The Internet of Vehicles (IoV), integrating vehicles with EV charging stations, faces significant vulnerabilities to cyber threats. Designing an eficient Intrusion Detection System (IDS) to detect sophisticated attacks within EV charging stations is crucial for safeguarding this interconnected network. However, creating IDS models using centralized machine learning approaches requires overcoming challenges such as scalability, time-consuming analysis, and real-time processing requirements. In this context, we propose a novel distributed system to IDS design for the IoV, leveraging distributed learning techniques to address these challenges and enhance EV charging station security. This study utilizes diferent machine learning models to improve the efectiveness of abnormal behavior detection. Based on the robustness and adaptability of machine learning models, the detection and classification of intrusion data are significantly enhanced. Our presented system is validated using the CICEV2023 dataset. Simulation results demonstrate that our algorithm achieves higher eficiency and accuracy compared to existing centralized schemes.
Learning
With increasing cyber threats in the era of connectivity, efective security measures within the Internet
of Vehicles (IoV) are critical [
Intrusion Detection Systems (IDS) play a crucial role in detecting and preventing cyber attacks in the
IoV [
However, current IDS approaches face challenges such as scalability and time-consuming analysis,
calling for more eficient solutions[
CEUR
ceur-ws.org
The main contribution of this paper is the introduction of a novel IDS design that integrates distributed
learning techniques and machine learning models to enhance security within the IoV. We validate
our proposed system using the CICEV2023 dataset [
The paper is structured as follows: Section 2 outlines the theoretical foundations and previous works related to the proposed system. Section 3 presents the proposed system, detailing the methodology and design modules. Section 4 of the study includes a discussion on the dataset used, validation of the proposed method, and the subsequent discussion of the findings. Finally, Section 5 concludes the paper by summarizing the main findings, highlighting the contributions, and suggesting future research directions.
The IoV is a rapidly evolving domain that integrates vehicles, infrastructure, and communication technologies. This integration creates a complex, interconnected environment where robust cybersecurity is paramount. Ensuring cybersecurity in the IoV is crucial, and intrusion detection plays a vital role in identifying and mitigating cyber threats. In this literature review, we systematically examine key research studies that have advanced intrusion detection techniques tailored specifically for the IoV environment.
Alladi et al. [
Yang et al. conducted multiple studies focusing on intrusion detection in the IoV. In their study
[
Laisen et al. [14] designed a data-driven IDS for the IoV using Convolutional Neural Networks (CNNs) to analyze RSU link load behaviors and achieve efective intrusion detection. Ullah et al. [ 15] proposed a hybrid deep learning model leveraging LSTM and GRU architectures, achieving high accuracy in detecting DDoS attacks and car hacks. Li et al. [16] addressed the challenge of updating intrusion detection models in the IoV by proposing model update schemes utilizing labeled and unlabeled data. Ahmed et al. [17] developed a deep learning-based IDS for the IoV’s CAN, detecting malicious attacks and ensuring trust, privacy, and data integrity. These studies contribute to IoV security by employing deep learning techniques for intrusion detection.
The limitations of existing intrusion detection techniques and systems in the IoV, including scalability issues, big datasets, and computational requirements, can be mitigated through the use of distributed intrusion detection systems. By distributing the detection mechanisms across multiple nodes or devices within the IoV infrastructure, these systems can handle large-scale deployments, efectively process and analyze massive amounts of data, and leverage the collective processing power of multiple nodes. This approach enables improved scalability, eficient handling of big datasets, and the ability to meet the computational demands of intrusion detection in the IoV environment.
Our proposed approach addresses the research gaps in IDS for the IoV by leveraging distributed learning techniques and addressing challenges associated with centralized machine learning approaches. We introduce a novel distributed system for IDS design in the IoV, improving scalability, time-consuming analysis, and real-time processing. By utilizing diferent machine learning models, we enhance the detection and classification of intrusion data, ensuring a more efective defense against potential attacks in the dynamic IoV environment. Additionally, our approach prioritizes trust and data integrity in the IoV ecosystem, contributing to a comprehensive and accurate IDS solution.
