Performance

Metric	Tier 1 (Multi-Class)	Tier 2 (Anomaly)
Accuracy	0.9586	0.6103
F1 (weighted)	0.9584	0.7035
Precision	0.9597	0.9243
Recall	0.9586	0.5678

Base Learner Validation Accuracies

Model	Accuracy
Decision Tree	0.9664
Random Forest	0.9690
Extra Trees	0.9690
XGBoost	0.9689

Attack Types Detected

Attack	Description	Detection
DoS	Flood CAN bus with dominant ID (0x0000) every 0.3ms	Signature (Tier 1)
Fuzzy	Random CAN ID and data injection every 0.5ms	Signature (Tier 1)
RPM Spoofing	Inject fake RPM gauge values every 1ms	Signature (Tier 1)
Gear Spoofing	Inject fake drive gear values every 1ms	Signature (Tier 1)
Unknown/Zero-Day	Any novel attack pattern	Anomaly (Tier 2)

Usage

python

import pickle
import pandas as pd
from inference import load_model, preprocess, predict

# Load model
model = load_model('vehicle_ids_model.pkl')

# Load CAN bus data (CSV format: timestamp, can_id, dlc, d0-d7, flag)
df = pd.read_csv('can_traffic.csv')

# Preprocess and predict
X = preprocess(df, model)
results = predict(X, model)

# Results contain: attack_type, anomaly_score, is_anomaly, alert
# alert values: NORMAL, KNOWN_ATTACK, UNKNOWN_ATTACK
print(results['alert'].value_counts())

Input Format

CAN bus message CSV with columns:

timestamp: Recording time (seconds)
can_id: CAN identifier in HEX (e.g., "043F")
dlc: Data Length Code (0-8)
d0-d7: Data bytes in HEX (e.g., "FF")
flag: R (normal) or T (injected/attack)

Feature Engineering

10 features extracted from raw CAN messages:

CAN ID (decimal), DLC
8 data bytes (decimal)
Statistical features: mean, std, min, max, range, sum of data bytes
Temporal: inter-arrival time (IAT)
Frequency: CAN ID frequency in traffic
Information-theoretic: data byte entropy

Training Details

Dataset: ~1,077,264 CAN bus messages (HCRL Car-Hacking format)
Train/Val/Test split: 70/15/15
SMOTE for class imbalance handling
Feature selection via Mutual Information
Z-score normalization

References

Li et al., "MTH-IDS: A Multi-Tiered Hybrid Intrusion Detection System for IoV", IEEE IoT Journal, 2021. arXiv:2105.13289
Seo et al., "GIDS: GAN based IDS for In-Vehicle Network", PST 2018. arXiv:1907.07377
Song et al., "In-vehicle network intrusion detection using deep CNN", Vehicular Communications, 2020.

anddali/vehicle-ids-anomaly-detector

Vehicle Intrusion Detection System (IDS) — Anomaly Detector

Architecture

Tier 1: Signature-Based IDS (Multi-Class Classification)

Tier 2: Anomaly-Based IDS (Zero-Day Detection)

Combined Detection

Performance

Base Learner Validation Accuracies

Attack Types Detected

Usage

Input Format

Feature Engineering

Training Details

References

anddali/
vehicle-ids-anomaly-detector