Fuzzing & & 97 & 1.00 & 0.99 & 0.91 \\ \cline{2-7}  & \multicolumn{4}{c}{Accuracy} & \multicolumn{4}{c}{0.9730} \\ \hline \multirow{4}{*}{[55]} & DoS & SVM & 0.99 & 0.99 & 0.99 & 0.99 \\ \cline{2-7}  & KNN & 0.99 & 0.99 & 0.99 & 0.99 \\ \cline{2-7}  & Fuzzing & SVM & 0.99 & 0.99 & 0.99 & 0.99 \\ \cline{2-7}  & KNN & 0.99 & 0.98 & 0.99 & 0.98 \\ \cline{2-7}  & SVM & 0.97 & 0.93 & 0.95 & 0.93 \\ \cline{2-7}  & KNN & 0.97 & 0.93 & 0.95 & 0.93 \\ \cline{2-7}  & KNN & 0.98 & 0.96 & 0.97 & 0.96 \\ \cline{2-7}  & \multicolumn{4}{c}{Accuracy} & \multicolumn{4}{c}{0.9792} \\ \cline{2-7}  & SVM & 0.98 & 0.96 & 0.97 & 0.96 \\ \cline{2-7}  & Accuracy & \multicolumn{4}{c}{0.9799} \\ \hline \multirow{4}{*}{Our} & Flood & 1.00 & 1.00 & 1.00 & 1.00 \\ \cline{2-7}  & Fuzzing & 1.00 & 1.00 & 1.00 & 1.00 \\ \cline{2-7}  & Normal & Stacking & 1.00 & 1.00 & 1.00 \\ \cline{2-7}  & Replay & 1.00 & 0.97 & 0.98 & 1.00 \\ \cline{2-7}  & Spoofing & 1.00 & 1.00 & 1.00 & 1.00 \\ \cline{2-7}  & Accuracy & \multicolumn{4}{c}{0.986} \\ \hline \end{tabular}
\end{table}
Table 9: _Cont._more training and testing time. While our results are promising, we acknowledge that the evaluation was conducted using a single dataset. Although the dataset is realistic and comprehensive in terms of attack types, this limitation may affect the generalizability of our findings. In future work, we aim to validate our IDS framework on multiple CAN bus datasets or in simulated real-time environments to ensure broader applicability and robustness.  
Conceptualization, E.A. and I.M.; methodology, E.A. and I.M.; software, E.A.; validation, E.A. and I.M.; formal analysis, E.A. and I.M.; investigation, E.A., I.M., B.A., and A.A.; writing--original draft preparation, review and editing, I.M.; visualization, E.A., B.A., and A.A.; supervision, I.M. and E.A.; writing--project administration, I.M. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
Not applicable.  
Data Availability StatementData available upon request.  
This work is part of the Smart Drive initiative at Tecore Networks Lab at Florida Atlantic University.  
The authors declare that they have no conflicts of interest.