A Lightweight and Responsive On-Line IDS Towards Intelligent Connected Vehicles System

The current intelligent connected vehicles (ICV) system often shares the detected intrusion event to the cloud for further collaborative investigation. The upstream channel leading to the Internet of Vehicles (IoV) cloud is typically vendor-proprietary and costly, and the congestion caused by false alarms even exacerbates the situation. Machine learning (ML) can improve intrusion detection performance by reducing the false alarm rate. However, as a computation-intensive approach, traditional ML is not appropriate for real-time detection. Therefore, this paper proposes a lightweight and responsive on-line intrusion detection approach aiming for the ICV system requiring real-time detection. More specifically, we design a model termed Machine Learning integrated with Blacklist Filter (ML-BF), which leverages the feature engineering and the Bloom filter techniques built on ML to enhance both detection and real-time performances. To evaluate the proposed solution, several experiments are conducted by using the Car-Hacking and CIC-IDS-2017 datasets. The experimental results show that our approach can detect intrusion at a microsecond level with a lower computational cost as well as a lower false positive rate than that in the state-of-the-art.