Despite the significant advancements highlighted in the literature, substantial challenges remain. Future research must focus on refining the integration of distributed architectures with advanced machine learning models to not only improve scalability and detection accuracy but also to minimize computational overhead. Moreover, real-world validations and longitudinal studies are essential to ensure that these systems can adapt to evolving threat landscapes and dynamic network conditions. Addressing these challenges will be crucial for translating theoretical advances into practical, resilient security solutions that can safeguard the IoV ecosystem in an increasingly interconnected world.
Our objective is to advance intrusion detection within the IoV by integrating theoretical foundations with practical applications. To achieve this, we propose a cluster-based distributed system, which includes master and worker nodes. In our methodology, the cluster is divided into these nodes, with the workers responsible for training the intrusion detection model using local data. Model updates, such as parameters or gradients, are subsequently transmitted to the master node to form the global model. This collaborative approach enhances security and communication system reliability, bolstering the IoV’s scalability.
The data pre-processing layer ensures that the collected data from the CICEV2023 DDoS attack dataset is clean, well-structured, and compatible for analysis within our DL IDS. The pre-processing steps include data cleaning, where irrelevant or noisy data is removed and missing values are handled appropriately. Encoding techniques are applied to categorical variables to convert them into numerical format, ensuring compatibility with machine learning algorithms. Additionally, time series management techniques are employed to organize the data into time-stamped sequences, allowing for the detection of temporal patterns associated with DoS/DDoS attacks. These pre-processing steps are essential for preparing the data for input into our DL IDS, ensuring that it can efectively detect and respond to security threats in the IoV environment. Notably, these pre-processing steps are eficiently carried out using Apache Spark, a distributed computing framework, enabling scalability and high-performance processing of large-scale datasets.
The Distributed Learning Layer in our approach involves the collaborative training of machine learning models by distributed entities within a Spark-based cluster. This process utilizes the parallel processing capabilities of Apache Spark to train the models eficiently and efectively. In a Spark-based cluster, the training data is distributed across multiple nodes, with each node being responsible for processing a subset of the data. The Spark framework manages the distribution of the data and the coordination of the training process across the cluster. During training, each node independently updates its portion of the model using local data. These updates, such as model parameters or gradients, are then aggregated at a master node to create a global model. This collaborative approach to training allows for the eficient use of computational resources and enables the training of large-scale machine learning models on big data. Furthermore, the distributed nature of the training process enhances the scalability of our approach, allowing for the training of complex models on large datasets. Additionally, by leveraging Spark’s fault-tolerant capabilities, our approach ensures that the training process is robust and reliable, even in the presence of node failures or network issues.
The Detection Layer in our approach is where the trained machine learning models are applied to detect DoS and DDoS attacks targeting EV charging stations within the IoV environment. This layer involves the following key components and processes: • Model Application: The trained machine learning models, which have been developed and optimized during the training phase, are applied to the incoming data streams from EV charging stations. These models analyze the data in real-time to detect patterns and anomalies indicative of DoS/DDoS attacks. • Real-time Monitoring: The Detection Layer continuously monitors the data streams from EV charging stations for any suspicious activity or deviations from normal behavior. This real-time monitoring allows for the immediate detection and response to potential attacks, minimizing the impact on the IoV environment. • Alert Generation: When a potential attack is detected, the Detection Layer generates alerts or notifications to alert the system administrators. These alerts provide details about the detected attack, including the type of attack and the afected EV charging stations, enabling timely and efective response actions.
Algorithm 1 provides an overview of the distributed training process for a machine learning-based IDS tailored for EV charging stations within the IoV. This subsection delves deeper into the workings of this algorithm, focusing on its implementation and the intricacies of training a model that can efectively detect and mitigate attacks in real-time.
