{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,18]],"date-time":"2026-08-18T05:58:30Z","timestamp":1787032710597,"version":"build-2736575974"},"reference-count":48,"publisher":"PeerJ","license":[{"start":{"date-parts":[[2025,8,19]],"date-time":"2025-08-19T00:00:00Z","timestamp":1755561600000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"National Key Research and Development Program of China","award":["2021YFB3101804"],"award-info":[{"award-number":["2021YFB3101804"]}]},{"name":"Basic Strengthening Project of the Science and Technology Commission in the Field of Technology","award":["2021-JCJQ-JJ-0496"],"award-info":[{"award-number":["2021-JCJQ-JJ-0496"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"abstract":"<jats:p>\n                    With the rapid development and widespread adoption of intelligent vehicles and the Internet of Vehicles (IoV), vehicle security has become a growing concern. Modern vehicles manage key components\n                    <jats:italic>via<\/jats:italic>\n                    the controller area network (CAN) connected electronic control units (ECUs). CAN bus intrusion techniques are the primary methods of compromising the IoV, posing a significant threat to the normal operation of critical vehicle systems, such as the power systems. However, existing attack detection methods still have shortcomings in terms of feature extraction and the diversity of attack type detection. To address these challenges, we propose an intrusion detection framework named basic ensemble and pioneer class decision (BEPCD). The framework first constructs a 15-dimensional feature model to hierarchically characterize CAN bus messages. Subsequently, BEPCD incorporates multi-model ensemble learning enhanced by a Pioneer class selector and confidence-driven voting mechanisms, enabling precise classification of both conventional and emerging attack patterns. Additionally, we analyze the importance of different data features across four machine learning algorithms. Experimental results on public datasets demonstrate that the proposed detection framework effectively detects intrusions in-vehicle CAN bus. Compared to other intrusion detection frameworks, our framework improves the overall F1-score by 1% to 5%. Notably, it achieves an approximately 77.5% performance enhancement in detecting replay attacks.\n                  <\/jats:p>","DOI":"10.7717\/peerj-cs.3108","type":"journal-article","created":{"date-parts":[[2025,8,19]],"date-time":"2025-08-19T08:28:01Z","timestamp":1755592081000},"page":"e3108","source":"Crossref","is-referenced-by-count":2,"title":["BEPCD: an ensemble learning-based intrusion detection framework for in-vehicle CAN bus"],"prefix":"10.7717","volume":"11","author":[{"given":"Bocheng","family":"Xu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fei","family":"Cao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xilong","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Song","family":"Tian","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wenbo","family":"Deng","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shudan","family":"Yue","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"4443","published-online":{"date-parts":[[2025,8,19]]},"reference":[{"key":"10.7717\/peerj-cs.3108\/ref-1","doi-asserted-by":"publisher","DOI":"10.33915\/etd.12709","article-title":"Machine learning based intrusion detection framework for CAN bus vulnerabilities in modern vehicles. Statler College of Engineering and Mineral Resources","author":"Agbo","year":"2024"},{"key":"10.7717\/peerj-cs.3108\/ref-2","doi-asserted-by":"publisher","first-page":"150","DOI":"10.1186\/s13677-024-00712-x","article-title":"Explainable AI-based innovative hybrid ensemble model for intrusion detection","volume":"13","author":"Ahmed","year":"2024","journal-title":"Journal