# MTH-IDS: A Multi-Tiered Hybrid Intrusion Detection System for Internet of Vehicles

arXiv: https://arxiv.org/abs/2105.13289 · HTML: https://mlsanity.com/paper/2105.13289/

## Key facts

- Cited by 36 papers in the map (data through 14 Oct 2026).
- Builds on 12 of its 100 references that are in the map.
- First posted on arXiv 26 May 2021.

## Builds on (most cited first, 12 of 12)

- [On Hyperparameter Optimization of Machine Learning Algorithms: Theory and Practice](https://mlsanity.com/paper/2007.15745/) (2020)
- [GIDS: GAN based Intrusion Detection System for In-Vehicle Network](https://mlsanity.com/paper/1907.07377/) (2019)
- [A Lightweight Concept Drift Detection and Adaptation Framework for IoT Data Streams](https://mlsanity.com/paper/2104.10529/) (2021)
- [Tree-based Intelligent Intrusion Detection System in Internet of Vehicles](https://mlsanity.com/paper/1910.08635/) (2019)
- [The Theory Behind Overfitting, Cross Validation, Regularization, Bagging, and Boosting: Tutorial](https://mlsanity.com/paper/1905.12787/) (2019)
- [Multi-Stage Optimized Machine Learning Framework for Network Intrusion Detection](https://mlsanity.com/paper/2008.03297/) (2020)
- [Machine Learning Towards Intelligent Systems: Applications, Challenges, and Opportunities](https://mlsanity.com/paper/2101.03655/) (2021)
- [Edge-enabled V2X Service Placement for Intelligent Transportation Systems](https://mlsanity.com/paper/2001.06288/) (2020)
- [Bayesian Optimization with Machine Learning Algorithms Towards Anomaly Detection](https://mlsanity.com/paper/2008.02327/) (2020)
- [DNS Typo-squatting Domain Detection: A Data Analytics & Machine Learning Based Approach](https://mlsanity.com/paper/2012.13604/) (2020)
- [Multi-split Optimized Bagging Ensemble Model Selection for Multi-class Educational Data Mining](https://mlsanity.com/paper/2006.05031/) (2020)
- [Systematic Ensemble Model Selection Approach for Educational Data Mining](https://mlsanity.com/paper/2005.06647/) (2020)