In the data collection phase, we obtained a comprehensive dataset named CICEV2023, which ofers critical insights into the vulnerabilities inherent in EV charging infrastructure. This dataset was meticulously curated to capture a wide range of attack scenarios, making it an invaluable resource for developing and validating our IDS. To develop an IDS, we performed extensive preprocessing to ensure the dataset’s quality and compatibility with machine learning algorithms.
The dataset used for analyzing IDS performance encompasses various attack characteristics and scenarios. It includes both full-scale attacks, where multiple charging stations are simultaneously targeted, and more subtle random attacks that simulate targeted breaches. Additionally, attacks are categorized based on their statistical distribution: Gaussian attacks, which mimic normal operational patterns, and non-Gaussian attacks, which deviate significantly from typical behavior. Within this dataset, four primary attack scenarios were examined: the correct ID of the EV, wrong ID of the EV, wrong timestamp of the EV, and wrong timestamp of the charging station (CS). These scenarios were carefully selected to reflect both common vulnerabilities and critical edge cases within the IoV ecosystem.
The collected data underwent a series of rigorous preprocessing steps, which include combining the Normal and Attack data frames into a single, unified data frame, analyzing the data frame’s structure and intrinsic properties, removing duplicate columns to eliminate redundancy, converting time columns to datetime objects, adjusting for timezone diferences, and calculating relevant durations. This comprehensive preprocessing pipeline ensures that the dataset is robust and well-suited for end for model ′ .
= 1 ∑=1 ′
Aggregate the local models ′ from all selected charging stations: Algorithm 1 Distributed Training Process for EV Charging Station IDS
4: for = 1 to do
Client Selection: 2: Initialize a global model at the master node (server). 28: Repeat the training process for a predefined number of rounds or until convergence criteria are
Randomly select a subset of charging stations from the network to participate in the training process.
for each selected charging station do
Download the current global model from the master node.
Perform local model training on the charging station’s local dataset to obtain a new local Upload the aggregated model to the master node.
The master node updates the global model: = + ⋅ (
− ) , where is the learning rate. 19: end for 20: Intrusion Detection and Notification: 21: for each new data sample received from a charging station do
Use the global model to predict whether the sample is normal or an attack. if an attack is detected then
Notify nearby vehicles in the network to avoid using the compromised charging station. advanced machine learning analyses, ultimately enhancing the reliability of our intrusion detection
To validate the efectiveness of the proposed system, a series of experiments and evaluations were conducted. The dataset was divided into training and testing sets to ensure representative and unbiased training of the IDS. The training set was used to train the 20 machine learning models, while the testing set was employed to evaluate the performance of the IDS.
Various performance metrics were employed to assess the efectiveness of the proposed system. These metrics included accuracy, precision, recall, and F1-score, as shown in Figure 2. Accuracy measures the overall correctness of the IDS in classifying attacks and normal behavior. Precision examines the proportion of correctly classified attacks out of all detected attacks, while recall calculates the proportion of correctly classified attacks out of all actual attacks. The F1-score combines precision and recall to provide an overall measure of the IDS’s performance.
The bar chart in Figure 3 provides a visual representation of the accuracy levels achieved by several models in intrusion detection. It reveals variations in performance among diferent models, with some, such as LGBM, XGB, DecisionTree, RandomForest, and ExtraTrees, demonstrating high accuracy. However, other models, like Ridge, QDA, BernoulliNB, and GaussianNB, exhibit relatively lower accuracy. This chart provides valuable insights into the relative performance of diferent models, assisting in the identification of suitable options for efective intrusion detection tasks.
The results obtained from the validation process serve as a strong validation of the proposed system’s capabilities and contribute to its credibility and reliability in real-world intrusion detection scenarios.
Our proposed system takes a novel approach by leveraging distributed learning techniques to design an eficient Intrusion Detection System (IDS) for EV charging stations within the IoV.
In comparing our results to existing solutions, we have achieved notably higher levels of eficiency and accuracy in detecting and classifying intrusion data. Our system leveraged a diverse set of machine learning models, which contributed to the enhanced performance of our intrusion detection system (IDS). The accuracy of our IDS ranged from 59.77% to 99.91%, with an average accuracy of 89.96%. To provide a comprehensive overview and facilitate a more intuitive understanding of the advancements made, we have included Table 1 below. This table showcases the accuracies reported for the existing approaches, underscoring the significant progress achieved in the field and the efectiveness of our proposed methodology.
