{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,7]],"date-time":"2026-10-07T15:22:05Z","timestamp":1791386525627,"version":"4.3.3"},"reference-count":43,"publisher":"MDPI AG","issue":"23","license":[{"start":{"date-parts":[[2022,11,26]],"date-time":"2022-11-26T00:00:00Z","timestamp":1669420800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Connectivity and automation have expanded with the development of autonomous vehicle technology. One of several automotive serial protocols that can be used in a wide range of vehicles is the controller area network (CAN). The growing functionality and connectivity of modern vehicles make them more vulnerable to cyberattacks aimed at vehicular networks. The CAN bus protocol is vulnerable to numerous attacks, as it is lacking security mechanisms by design. It is crucial to design intrusion detection systems (IDS) with high accuracy to detect attacks on the CAN bus. In this paper, we design an effective machine learning-based IDS scheme for binary classification that utilizes eight supervised ML algorithms, along with ensemble classifiers. The scheme achieved a higher effectiveness score in detecting normal and abnormal activities when trained with normal and malicious CAN traffic datasets. Random Forest, Decision Tree, and Xtreme Gradient Boosting classifiers provided the most accurate results. Then we evaluated three ensemble methods, voting, stacking, and bagging, for this classification task. The ensemble classifiers achieved better accuracy than the individual models, since ensemble learning strategies have superior performance through a combination of multiple learning mechanisms. These mechanisms have a varied range of capabilities that improve the prediction reliability while lowering the possibility of classification errors. Our model outperformed the most recent study that used the same dataset, with an accuracy of 0.984.<\/jats:p>","DOI":"10.3390\/s22239195","type":"journal-article","created":{"date-parts":[[2022,11,28]],"date-time":"2022-11-28T08:13:09Z","timestamp":1669623189000},"page":"9195","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":33,"title":["Classification of Normal and Malicious Traffic Based on an Ensemble of Machine Learning for a Vehicle CAN-Network"],"prefix":"10.3390","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0948-0069","authenticated-orcid":false,"given":"Easa","family":"Alalwany","sequence":"first","affiliation":[{"name":"Electrical Engineering & Computer Science, Florida Atlantic University, 777 Glades Road, Boca Raton, FL 33431, USA"},{"name":"College of Computer Science and Engineering, Taibah University, Yanbu 46421, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4461-7307","authenticated-orcid":false,"given":"Imad","family":"Mahgoub","sequence":"additional","affiliation":[{"name":"Electrical Engineering & Computer Science, Florida Atlantic University, 777 Glades Road, Boca Raton, FL 33431, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2022,11,26]]},"reference":[{"key":"ref_1","first-page":"1","article-title":"Connected car: Technologies, issues, future trends","volume":"49","author":"Coppola","year":"2016","journal-title":"ACM Comput. Surv. CSUR"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"760","DOI":"10.1109\/TITS.2018.2818888","article-title":"A survey on recent advances in vehicular network security, trust, and privacy","volume":"20","author":"Lu","year":"2018","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_3","first-page":"7","article-title":"VANet security challenges and solutions: A survey","volume":"7","author":"Hasrouny","year":"2017","journal-title":"Veh. Commun."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/CC.2014.6969789","article-title":"An overview of internet of vehicles","volume":"11","author":"Yang","year":"2014","journal-title":"China Commun."},{"key":"ref_5","first-page":"90","article-title":"Cyber security attacks to modern vehicular systems","volume":"36","author":"Pan","year":"2017","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_6","unstructured":"Avatefipour, O., and Malik, H. (2018). State-of-the-art survey on in-vehicle network communication (CAN-Bus) security and vulnerabilities. arXiv."},{"key":"ref_7","first-page":"1","article-title":"Cyberattacks and countermeasures for in-vehicle networks","volume":"54","author":"Aliwa","year":"2021","journal-title":"ACM Comput. Surv. CSUR"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Wang, Q., Qian, Y., Lu, Z., Shoukry, Y., and Qu, G. (2018, January 17\u201318). A delay based plug-in-monitor for intrusion detection in controller area network. Proceedings of the 2018 Asian Hardware Oriented Security and Trust Symposium (AsianHOST), Hong Kong, China.","DOI":"10.1109\/AsianHOST.2018.8607178"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Bozdal, M., Samie, M., Aslam, S., and Jennions, I. (2020). Evaluation of can bus security challenges. Sensors, 20.","DOI":"10.3390\/s20082364"},{"key":"ref_10","unstructured":"Miller, C., and Valasek, C. (2015). Remote exploitation of an unaltered passenger vehicle. Black Hat USA, 2015."