{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,18]],"date-time":"2026-03-18T18:58:41Z","timestamp":1773860321168,"version":"3.50.1"},"reference-count":50,"publisher":"MDPI AG","issue":"9","license":[{"start":{"date-parts":[[2023,4,28]],"date-time":"2023-04-28T00:00:00Z","timestamp":1682640000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Tongji University","award":["TPD-TC202110-14"],"award-info":[{"award-number":["TPD-TC202110-14"]}]},{"name":"Tongji University","award":["TPD-TC202211-06"],"award-info":[{"award-number":["TPD-TC202211-06"]}]},{"name":"Tongji University","award":["PKX2022-W01"],"award-info":[{"award-number":["PKX2022-W01"]}]},{"name":"Shanghai Pudong New Area Science and Technology Development Fund Industry-University-Research Special Project (Future Vehicle)","award":["TPD-TC202110-14"],"award-info":[{"award-number":["TPD-TC202110-14"]}]},{"name":"Shanghai Pudong New Area Science and Technology Development Fund Industry-University-Research Special Project (Future Vehicle)","award":["TPD-TC202211-06"],"award-info":[{"award-number":["TPD-TC202211-06"]}]},{"name":"Shanghai Pudong New Area Science and Technology Development Fund Industry-University-Research Special Project (Future Vehicle)","award":["PKX2022-W01"],"award-info":[{"award-number":["PKX2022-W01"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>The automotive Ethernet is gradually replacing the traditional controller area network (CAN) as the backbone network of the vehicle. As an essential protocol to solve service-based communication, Scalable service-Oriented MiddlewarE over IP (SOME\/IP) is expected to be applied to an in-vehicle network (IVN). The increasing number of external attack interfaces and the protocol\u2019s vulnerability makes SOME\/IP in-vehicle networks vulnerable to intrusion. This paper proposes a multi-layer intrusion detection system (IDS) architecture, including rule-based and artificial intelligence (AI)-based modules. The rule-based module is used to detect the SOME\/IP header, SOME\/IP-SD message, message interval, and communication process. The AI-based module acts on the payload. We propose a SOME\/IP dataset establishment method to evaluate the performance of the proposed multi-layer IDS. Experiments are carried out on a Jetson Xavier NX, showing that the accuracy of AI-based detection reached 99.7761% and that of rule-based detection was 100%. The average detection time per packet is 0.3958 ms with graphics processing unit (GPU) acceleration and 0.6669 ms with only a central processing unit (CPU). After vehicle-level real-time analyses, the proposed IDS can be deployed for distributed or select critical advanced driving assistance system (ADAS) traffic for detection in a centralized layout.<\/jats:p>","DOI":"10.3390\/s23094376","type":"journal-article","created":{"date-parts":[[2023,4,28]],"date-time":"2023-04-28T09:54:53Z","timestamp":1682675693000},"page":"4376","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":20,"title":["A Multi-Layer Intrusion Detection System for SOME\/IP-Based In-Vehicle Network"],"prefix":"10.3390","volume":"23","author":[{"given":"Feng","family":"Luo","sequence":"first","affiliation":[{"name":"School of Automotive Studies, Tongji University, Shanghai 201804, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8306-5712","authenticated-orcid":false,"given":"Zhenyu","family":"Yang","sequence":"additional","affiliation":[{"name":"School of Automotive Studies, Tongji University, Shanghai 201804, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhaojing","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Automotive Studies, Tongji University, Shanghai 201804, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zitong","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Automotive Studies, Tongji University, Shanghai 201804, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8723-1105","authenticated-orcid":false,"given":"Bowen","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Automotive Studies, Tongji University, Shanghai 201804, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mingzhi","family":"Wu","sequence":"additional","affiliation":[{"name":"Nanchang Automotive Institute of Intelligence and New Energy, Tongji University (NAIT), Nanchang 330052, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2023,4,28]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Keertikumar, M., Shubham, M., and Banakar, R.M. (2015, January 8\u201310). Evolution of IoT in smart vehicles: An overview. Proceedings of the International Conference on Green Computing and Internet of Things (ICGCIoT 2015), Greater Noida, India.","DOI":"10.1109\/ICGCIoT.2015.7380573"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Toufga, S., Abdellatif, S., Assouane, H.T., Owezarski, P., and Villemur, T. (2020). Towards Dynamic Controller Placement in Software Defined Vehicular Networks. Sensors, 20.","DOI":"10.3390\/s20061701"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"27","DOI":"10.1109\/MS.2017.69","article-title":"Future Automotive Architecture and the Impact of IT Trends","volume":"34","author":"Traub","year":"2017","journal-title":"IEEE Softw."