of Cloud Computing"},{"key":"10.7717\/peerj-cs.3108\/ref-3","doi-asserted-by":"publisher","first-page":"100865","DOI":"10.1016\/j.vehcom.2024.100865","article-title":"STC-GraphFormer: graph spatial-temporal correlation transformer for in-vehicle network intrusion detection system","volume":"51","author":"Al-Absi","year":"2025","journal-title":"Vehicular Communications"},{"issue":"23","key":"10.7717\/peerj-cs.3108\/ref-4","doi-asserted-by":"publisher","first-page":"13","DOI":"10.3390\/s22239195","article-title":"Classification of normal and malicious traffic based on an ensemble of machine learning for a vehicle CAN-network","volume":"22","author":"Alalwany","year":"2022","journal-title":"Sensors"},{"issue":"5","key":"10.7717\/peerj-cs.3108\/ref-5","doi-asserted-by":"publisher","first-page":"919","DOI":"10.3390\/electronics13050919","article-title":"An effective ensemble learning-based real-time intrusion detection scheme for an in-vehicle network","volume":"13","author":"Alalwany","year":"2024","journal-title":"Electronics"},{"key":"10.7717\/peerj-cs.3108\/ref-6","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3431233","article-title":"Cyberattacks and countermeasures for in-vehicle networks","volume":"54","author":"Aliwa","year":"2021","journal-title":"ACM Computing Surveys (CSUR)"},{"issue":"2","key":"10.7717\/peerj-cs.3108\/ref-7","doi-asserted-by":"publisher","first-page":"2045","DOI":"10.1109\/access.2023.3347619","article-title":"Enhanced intrusion detection in in-vehicle networks using advanced feature fusion and stacking-enriched learning","volume":"12","author":"Altalbe","year":"2023","journal-title":"IEEE Access"},{"issue":"7","key":"10.7717\/peerj-cs.3108\/ref-8","doi-asserted-by":"publisher","first-page":"7","DOI":"10.3390\/s23073610","article-title":"Intrusion detection in vehicle controller area network (CAN) bus using machine learning: a comparative performance study","volume":"23","author":"Bari","year":"2023","journal-title":"Sensors"},{"issue":"8","key":"10.7717\/peerj-cs.3108\/ref-9","doi-asserted-by":"publisher","first-page":"2364","DOI":"10.3390\/s20082364","article-title":"Evaluation of CAN bus security challenges","volume":"20","author":"Bozdal","year":"2020","journal-title":"Sensors"},{"key":"10.7717\/peerj-cs.3108\/ref-10","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010933404324","article-title":"Random forests. Machine learning","author":"Breiman","year":"2001"},{"key":"10.7717\/peerj-cs.3108\/ref-11","doi-asserted-by":"publisher","first-page":"321","DOI":"10.1613\/jair.953","article-title":"SMOTE: synthetic minority over-sampling technique","volume":"16","author":"Chawla","year":"2002","journal-title":"Journal of Artificial Intelligence Research"},{"key":"10.7717\/peerj-cs.3108\/ref-12","first-page":"785","article-title":"XGBoost","author":"Chen","year":"2016"},{"issue":"3","key":"10.7717\/peerj-cs.3108\/ref-13","doi-asserted-by":"publisher","first-page":"2366","DOI":"10.1109\/tits.2021.3088998","article-title":"Histogram-based intrusion detection and filtering framework for secure and safe in-vehicle networks","volume":"23","author":"Derhab","year":"2022","journal-title":"IEEE Transactions on Intelligent Transportation Systems"},{"key":"10.7717\/peerj-cs.3108\/ref-14","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2309.10173","article-title":"GCNIDS: graph convolutional network-based intrusion detection system for CAN bus","author":"Devnath","year":"2023"},{"key":"10.7717\/peerj-cs.3108\/ref-15","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1007\/s10994-006-6226-1","article-title":"Extremely randomized trees","volume":"63","author":"Geurts","year":"2006","journal-title":"Machine Learning"},{"key":"10.7717\/peerj-cs.3108\/ref-16","doi-asserted-by":"publisher","first-page":"122181","DOI":"10.1016\/j.eswa.2023.122181","article-title":"Supervised