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Seo, E., Song, H.M., and Kim, H.K. (2018, January 28\u201330). GIDS: GAN based intrusion detection system for in-vehicle network. Proceedings of the 2018 16th Annual Conference on Privacy, Security and Trust (PST), Belfast, Ireland.","DOI":"10.1109\/PST.2018.8514157"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"3299","DOI":"10.1007\/s10462-020-09948-w","article-title":"Machine learning towards intelligent systems: Applications, challenges, and opportunities","volume":"54","author":"Injadat","year":"2021","journal-title":"Artif. Intell. Rev."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"10823","DOI":"10.1109\/ACCESS.2019.2891073","article-title":"Artificial intelligence for vehicle-to-everything: A survey","volume":"7","author":"Tong","year":"2019","journal-title":"IEEE Access"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"127580","DOI":"10.1109\/ACCESS.2019.2937576","article-title":"An intelligent secured framework for cyberattack detection in electric vehicles\u2019 CAN bus using machine learning","volume":"7","author":"Avatefipour","year":"2019","journal-title":"IEEE Access"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"919","DOI":"10.1109\/TITS.2019.2908074","article-title":"A survey of intrusion detection for in-vehicle networks","volume":"21","author":"Wu","year":"2019","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s13638-019-1484-3","article-title":"Intrusion detection system for automotive Controller Area Network (CAN) bus system: A review","volume":"2019","author":"Lokman","year":"2019","journal-title":"EURASIP J. Wirel. Commun. Netw."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"100435","DOI":"10.1016\/j.iot.2021.100435","article-title":"Ensemble detection model for IoT IDS","volume":"16","author":"Alhowaide","year":"2021","journal-title":"Internet Things"},{"key":"ref_18","first-page":"31","article-title":"Evaluation of classification algorithms for intrusion detection system: A review","volume":"2","author":"Salih","year":"2021","journal-title":"J. Soft Comput. Data Min."},{"key":"ref_19","unstructured":"Pham, N.T., Foo, E., Suriadi, S., Jeffrey, H., and Lahza, H.F.M. (February, January 29). Improving performance of intrusion detection system using ensemble methods and feature selection. Proceedings of the Australasian Computer Science Week Multiconference, Brisbane, QLD, Australia."},{"key":"ref_20","unstructured":"Checkoway, S., McCoy, D., Kantor, B., Anderson, D., Shacham, H., Savage, S., Koscher, K., Czeskis, A., Roesner, F., and Kohno, T. (2011, January 30). Comprehensive experimental analyses of automotive attack surfaces. Proceedings of the 20th USENIX Security Symposium (USENIX Security 11), San Francisco, CA, USA."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Bozdal, M., Samie, M., and Jennions, I. (2018, January 19\u201320). A survey on can bus protocol: Attacks, challenges, and potential solutions. Proceedings of the 2018 International Conference on Computing, Electronics & Communications Engineering (iCCECE), Southend, UK.","DOI":"10.1109\/iCCECOME.2018.8658720"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"79","DOI":"10.4236\/wet.2018.94007","article-title":"Classification approach for intrusion detection in vehicle systems","volume":"9","author":"Alshammari","year":"2018","journal-title":"Wirel. Eng. Technol."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Gundu, R., and Maleki, M. (2022, January 19\u201321). Securing CAN Bus in Connected and Autonomous Vehicles Using Supervised Machine Learning Approaches. Proceedings of the 2022 IEEE International Conference on Electro Information Technology (eIT), Mankato, MN, USA.","DOI":"10.1109\/eIT53891.2022.9813985"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Kalkan, S.C., and Sahingoz, O.K. (2020, January 1\u20133). In-vehicle intrusion detection system on controller area network with machine learning models. Proceedings of the 2020 11th International Conference on Computing, Communication and Networking Technologies (ICCCNT), Kharagpur, India.","DOI":"10.1109\/ICCCNT49239.2020.9225442"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"1098","DOI":"10.1109\/TVT.2021.3051026","article-title":"Self-supervised anomaly detection for in-vehicle network using noised pseudo normal data","volume":"70","author":"Song","year":"2021","journal-title":"IEEE Trans. Veh. Technol."