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Panigrahy, S.K., and Emany, H. (2023). A Survey and Tutorial on Network Optimization for Intelligent Transport System Using the Internet of Vehicles. Sensors, 23.","DOI":"10.3390\/s23010555"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Hank, P., M\u00fcller, S., Vermesan, O., and Van Den Keybus, J. (2013, January 18\u201322). Automotive ethernet: In-vehicle networking and smart mobility. Proceedings of the 2013 Design, Automation & Test in Europe Conference & Exhibition (DATE 2013), Grenoble, France.","DOI":"10.7873\/DATE.2013.349"},{"key":"ref_6","unstructured":"Aspestrand, O., and Claeson, V. (2018). The Fast-Lane Development of Automotive Ethernet for Autonomous Drive. [Master\u2019s Thesis, Chalmers University of Technology]. Available online: https:\/\/odr.chalmers.se\/bitstream\/20.500.12380\/256211\/1\/256211.pdf."},{"key":"ref_7","unstructured":"Kreissl, J. (2017). Absicherung der SOME\/IP Kommunikation Bei Adaptive AUTOSAR. [Master\u2019s Thesis, Universit\u00e4t Stuttgart]. Available online: https:\/\/elib.uni-stuttgart.de\/bitstream\/11682\/9482\/1\/ausarbeitung.pdf."},{"key":"ref_8","unstructured":"Golson, J. (2023, April 20). Jeep Hackers at It Again, This Time Taking Control of Steering and Braking Systems. Available online: https:\/\/www.theverge.com\/2016\/8\/2\/12353186\/car-hackjeep-cherokee-vulnerability-miller-valasek."},{"key":"ref_9","unstructured":"Miller, C., and Valasek, C. (2023, April 20). A Survey of Remote Automotive Attack Surfaces. Available online: https:\/\/img.hardworkingtrucks.com\/files\/base\/randallreilly\/all\/migrated-files\/hwt\/2014\/09\/Remote_Automotive_Attack_Surfaces.pdf."},{"key":"ref_10","first-page":"993","article-title":"A Practical Wireless Attack on the Connected Car and Security Protocol for In-Vehicle CAN","volume":"16","author":"Woo","year":"2014","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Mandal, A.K., Cortesi, A., Ferrara, P., Panarotto, F., and Spoto, F. (2018, January 8\u201310). Vulnerability analysis of Android auto infotainment apps. Proceedings of the 15th ACM International Conference on Computing Frontiers, Ischia, Italy.","DOI":"10.1145\/3203217.3203278"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Ma, B., Yang, S., Zuo, Z., Zou, B., Cao, Y., Yan, X., Zhou, S., and Li, J. (2022). An Authentication and Secure Communication Scheme for In-Vehicle Networks Based on SOME\/IP. Sensors, 22.","DOI":"10.3390\/s22020647"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"13450","DOI":"10.1109\/TVT.2020.3028880","article-title":"Securing SOME\/IP for In-Vehicle Service Protection","volume":"69","author":"Iorio","year":"2020","journal-title":"IEEE Trans. Veh. Technol."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"77","DOI":"10.1109\/MVT.2020.2980444","article-title":"Protecting In-Vehicle Services: Security-Enabled SOME\/IP Middleware","volume":"15","author":"Iorio","year":"2020","journal-title":"IEEE Veh. Technol. Mag."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"16","DOI":"10.1016\/j.jnca.2012.09.004","article-title":"Intrusion detection system: A comprehensive review","volume":"36","author":"Liao","year":"2013","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Gehrmann, T., and Duplys, P. (2020, January 26\u201328). Intrusion Detection for SOME\/IP: Challenges and Opportunities. Proceedings of the 2020 23rd Euromicro Conference on Digital System Design (DSD 2020), Kranj, Slovenia.","DOI":"10.1109\/DSD51259.2020.00096"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"21266","DOI":"10.1109\/ACCESS.2019.2894183","article-title":"Intrusion Detection Systems for Intra-Vehicle Networks: A Review","volume":"7","author":"Maple","year":"2019","journal-title":"IEEE Access"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"919","DOI":"10.1109\/TITS.2019.2908074","article-title":"A Survey of Intrusion Detection for In-Vehicle Networks","volume":"21","author":"Wu","year":"2020","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"5039","DOI":"10.1109\/ACCESS.2019.2963077","article-title":"DDoS Attack Detection Method Based on Improved KNN With the Degree of DDoS Attack in Software-Defined Networks","volume":"8","author":"Dong","year":"2020","journal-title":"IEEE Access"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Kokila, R.T., Thamarai Selvi, S., and Govindarajan, K. (2014, January 17\u201319). DDoS detection and analysis in SDN-based environment using support vector machine classifier. Proceedings of the 6th International Conference on Advanced Computing (ICoAC 2014), Chennai, India.","DOI":"10.1109\/ICoAC.2014.7229711"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Ali, J., Roh, B.