# An Intelligent Ensemble-Based Detection of In-Vehicle Network Intrusion
## 3 Related Work  
In a review of IDS for vehicular networks, [PERSON] et al. [47] emphasized the importance of addressing cyber-physical threats and exploring IDS mechanisms for vehicular communication from multiple perspectives. They identified gaps in real-world validation and highlighted the significance of implementation and testing to verify IDS effectiveness. To detect in-vehicle attacks, the authors in [48] presented a deep convolutional neural network (DCNN) approach called Reduced Inception-ResNet. Compared to Naive Bayes (NB), Support Vector Machine (SVM), Decision Tree (DT), and Artificial Neural Network (ANN), this method outperformed the others in terms of detection accuracy. However, more improvement is needed to investigate the performance of various types of CAN bus attacks, and the imbalance of data between malicious and normal samples prevents these models from performing accurate intrusion detection techniques. In [49], a lightweight ML algorithm based on RNN is proposed for IDS on the CAN bus network. To obtain the highest effective results in detection performance, the authors combined the security control unit (SECCU) and the simplified attention (SIMATT) algorithms. The proposed model outperformed Long Short-Term Memory (LSTM), Gated Recurrent Unit (GRU), GAN-Based Intrusion Detection System (GIDS), and RNN in terms of performance metrics. The authors in [50] proposed a CAN-bus intrusion-based LSTM deep learning model. The model can detect three types of attacks: DoS, fuzzing, and spoofing. However, no feature selection or data balance is used. In [51], the authors proposed an IDS that utilizes RNN and LSTM. The selected model provided intrusion detection against CAN bus spoofing attacks; however, further research is required to detect additional types of cyberattacks. In [52], the authors presented CANintelliiIDS, a method for detecting CAN bus intrusions based on CNN and attention-based gated recurrent unit (AGRU) models. The main focus of the model was detecting DoS, fuzzing, and impersonation attacks. In terms of performance metrics, the model outperformed RF, SVM, CNN, and Logistic Regression. In [53], CAN-bus intrusion based on the application of Recurrence Quantification Analysis (RQA) to detect spoofing attacks is proposed. The RQA-based approach obtained good detection accuracy. The author focused on spoofing attacks, but other attacks need to be considered. CNN and LSTM are types of deep learning models that have been integrated and proposed as methods for defending IVNs against a variety of cyberattacks [54]. These attacks include replay, DoS spoofing, and fuzzing attacks. They were able to detect all four attacks with an accuracy score of 97.30%. In [55], the authors proposed a graph-based IDS, and they utilized KNN and SVM to detect and identify attack messages broadcast on the CAN bus. This was conducted by turning the messages received from the CAN bus into a temporal graph; however, no hyperparameter tuning or data balancing were performed. IDS models have shown potential in previous research; however, they frequently lack an integrated framework that combines feature selection, data balancing, and systematic hyperparameter optimization across diverse attack types. Additionally, most studies focus on specific types of attacks or employ a single ensemble strategy. In contrast, our study integrates three ensemble methodologies, stacking, bagging, and voting, alongside rigorous preprocessing techniques to detect all four major CAN bus attacks (DoS, fuzzing, spoofing, and replay). This work aims to evaluate a comprehensive and multifaceted ensemble IDS on real-world CAN data. Authors in [56] have introduced an enhanced SVM-based IDS model for the CAN bus system. On the actual dataset, the model performed well and was robust to only DoS attacks on electric vehicles. Several studies [51; 53; 56] focus on a single type of attack, such as spoofing or DoS attacks. The CAN bus, however, is vulnerable to various attacks. While Refs.