# Hierarchical Federated Learning-Based Intrusion Detection for In-Vehicle Networks
## 1 Introduction  
The number of connected and autonomous vehicles (CAVs) is experiencing rapid growth globally. This surge in reliance on electronics and software within modern automotive systems introduces cybersecurity risks that were not previously considered in their design and engineering [1]. A recent report estimates that the global market for connected vehicles will grow to approximately USD 244 billion by 2030 [2]. The controller area network (CAN) bus has emerged the primary protocol for in-vehicle communication because of its simplicity and efficiency. However, it lacks essential security features such as authentication and encryption [3], making it vulnerable to cyberattacks that can have severe consequences, including loss of life [4, 5]. Intrusion detection systems (IDSs) are an effective method for detecting these threats within in-vehicle networks. Despite significant advancements in machine learning and deep learning for IDSs, challenges related to data privacy and communication efficiency remain. Federated learning (FL) offers a promising solution by enabling local model training while preserving the privacy of raw data [6]. FL addresses key limitations of centralized IDS approaches and is particularly well suited for in-vehicle networks for several compelling reasons:  
* Privacy Preservation:Regulations such as the general data protection regulation (GDPR), California consumer privacy act (CCPA), personal information protection and electronic documents act (PIPEDA), and Brazilian general data protection law(LGPD) safeguard sensitive data from unauthorized movement. FL enhances privacy by transmitting only learned parameters to the cloud server instead of raw data, thereby improving data protection [7].
* Reduced latency: By processing data locally and only sending model updates, FL reduces latency compared to traditional centralized approaches that require sending raw data to a central server [7].
* Compliance with guidelines: According to the 2020 guidelines of the International Telecommunication Union, an in-vehicle IDS must have the ability to regularly update its set of rules [8]. FL facilitates these updates by allowing continuous learning and model refinement.
* Adaptability to new attacks: FL enhances IDS adaptability to new, unseen attacks by updating local models with those trained on newly identified threats. These continuous updates ensure effective responses to evolving threats.
* Diverse driving scenarios: FL facilitates the training of a universal model that encompasses various driving scenarios, vehicle states, and driving behaviors.  
Numerous studies have developed FL-based IDSs for in-vehicle networks [9; 10; 11; 12; 13; 14]. However, they all utilize the standard FL architecture. To the best of our knowledge, this is the first study to introduce the H-FL framework for an in-vehicle IDS and to deploy and evaluate IDS performance within this architecture. The aim of this paper is to introduce and deploy our proposed IDS in [15] in the H-FL environment, evaluating its performance. The main contributions are summarized as follows:  
* Deployment and evaluation of our proposed multistage IDS in an H-FL environment.
* Distribution of data across clients with three levels of non-IID data distributions, making the scenario more realistic.
* Performance evaluation of the IDS in the H-FL environment for both seen and unseen attack detection.
* Assessing IDS performance under different levels of non-IID data distribution.  
The remainder of this paper is organized as follows. Section 2 provides context and background on FL, followed by a discussion of related work. Section 3 describes our overall methodology, followed by experimental results and evaluation in Section 4. Finally, Section 5 concludes the paper.