contrastive ResNet and transfer learning for the in-vehicle intrusion detection system","volume":"238","author":"Hoang","year":"2024","journal-title":"Expert Systems with Applications"},{"key":"10.7717\/peerj-cs.3108\/ref-17","first-page":"235","article-title":"Security threats to automotive CAN networks-practical examples and selected short-term countermeasures","author":"Hoppe","year":"2008"},{"key":"10.7717\/peerj-cs.3108\/ref-18","doi-asserted-by":"publisher","first-page":"3925","DOI":"10.1109\/tifs.2022.3217389","article-title":"Adaptive controller area network intrusion detection system considering temperature variations","volume":"17","author":"Jeong","year":"2022","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"10.7717\/peerj-cs.3108\/ref-19","doi-asserted-by":"publisher","first-page":"138","DOI":"10.1007\/s42154-023-00273-w","article-title":"In-vehicle network injection attacks detection based on feature selection and classification","volume":"7","author":"Ji","year":"2024","journal-title":"Automotive Innovation"},{"issue":"7","key":"10.7717\/peerj-cs.3108\/ref-20","doi-asserted-by":"publisher","first-page":"6123","DOI":"10.1109\/tits.2021.3078740","article-title":"A survey of attacks on controller area networks and corresponding countermeasures","volume":"23","author":"Jo","year":"2022","journal-title":"IEEE Transactions on Intelligent Transportation Systems"},{"key":"10.7717\/peerj-cs.3108\/ref-21","doi-asserted-by":"crossref","DOI":"10.14722\/autosec.2021.23035","article-title":"Car hacking and defense competition on in-vehicle network","author":"Kang","year":"2021"},{"key":"10.7717\/peerj-cs.3108\/ref-22","doi-asserted-by":"publisher","first-page":"54979","DOI":"10.1109\/ACCESS.2020.2980523","article-title":"Detecting low-rate replay-based injection attacks on in-vehicle networks","volume":"8","author":"Katragadda","year":"2020","journal-title":"IEEE Access"},{"issue":"5","key":"10.7717\/peerj-cs.3108\/ref-23","doi-asserted-by":"publisher","first-page":"103171","DOI":"10.1016\/j.rineng.2024.103171","article-title":"XAIEnsembleTL-IoV: a new eXplainable artificial intelligence ensemble transfer learning for zero-day botnet attack detection in the internet of vehicles","volume":"24","author":"Kayode","year":"2024","journal-title":"Results in Engineering"},{"key":"10.7717\/peerj-cs.3108\/ref-24","doi-asserted-by":"publisher","first-page":"103712","DOI":"10.1016\/j.cose.2024.103712","article-title":"DivaCAN: detecting in-vehicle intrusion attacks on a controller area network using ensemble learning","volume":"139","author":"Khan","year":"2024","journal-title":"Computers & Security"},{"key":"10.7717\/peerj-cs.3108\/ref-25","doi-asserted-by":"publisher","first-page":"447","DOI":"10.1109\/SP.2010.34","article-title":"Experimental security analysis of a modern automobile","author":"Koscher","year":"2010"},{"key":"10.7717\/peerj-cs.3108\/ref-26","doi-asserted-by":"publisher","first-page":"195","DOI":"10.1109\/SP40001.2021.00122","article-title":"CANNON: reliable and stealthy remote shutdown attacks via unaltered automotive microcontrollers","author":"Kulandaivel","year":"2021"},{"key":"10.7717\/peerj-cs.3108\/ref-27","doi-asserted-by":"publisher","first-page":"119771","DOI":"10.1016\/j.eswa.2023.119771","article-title":"A survey of deep learning-based intrusion detection in automotive applications","volume":"221","author":"Lampe","year":"2023","journal-title":"Expert Systems with Applications"},{"issue":"3","key":"10.7717\/peerj-cs.3108\/ref-28","doi-asserted-by":"publisher","first-page":"2941","DOI":"10.32604\/iasc.2023.039992","article-title":"FIDS: filtering-based intrusion detection system for in-vehicle CAN","volume":"37","author":"Lee","year":"2023","journal-title":"Intelligent Automation & Soft