# An Intelligent Ensemble-Based Detection of In-Vehicle Network Intrusion
## 1 Introduction  
Vehicles are increasingly becoming a necessity in modern society. The emerging vehicular network technology supports inter-vehicle and vehicle-to-everything communication and has the potential to enhance the safety and efficiency of transportation systems [1, 2, 3, 4, 5, 6, 7, 8]. In-vehicle networks (IVNs) support intra-vehicle communication between vehicle interconnected components [9, 10]. To meet the growing need for advanced functionality, vehicles are becoming more equipped with electronic equipment. Electrical Control Units (ECUs) are significant pieces of equipment for monitoring and controlling various components. The average vehicle has between 70 and 100 ECUs, each of which transmits over 2500 signals to other units within the vehicle [11]. IVNs, which are comprised of various bus protocols, have been adopted as the framework for coordinating communication among ECUs. Enabled by actuators, sensors, and processors, IVNs facilitate information exchange services depending on the needs of drivers. Vehicle manufacturers adopt a high number of ECUs to enhance various functionalities [11, 12, 13]. For IVNs, the communication protocols utilizedinclude Controller Area Network (CAN), Local Interconnect Network (LIN), FlexRay, Ethernet, and Media-Oriented Systems Transport (MOST). The common key feature among the protocols is the transmission of messages with pre-defined time limits and message delivery reports. IVNs mainly use the CAN bus protocol, which focuses on the reliability of communication and functional safety. CAN is often adopted for multiple functionalities and control, including real-time communication for engine management, brake controls, airbag control, and control of the body system. The protocol transmits packets between ECUs through interconnected buses. It is essential to protect the communication within a vehicle since intra-vehicular communication affects the safety of drivers, passengers, and the vehicles themselves. The CAN protocol, designed for robustness, flexibility, speed, and low cost, has become a cause of concern due to a lack of security mechanisms. These mechanisms include a lack of authentication and encryption that let attackers disrupt the protocol and messages' confidentiality, integrity, and availability. The authors in [14; 15; 16; 17; 18] reported that the CAN protocol's weak security makes it a target for different attacks. The most common attack vectors include DoS, fuzzing, replay, and spoofing, which are critical due to how they can render the protocol system ineffective [19]. The protocol's broadcast transmission technique, security vulnerabilities, and unsecured priority scheme are weaknesses that further expose the CAN protocol to cyber threats. Successful attacks against the CAN protocol through injection or other vectors can enable an attacker to take control of the bus system, disable the brakes, affect acceleration and steering, or turn the lights on/off, among others. As part of a hacking experiment, a Jeep Cherokee's functions were hacked and controlled [20]. Various attacks can be launched against the CAN bus protocol because it was designed without security mechanisms. It is essential to develop highly accurate detection mechanisms for CAN bus attacks. Conventional security mechanisms, including authentication, firewalls, and encryption, are not suitable for CAN due to its structural limitations. These limitations include the absence of support for such security methods [21; 22; 23]. The 8-byte size of the CAN data frame poses limits on cryptographic message authentication. Another proposed method utilizes a convincing honeypot at the wireless gateway, but its efficacy depends on its ability to deceive assailants with its realism. In addition, a suggested firewall architecture for vehicular gateways may not offer complete protection against a variety of potential risks to the network [24].