# One-Class Classification for Intrusion Detection on Vehicular Networks

arXiv: https://arxiv.org/abs/2309.14134 · HTML: https://mlsanity.com/paper/2309.14134/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 31 references that are in the map.
- First posted on arXiv 25 Sep 2023.

## Builds on (most cited first, 6 of 6)

- [Subspace Support Vector Data Description](https://mlsanity.com/paper/1802.03989/) (2018)
- [Ellipsoidal Subspace Support Vector Data Description](https://mlsanity.com/paper/2003.09504/) (2020)
- [Graph-Embedded Subspace Support Vector Data Description](https://mlsanity.com/paper/2104.14370/) (2021)
- [Boosting rare benthic macroinvertebrates taxa identification with one-class classification](https://mlsanity.com/paper/2002.10420/) (2020)
- [Using Data Analytics to Detect Anomalous States in Vehicles](https://mlsanity.com/paper/1512.08048/) (2015)
- [Early Myocardial Infarction Detection with One-Class Classification over Multi-view Echocardiography](https://mlsanity.com/paper/2204.07253/) (2022)

## Built on by (most cited first, 2 of 2)

- [To Vaccinate or not to Vaccinate? Analyzing mathbbX Power over the Pandemic](https://mlsanity.com/paper/2503.02563/) (2025)
- [A Survey of Learning-Based Intrusion Detection Systems for In-Vehicle Network](https://mlsanity.com/paper/2505.11551/) (2025)

## Abstract (arXiv)

Controller Area Network bus systems within vehicular networks are not equipped with the tools necessary to ward off and protect themselves from modern cyber-security threats. Work has been done on using machine learning methods to detect and report these attacks, but common methods are not robust towards unknown attacks. These methods usually rely on there being a sufficient representation of attack data, which may not be available due to there either not being enough data present to adequately represent its distribution or the distribution itself is too diverse in nature for there to be a sufficient representation of it. With the use of one-class classification methods, this issue can be mitigated as only normal data is required to train a model for the detection of anomalous instances. Research has been done on the efficacy of these methods, most notably One-Class Support Vector Machine and Support Vector Data Description, but many new extensions of these works have been proposed and have yet to be tested for injection attacks in vehicular networks. In this paper, we investigate the performance of various state-of-the-art one-class classification methods for detecting injection attacks on Controller Area Network bus traffic. We investigate the effectiveness of these techniques on attacks launched on Controller Area Network buses from two different vehicles during normal operation and while being attacked. We observe that the Subspace Support Vector Data Description method outperformed all other tested methods with a Gmean of about 85%.