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Mehedi, S.T., Anwar, A., Rahman, Z., and Ahmed, K. (2021). Deep transfer learning based intrusion detection system for electric vehicular networks. Sensors, 21.","DOI":"10.3390\/s21144736"},{"key":"ref_27","unstructured":"Bosch, R. (1991). CAN Specification Version 2.0, Rober Bousch GmbH."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Johansson, K.H., T\u00f6rngren, M., and Nielsen, L. (2005). Vehicle applications of controller area network. Handbook of Networked and Embedded Control Systems, Springer.","DOI":"10.1007\/0-8176-4404-0_32"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"15","DOI":"10.1109\/MTS.2018.2795093","article-title":"Connected vehicle security vulnerabilities [commentary]","volume":"37","author":"Takefuji","year":"2018","journal-title":"IEEE Technol. Soc. Mag."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"279","DOI":"10.1108\/IMCS-05-2013-0041","article-title":"Information security: Critical review and future directions for research","volume":"22","author":"Silic","year":"2014","journal-title":"Inf. Manag. Comput. Secur."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Nowdehi, N., Lautenbach, A., and Olovsson, T. (2017, January 24\u201327). In-vehicle CAN message authentication: An evaluation based on industrial criteria. Proceedings of the 2017 IEEE 86th Vehicular Technology Conference (VTC-Fall), Toronto, ON, Canada.","DOI":"10.1109\/VTCFall.2017.8288327"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Zhang, H., Meng, X., Zhang, X., and Liu, Z. (2020). CANsec: A practical in-vehicle controller area network security evaluation tool. Sensors, 20.","DOI":"10.3390\/s20174900"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Deng, J., Yu, L., Fu, Y., Hambolu, O., and Brooks, R.R. (2017). Security and data privacy of modern automobiles. Data Analytics for Intelligent Transportation Systems, Elsevier.","DOI":"10.1016\/B978-0-12-809715-1.00006-7"},{"key":"ref_34","unstructured":"Kang, H., Kwak, B., Lee, Y., Lee, H., Lee, H., and Kim, H. (2021). Car Hacking: Attack and Defense Challenge 2020 Dataset. IEEE Dataport, IEEE."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"863","DOI":"10.1613\/jair.1.11192","article-title":"SMOTE for learning from imbalanced data: Progress and challenges, marking the 15-year anniversary","volume":"61","author":"Garcia","year":"2018","journal-title":"J. Artif. Intell. Res."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"24649","DOI":"10.1109\/ACCESS.2019.2899578","article-title":"Variance ranking attributes selection techniques for binary classification problem in imbalance data","volume":"7","author":"Ebenuwa","year":"2019","journal-title":"IEEE Access"},{"key":"ref_37","unstructured":"Alfrhan, A.A., Alhusain, R.H., and Khan, R.U. (2020, January 9\u201310). SMOTE: Class imbalance problem in intrusion detection system. Proceedings of the 2020 International Conference on Computing and Information Technology (ICCIT-1441), Tabuk, Saudi Arabia."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Tan, X., Su, S., Huang, Z., Guo, X., Zuo, Z., Sun, X., and Li, L. (2019). Wireless sensor networks intrusion detection based on SMOTE and the random forest algorithm. Sensors, 19.","DOI":"10.3390\/s19010203"},{"key":"ref_39","first-page":"1","article-title":"A systematic review on imbalanced data challenges in machine learning: Applications and solutions","volume":"52","author":"Kaur","year":"2019","journal-title":"ACM Comput. Surv. CSUR"},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"241","DOI":"10.1016\/S0893-6080(05)80023-1","article-title":"Stacked generalization","volume":"5","author":"Wolpert","year":"1992","journal-title":"Neural Netw."},{"key":"ref_41","first-page":"110","article-title":"Ensemble learning","volume":"2","author":"Dietterich","year":"2002","journal-title":"Handb. Brain Theory Neural Netw."},{"key":"ref_42","unstructured":"Quinlan, J.R. (1996, January 4\u20138). Bagging, boosting, and C4.5. Proceedings of the AAAI\/IAAI, Portland, OR, USA."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"1303","DOI":"10.1016\/S0031-3203(02)00169-3","article-title":"Double-bagging: Combining classifiers by bootstrap aggregation","volume":"36","author":"Hothorn","year":"2003","journal-title":"Pattern Recognit."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/23\/9195\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T01:27:18Z","timestamp":1760146038000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/23\/9195"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,11,26]]},"references-count":43,"journal-issue":{"issue":"23","published-online":{"date-parts":[[2022,12]]}},"alternative-id":["s22239195"],"URL":"https:\/\/doi.org\/10.3390\/s22239195","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,11,26]]}}}