-H., Lee, B., Oh, J., and Adil, M. (2020, January 21\u201323). A Machine Learning Framework for Prevention of Software-Defined Networking controller from DDoS Attacks and dimensionality reduction of big data. Proceedings of the International Conference on Information and Communication Technology Convergence (ICTC 2020), Jeju, Republic of Korea.","DOI":"10.1109\/ICTC49870.2020.9289504"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Heidari, A., and Jabraeil Jamali, M.A. (2022). Internet of Things intrusion detection systems: A comprehensive review and future directions. Clust. Comput., 1\u201328.","DOI":"10.1007\/s10586-022-03776-z"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s42400-021-00077-7","article-title":"A critical review of intrusion detection systems in the internet of things: Techniques, deployment strategy, validation strategy, attacks, public datasets and challenges","volume":"4","author":"Khraisat","year":"2021","journal-title":"Cybersecurity"},{"key":"ref_24","unstructured":"Bresch, M., and Salman, N. (2017). Design and Implementation of an Intrusion Detection System (IDS) for In-Vehicle Networks. [Master\u2019s Thesis, Chalmers University of Technology]. Available online: https:\/\/odr.chalmers.se\/bitstream\/20.500.12380\/251871\/1\/251871.pdf."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"2114","DOI":"10.1109\/TIFS.2018.2812149","article-title":"VoltageIDS: Low-Level Communication Characteristics for Automotive Intrusion Detection System","volume":"13","author":"Choi","year":"2018","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"58194","DOI":"10.1109\/ACCESS.2020.2982544","article-title":"CANet: An Unsupervised Intrusion Detection System for High Dimensional CAN Bus Data","volume":"8","author":"Hanselmann","year":"2020","journal-title":"IEEE Access"},{"key":"ref_27","first-page":"100198","article-title":"In-vehicle network intrusion detection using deep convolutional neural network","volume":"21","author":"Song","year":"2020","journal-title":"Veh. Commun."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"1484","DOI":"10.1109\/TVT.2019.2961344","article-title":"SAIDuCANT: Specification-Based Automotive Intrusion Detection Using Controller Area Network (CAN) Timing","volume":"69","author":"Olufowobi","year":"2020","journal-title":"IEEE Trans. Veh. Technol."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"616","DOI":"10.1109\/JIOT.2021.3084796","article-title":"MTH-IDS: A Multitiered Hybrid Intrusion Detection System for Internet of Vehicles","volume":"9","author":"Yang","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Taylor, A., Japkowicz, N., and Leblanc, S. (2015, January 14\u201316). Frequency-based anomaly detection for the automotive CAN bus. Proceedings of the 2015 World Congress on Industrial Control Systems Security (WCICSS), London, UK.","DOI":"10.1109\/WCICSS.2015.7420322"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Cho, K.T., and Shin, K.G. (2017, January 30). Viden: Attacker identification on in-vehicle networks. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Dallas, TX, USA.","DOI":"10.1145\/3133956.3134001"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"M\u00fcter, M., and Asaj, N. (2011, January 5\u20139). Entropy-based anomaly detection for in-vehicle networks. Proceedings of the 2011 IEEE Intelligent Vehicles Symposium (IV), Baden, Germany.","DOI":"10.1109\/IVS.2011.5940552"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Marchetti, M., and Stabili, D. (2017, January 11\u201314). Anomaly detection of CAN bus messages through analysis of ID sequences. Proceedings of the 2017 IEEE Intelligent Vehicles Symposium (IV), Los Angeles, CA, USA.","DOI":"10.1109\/IVS.2017.7995934"},{"key":"ref_34","first-page":"43","article-title":"Field classification, modeling and anomaly detection in unknown CAN bus networks","volume":"9","author":"Markovitz","year":"2017","journal-title":"Veh. Commun."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Kang, M.-J., and Kang, J.-W. (2016, January 15\u201318). A novel intrusion detection method using deep neural network for in-vehicle network security. Proceedings of the 2016 IEEE 83rd Vehicular Technology Conference (VTC 2016), Nanjing, China.","DOI":"10.1109\/VTCSpring.2016.7504089"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Taylor, A., Leblanc, S., and Japkowicz, N. (2016, January 17\u201319). Anomaly detection in automobile control network data with long short-term memory networks. Proceedings of the 2016 IEEE International Conference on Data Science and Advanced Analytics (DSAA), Montreal, QC, Canada.","DOI":"10.1109\/DSAA.2016.20"},{"key":"ref_37","unstructured":"Zhang, L., Shi, L., Kaja, N., and Ma, D. (2018, January 7\u20139). A two-stage deep learning approach for can intrusion detection. Proceedings of the Ground Vehicle Systems Engineering & Technology Symposium (GVSETS 2018), Novi, MI, USA."