## Built on by (most cited first, 30 of 36)

- [Deep transfer learning for intrusion detection in industrial control networks: A comprehensive review](https://mlsanity.com/paper/2304.10550/) (2023)
- [PWPAE: An Ensemble Framework for Concept Drift Adaptation in IoT Data Streams](https://mlsanity.com/paper/2109.05013/) (2021)
- [IoT Data Analytics in Dynamic Environments: From An Automated Machine Learning Perspective](https://mlsanity.com/paper/2209.08018/) (2022)
- [A Survey on Machine Learning-based Misbehavior Detection Systems for 5G and Beyond Vehicular Networks](https://mlsanity.com/paper/2201.10500/) (2022)
- [A Transfer Learning and Optimized CNN Based Intrusion Detection System for Internet of Vehicles](https://mlsanity.com/paper/2201.11812/) (2022)
- [Multi-Perspective Content Delivery Networks Security Framework Using Optimized Unsupervised Anomaly Detection](https://mlsanity.com/paper/2107.11514/) (2021)
- [Zero-X: A Blockchain-Enabled Open-Set Federated Learning Framework for Zero-Day Attack Detection in IoV](https://mlsanity.com/paper/2407.02969/) (2024)
- [LCCDE: A Decision-Based Ensemble Framework for Intrusion Detection in The Internet of Vehicles](https://mlsanity.com/paper/2208.03399/) (2022)
- [Constrained Twin Variational Auto-Encoder for Intrusion Detection in IoT Systems](https://mlsanity.com/paper/2312.02490/) (2023)
- [Real-Time Zero-Day Intrusion Detection System for Automotive Controller Area Network on FPGAs](https://mlsanity.com/paper/2401.10724/) (2024)
- [Towards Autonomous Cybersecurity: An Intelligent AutoML Framework for Autonomous Intrusion Detection](https://mlsanity.com/paper/2409.03141/) (2024)
- [Enabling AutoML for Zero-Touch Network Security: Use-Case Driven Analysis](https://mlsanity.com/paper/2502.21286/) (2025)
- [STC-IDS: Spatial-Temporal Correlation Feature Analyzing based Intrusion Detection System for Intelligent Connected Vehicles](https://mlsanity.com/paper/2204.10990/) (2022)
- [SecureBERT and LLAMA 2 Empowered Control Area Network Intrusion Detection and Classification](https://mlsanity.com/paper/2311.12074/) (2023)
- [Towards Zero Touch Networks: Cross-Layer Automated Security Solutions for 6G Wireless Networks](https://mlsanity.com/paper/2502.20627/) (2025)
- [A Lightweight Multi-Attack CAN Intrusion Detection System on Hybrid FPGAs](https://mlsanity.com/paper/2401.10689/) (2024)
- [Exploring Highly Quantised Neural Networks for Intrusion Detection in Automotive CAN](https://mlsanity.com/paper/2401.11030/) (2024)
- [Toward Autonomous and Efficient Cybersecurity: A Multi-Objective AutoML-based Intrusion Detection System](https://mlsanity.com/paper/2511.08491/) (2025)
- [An Automated Data Engineering Pipeline for Anomaly Detection of IoT Sensor Data](https://mlsanity.com/paper/2109.13828/) (2021)
- [Anomaly Detection in Intra-Vehicle Networks](https://mlsanity.com/paper/2205.03537/) (2022)
- [Statistical Detection of Adversarial examples in Blockchain-based Federated Forest In-vehicle Network Intrusion Detection Systems](https://mlsanity.com/paper/2207.04843/) (2022)
- [Forensic Data Analytics for Anomaly Detection in Evolving Networks](https://mlsanity.com/paper/2308.09171/) (2023)
- [Is there a Trojan! : Literature survey and critical evaluation of the latest ML based modern intrusion detection systems in IoT environments](https://mlsanity.com/paper/2310.10778/) (2023)
- [LiPar: A Lightweight Parallel Learning Model for Practical In-Vehicle Network Intrusion Detection](https://mlsanity.com/paper/2311.08000/) (2023)
- [Optimized Ensemble Model Towards Secured Industrial IoT Devices](https://mlsanity.com/paper/2401.05509/) (2024)
- [ADVENT: Attack/Anomaly Detection in VANETs](https://mlsanity.com/paper/2401.08564/) (2024)
- [Deep Learning-based Embedded Intrusion Detection System for Automotive CAN](https://mlsanity.com/paper/2401.10674/) (2024)
- [A Lightweight FPGA-based IDS-ECU Architecture for Automotive CAN](https://mlsanity.com/paper/2401.12234/) (2024)
- [Quantised Neural Network Accelerators for Low-Power IDS in Automotive Networks](https://mlsanity.com/paper/2401.12240/) (2024)
- [MKF-ADS: Multi-Knowledge Fusion Based Self-supervised Anomaly Detection System for Control Area Network](https://mlsanity.com/paper/2403.04293/) (2024)

## Abstract (arXiv)

Modern vehicles, including connected vehicles and autonomous vehicles, nowadays involve many electronic control units connected through intra-vehicle networks to implement various functionalities and perform actions. Modern vehicles are also connected to external networks through vehicle-to-everything technologies, enabling their communications with other vehicles, infrastructures, and smart devices. However, the improving functionality and connectivity of modern vehicles also increase their vulnerabilities to cyber-attacks targeting both intra-vehicle and external networks due to the large attack surfaces. To secure vehicular networks, many researchers have focused on developing intrusion detection systems (IDSs) that capitalize on machine learning methods to detect malicious cyber-attacks. In this paper, the vulnerabilities of intra-vehicle and external networks are discussed, and a multi-tiered hybrid IDS that incorporates a signature-based IDS and an anomaly-based IDS is proposed to detect both known and unknown attacks on vehicular networks. Experimental results illustrate that the proposed system can detect various types of known attacks with 99.99% accuracy on the CAN-intrusion-dataset representing the intra-vehicle network data and 99.88% accuracy on the CICIDS2017 dataset illustrating the external vehicular network data. For the zero-day attack detection, the proposed system achieves high F1-scores of 0.963 and 0.800 on the above two datasets, respectively. The average processing time of each data packet on a vehicle-level machine is less than 0.6 ms, which shows the feasibility of implementing the proposed system in real-time vehicle systems. This emphasizes the effectiveness and efficiency of the proposed IDS.