A Stacked Machine Learning-Based Intrusion Detection System for Internal and External Networks in Smart Connected Vehicles

In response to the escalating threat of cyberattacks on smart connected vehicles, numerous Intrusion Detection Systems (IDSs) have emerged. However, existing IDSs often prioritize enhancing detection accuracy while overlooking the time needed for training and detection. Moreover, they may not fully leverage the combined utilization of CAN bus IDs and the data field with external network data. Consequently, these systems frequently struggle to meet the real-time demands and broader attack scenarios inherent in in-vehicle systems. To overcome these challenges, we propose a stacked-model IDS architecture deployed across the CAN bus and central gateway, capable of detecting both internal and external vehicular network attacks. The system extracts key features from in-vehicle and external network data, builds base learners (CART, LightGBM, XGBoost), and integrates them through stacking with a meta-learner. Feature selection and training efficiency are enhanced using information gain and maximal information coefficient algorithms. Experiments show that the proposed IDS achieves an average detection accuracy of 99.99% for internal CAN bus attacks and 99.81% for external network attacks, with fast detection times of 0.018 ms and 0.088 ms, respectively. These results highlight the system’s real-time capability, high accuracy, and adaptability to complex attack scenarios.