Jul 2026· International Conference on Ubiquitous and Future Networks· pp. 911-916· 0 citations· 13 references
Abstract
Deploying effective intrusion detection systems (IDS) on resource-constrained embedded hardware demands models that maximise threat recall under severe class imbalance and tight computational budgets. This paper presents a systematic, multi-cycle experimental study comparing neural network architectures—multi-layer perceptrons (MLPs) of varying depth, a long short-term memory (LSTM) network, and classical machine-learning baselines (Random Forest, XGBoost)—for binary classification of network traffic in an embedded testbed environment. Three findings distinguish our work. First, we show that temporal holdout splitting consistently outperforms k-fold cross-validation for network traffic data because random fold assignment violates the temporal autocorrelation structure of network flows, inflating k-fold recall estimates by 4–7 percentage points. Second, we demonstrate that removing four machine-specific identifiers (source/destination IP addresses and port numbers) improves recall by approximately 20 percentage points—a larger gain than any architectural change evaluated. Third, despite its theoretical suitability for sequential data, the LSTM underperforms the optimised MLP ($26.7\%$ vs. $50.7\%$ recall) on this small, imbalanced dataset, while classical tree-based methods achieve competitive recall with substantially lower inference cost. These results provide concrete, empirically grounded guidelines for IDS practitioners targeting embedded deployment, and highlight systematic evaluation pitfalls that are widespread in the network-security literature.
This paper evaluates an ultra-compact five-feature polling scheme (F1–F5) designed to preserve statistical symmetry between control-plane monitoring and telemetry overhead within a dynamic Mininet–Ryu testbed and reveals that tree-based ensembles consistently outperform deep learning approaches.
An Enhanced Multi-Model Ensemble Network Intrusion Detection System (EME-NIDS), a deep meta-learning system that combines five different heterogeneous learning paradigms, including Convolutional Neural Networks, Dense Neural Networks, Transformers, XGBoost, and Random Forests is introduced.
Controller Area Network (CAN) is the dominant in-vehicle bus, yet its broadcast design and absent authentication leave it exposed to injection and spoofing attacks. Existing deep-learning intrusion detection systems achieve strong accuracy but depend on ML inference frameworks incompatible with the resource budgets of production Electronic Control Units (ECUs). We present a systems-oriented pipeline that trains four neural architectures—Transformer, CNN, LSTM, and ANN—on a five-class labeled CAN dataset and distills each into a framework-free C++ decision tree via the Trustee protocol. We observe and address a systematic false-alarm collapse on Normal-class traffic: standard Trustee produces around 30% FPR-N because Normal frames constitute only 5.4% of training data. A class-balanced Trustee variant, which oversamples Normal by factor α=5, reduces FPR-N to 13.8±1.4% (three Trustee runs) while preserving 91.1±0.6% accuracy and 0.918±0.006 macro-F1 at 2.1% CPU on a Raspberry Pi 4, versus 22.6% for TF-Lite int8 and 59.4% for TensorFlow on the same board. We additionally report α and depth ablations, three-seed teacher statistics, and per-class recall for all models.Code: https://github.com/Amirmasoud-Pourmiri/Lightweight-Neural-Network-Distillation-for-Real-Time-CAN-Bus-Intrusion-Detection-in-Vehicles
Amirmasoud Pourmiri, Ali Eslami, Sergio A. Salinas Monroy· International Conference on...· 0 citations
An OFLN by addition of PSO to perform automated hyperparameter optimization and MAML to enable high-speed adaptation to new and previously seen attacks is proposed, which is more effective than baseline ensemble models in detection accuracy, resistance to class imbalance and training efficiency.
Network Intrusion Detection Systems (NIDS) play a critical role in securing IoT environments, where resource constraints demand lightweight yet effective solutions. While Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) networks are widely adopted as benchmarks for intrusion detection, their high computational demands pose challenges for real-time deployment on IoT devices. Deep learning has emerged as a powerful approach for intrusion detection, and to explore lightweight alternatives, we investigate reservoir computing models, namely Echo State Networks (ESNs) and Liquid State Machines (LSMs). In the proposed framework, ESN and LSM act as temporal feature-learning and attack-classification engines, leveraging fixed recurrent reservoirs to efficiently capture network traffic dynamics while requiring minimal training overhead. We propose custom ESN- and LSM-based architectures that offer significantly lower computational complexity than conventional deep learning models. Our models demonstrate performance comparable to CNN and LSTM-based approaches while achieving substantial reductions in resource usage, making them suitable for real-time intrusion detection in IoT networks. We utilize the latest NF-ToN-IoT dataset from the University of Queensland, comprising 1,379,274 network flows spanning diverse attack categories. Furthermore, despite their potential advantages, ESN and LSM remain relatively underexplored in NIDS applications. The results highlight the viability of reservoir computing as an efficient, scalable, and responsive alternative for lightweight intrusion detection in IoT environments.
Khorshed Alam, Mahbubul Haq Bhuiyan, Mohammad Ashraful Hoque et al.· PLoS ONE· 0 citations
Distributed Denial-of-Service (DDoS) attacks remain one of the most disruptive threats to network infrastructure, yet many machine learning (ML)-based detection studies report only offline benchmark performance without verifying whether that performance holds under real network conditions. This study evaluates two explainable ML classifiers, XGBoost and Random Forest, for DDoS detection and examines whether their near-perfect offline accuracy translates into reliable physical-network operation. The study combines offline benchmarking on the CIC-DDoS2019 dataset (293,485 flows) with physical-network validation using a working Intrusion Detection System (IDS) prototype under a controlled SYN-flood attack. Session-disjoint stratified sampling prevented flow-level leakage across attack sessions, while SHapley Additive exPlanations (SHAP) interpreted global and local feature importance. Offline, both classifiers achieved near-perfect performance (accuracy 99.99% for XGBoost, 99.98% for Random Forest; F1 = 0.9999; ROC-AUC up to 1.0000), with no statistically significant difference between them (McNemar's exact test, p = 0.2188), though XGBoost achieved approximately 3.69 times higher inference throughput (1,819,816 flows/s). SHAP identified Min Packet Length, Fwd Packet Length Min, Inbound, Protocol, and Init_Win_bytes_forward as the most influential features. In physical deployment, however, the IDS prototype flagged 6.26% of captured flows (6,935 of 110,762) as ATTACK during the SYN-flood test, and a separate 397-flow ambient-benign subset yielded a 6.80% false positive rate (95% Wilson CI: 4.72–9.71%), with short-duration SSDP/UPnP-style UDP control traffic accounting for 70% of observed false positives. This gap shows that near-perfect offline accuracy does not guarantee low false positives in real deployment, indicating that offline benchmarks alone are insufficient for validating IDS readiness.
Muhammad Azzam Anshori, R. Amri· Journal of Computer Science...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
