ML-BF: Responsive and Dynamic Intrusion Detection towards Intelligent Connected Vehicles

In recent years, intelligent connected vehicles (ICVs) have risen to prominence within vehicular networks, making them susceptible to a wide range of network attacks. Modern ICVs deploy onboard intrusion detection and share detected threats with the cloud for collaborative defense. Machine learning (ML) has been proven to improve intrusion detection performance. However, its high computational demand limits real-time detection capabilities, which are crucial for ICV security. Therefore, this paper proposes a responsive and dynamic real-time intrusion detection for the ICV system. More specifically, an ML integrating with Blacklist Filter (ML-BF) model is designed, which leverages a supervised model with feature engineering, and the Bloom filter to enhance detection and real-time performance. Moreover, the Autoencoder (AE) is used to detect unknown attacks and dynamically update signatures/rules. Experiments on Car-Hacking and CT&T datasets show that ML-BF achieves over 99.9% accuracy with microsecond-level detection time and reduces false negatives to below 0.05%, outperforming existing solutions.