},{"key":"ref_38","unstructured":"Weber, M., Klug, S., Sax, E., and Zimmer, B. (February, January 31). Embedded hybrid anomaly detection for automotive CAN communication. Proceedings of the 9th European Congress on Embedded Real Time Software and Systems (ERTS 2018), Toulouse, France."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Song, H.M., Kim, H.R., and Kim, H.K. (2016, January 13\u201315). Intrusion detection system based on the analysis of time intervals of CAN messages for in-vehicle network. Proceedings of the 2016 International Conference on Information Networking (ICOIN), Kota Kinabalu, Malaysia.","DOI":"10.1109\/ICOIN.2016.7427089"},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Herold, N., Posselt, S.-A., Hanka, O., and Carle, G. (2016, January 25\u201329). Anomaly detection for SOME\/IP using complex event processing. Proceedings of the NOMS 2016-2016 IEEE\/IFIP Network Operations and Management Symposium, Istanbul, Turkey.","DOI":"10.1109\/NOMS.2016.7502991"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Zihan, Z., Lirong, C., Haitao, Z., and Fan, Z. (2021, January 17\u201319). Research on Intrusion Detection Technology Based on Embedded Ethernet. Proceedings of the 18th International Computer Conference on Wavelet Active Media Technology and Information Processing (ICCWAMTIP 2021), Chengdu, China.","DOI":"10.1109\/ICCWAMTIP53232.2021.9674069"},{"key":"ref_42","first-page":"100338","article-title":"Convolutional neural network-based intrusion detection system for AVTP streams in automotive Ethernet-based networks","volume":"29","author":"Jeong","year":"2021","journal-title":"Veh. Commun."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Alkhatib, N., Mushtaq, M., Ghauch, H., and Danger, J.-L. (2022, January 5\u20139). Unsupervised Network Intrusion Detection System for AVTP in Automotive Ethernet Networks. Proceedings of the IEEE Intelligent Vehicles Symposium (IV), Aachen, Germany.","DOI":"10.1109\/IV51971.2022.9827285"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Alkhatib, N., Ghauch, H., and Danger, J.-L. (2021, January 27\u201330). SOME\/IP Intrusion Detection using Deep Learning-based Sequential Models in Automotive Ethernet Networks. Proceedings of the 2021 IEEE 12th Annual Information Technology, Electronics and Mobile Communication Conference (IEMCON 2021), Vancouver, BC, Canada.","DOI":"10.1109\/IEMCON53756.2021.9623129"},{"key":"ref_45","unstructured":"(2023, April 20). SOME\/IP Generator. Available online: https:\/\/github.com\/Egomania\/SOME-IP_Generator."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Grimm, D., Weber, M., and Sax, E. (2018, January 16\u201318). An extended hybrid anomaly detection system for automotive electronic control units communicating via ethernet. Proceedings of the 4th International Conference on Vehicle Technology and Intelligent Transport Systems, Funchal, Madeira, Portugal.","DOI":"10.5220\/0006779204620473"},{"key":"ref_47","unstructured":"(2023, April 20). SOME\/IP Service Discovery Protocol Specification, AUTOSAR. Available online: https:\/\/www.autosar.org\/fileadmin\/standards\/R22-11\/FO\/AUTOSAR_PRS_SOMEIPServiceDiscoveryProtocol.pdf."},{"key":"ref_48","unstructured":"(2023, April 20). SOME\/IP Protocol Specification, AUTOSAR. Available online: https:\/\/www.autosar.org\/fileadmin\/standards\/R22-11\/FO\/AUTOSAR_PRS_SOMEIPProtocol.pdf."},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"6902138","DOI":"10.1155\/2021\/6902138","article-title":"Security Analysis of the TSN Backbone Architecture and Anomaly Detection System Design Based on IEEE 802.1Qci","volume":"2021","author":"Luo","year":"2021","journal-title":"Secur. Commun. Netw."},{"key":"ref_50","unstructured":"(2023, April 20). Dataset-for-SOME-IP-IDS. Available online: https:\/\/github.com\/yzyGo\/Dataset-for-SOME-IP-IDS.git."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/9\/4376\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T19:25:56Z","timestamp":1760124356000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/9\/4376"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,4,28]]},"references-count":50,"journal-issue":{"issue":"9","published-online":{"date-parts":[[2023,5]]}},"alternative-id":["s23094376"],"URL":"https:\/\/doi.org\/10.3390\/s23094376","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,4,28]]}}}