While the specific metrics for each existing solution were not provided in the literature review, our system achieved high accuracy rates while maintaining a balance between precision and recall. This indicates that our IDS has a low false positive rate (precision) while efectively detecting a high proportion of actual attacks (recall). The F1-score, which combines precision and recall into a single measure, further demonstrates the overall performance of our system.
By leveraging distributed learning, our system overcomes the limitations of centralized machine learning approaches used in some existing solutions. This allows for eficient and real-time processing of data, enhancing the efectiveness of abnormal behavior detection within EV charging stations. Our results demonstrate the efectiveness of our system in enhancing the security of EV charging stations within the interconnected network of the IoV.
In conclusion, this study presents a robust distributed learning-based IDS framework that significantly enhances the security of EV stations within the IoV. By addressing the limitations of centralized machine learning approaches, the proposed framework improves the efectiveness of abnormal behavior detection and intrusion data classification. The presented system, validated using the CICEV2023 dataset, achieves higher eficiency and accuracy compared to existing centralized schemes. Additionally, the framework demonstrates its eficacy in detecting and mitigating DoS and DDoS attacks through the utilization of the CICEV2023 DDoS Attack Dataset and Apache Spark for data preprocessing and distributed training.
This research contributes substantially to the field of IoV security by ofering a comprehensive solution that not only fortifies EV charging stations but also reinforces the overall integrity of vehicular networks. By leveraging distributed learning, our approach enhances scalability and ensures real-time responsiveness, which are critical for defending against rapidly evolving cyber threats in a highly interconnected environment.
Looking ahead, future research should focus on further optimizing the proposed framework to address emerging challenges. Potential directions include integrating advanced encryption techniques for secure data transmission, as well as implementing privacy-preserving strategies such as federated learning and diferential privacy to safeguard sensitive information against intrusion attacks. Longitudinal studies and real-world deployments will be essential to validate the robustness and adaptability of the framework under diverse operational conditions. These eforts will be pivotal in translating theoretical advancements into practical, industry-ready solutions that can sustain the dynamic and complex nature of the IoV ecosystem.
Overall, our work paves the way for the development of next-generation IDS frameworks that are not only efective in thwarting cyber threats but also scalable, resilient, and adaptable to the evolving demands of modern vehicular networks.
During the preparation of this work, the authors used ChatGPT for rephrasing and improving clarity of certain paragraphs. All content generated or suggested by these tools was critically reviewed and edited by the authors. The authors afirm full responsibility for the accuracy, originality, and integrity of the paper. [13] L. Yang, A. Moubayed, I. Hamieh, A. Shami, Tree-based intelligent intrusion detection system in internet of vehicles, in: 2019 IEEE global communications conference (GLOBECOM), IEEE, 2019, pp. 1–6. [14] L. Nie, Z. Ning, X. Wang, X. Hu, J. Cheng, Y. Li, Data-driven intrusion detection for intelligent internet of vehicles: A deep convolutional neural network-based method, IEEE Transactions on Network Science and Engineering 7 (2020) 2219–2230. [15] S. Ullah, M. A. Khan, J. Ahmad, S. S. Jamal, Z. e Huma, M. T. Hassan, N. Pitropakis, Arshad, W. J.
Buchanan, Hdl-ids: a hybrid deep learning architecture for intrusion detection in the internet of vehicles, Sensors 22 (2022) 1340. [16] X. Li, Z. Hu, M. Xu, Y. Wang, J. Ma, Transfer learning based intrusion detection scheme for internet of vehicles, Information Sciences 547 (2021) 119–135. [17] I. Ahmed, G. Jeon, A. Ahmad, Deep learning-based intrusion detection system for internet of vehicles, IEEE Consumer Electronics Magazine 12 (2021) 117–123.