Computing"},{"key":"10.7717\/peerj-cs.3108\/ref-29","doi-asserted-by":"publisher","first-page":"94","DOI":"10.1186\/s13638-019-1484-3","article-title":"Intrusion detection system for automotive controller area network (CAN) bus system: a review","volume":"2019","author":"Lokman","year":"2019","journal-title":"EURASIP Journal on Wireless Communications and Networking"},{"key":"10.7717\/peerj-cs.3108\/ref-30","first-page":"1","volume-title":"Remote exploitation of an unaltered passenger vehicle","volume":"2015","author":"Miller","year":"2015"},{"issue":"6","key":"10.7717\/peerj-cs.3108\/ref-31","doi-asserted-by":"publisher","first-page":"100837","DOI":"10.1016\/j.vehcom.2024.100837","article-title":"A robust multi-stage intrusion detection system for in-vehicle network security using hierarchical federated learning","volume":"49","author":"Muzun","year":"2024","journal-title":"Vehicular Communications"},{"key":"10.7717\/peerj-cs.3108\/ref-32","doi-asserted-by":"publisher","first-page":"103821","DOI":"10.1016\/j.autcon.2021.103821","article-title":"An engineer\u2019s guide to eXplainable artificial intelligence and interpretable machine learning: navigating causality, forced goodness, and the false perception of inference","volume":"129","author":"Naser","year":"2021","journal-title":"Automation in Construction"},{"key":"10.7717\/peerj-cs.3108\/ref-33","doi-asserted-by":"publisher","first-page":"101209","DOI":"10.1016\/j.iot.2024.101209","article-title":"CICIoV2024: advancing realistic IDS approaches against DoS and spoofing attack in IoV CAN bus","volume":"26","author":"Neto","year":"2024","journal-title":"Internet of Things"},{"key":"10.7717\/peerj-cs.3108\/ref-34","doi-asserted-by":"publisher","first-page":"55389","DOI":"10.1109\/ACCESS.2023.3282110","article-title":"Transformer-based attention network for in-vehicle intrusion detection","volume":"11","author":"Nguyen","year":"2023","journal-title":"IEEE Access"},{"key":"10.7717\/peerj-cs.3108\/ref-35","article-title":"Over-the-air: how we remotely compromised the gateway, BCM, and autopilot ECUs of Tesla cars","author":"Nie","year":"2018"},{"issue":"3","key":"10.7717\/peerj-cs.3108\/ref-36","doi-asserted-by":"publisher","first-page":"1252","DOI":"10.3390\/app13031252","article-title":"Explainable artificial intelligence (XAI) for intrusion detection and mitigation in intelligent connected vehicles: a review","volume":"13","author":"Nwakanma","year":"2023","journal-title":"Applied Sciences"},{"key":"10.7717\/peerj-cs.3108\/ref-37","doi-asserted-by":"publisher","first-page":"39213","DOI":"10.1109\/access.2023.3268519","article-title":"G-IDCS: graph-based intrusion detection and classification system for CAN protocol","volume":"11","author":"Park","year":"2023","journal-title":"IEEE Access"},{"key":"10.7717\/peerj-cs.3108\/ref-38","doi-asserted-by":"publisher","first-page":"31","DOI":"10.48550\/arXiv.1706.09516","article-title":"CatBoost: unbiased boosting with categorical features","author":"Prokhorenkova","year":"2018"},{"key":"10.7717\/peerj-cs.3108\/ref-39","doi-asserted-by":"publisher","first-page":"13820","DOI":"10.1038\/s41598-025-98433-x","article-title":"Securing the CAN bus using deep learning for intrusion detection in vehicles","volume":"15","author":"Rai","year":"2025","journal-title":"Scientific Reports"},{"issue":"3","key":"10.7717\/peerj-cs.3108\/ref-40","doi-asserted-by":"publisher","first-page":"3230","DOI":"10.1109\/TVT.2023.3327275","article-title":"X-CANIDS: signal-aware explainable intrusion detection system for controller area network-based in-vehicle network","volume":"73","author":"Seonghoon","year":"2023","journal-title":"IEEE Transactions on Vehicular Technology"},{"key":"10.7717\/peerj-cs.3108\/ref-41","doi-asserted-by":"publisher","first-page":"13","DOI":"10.1007\/978-3-030-95918-0_2","article-title":"Intrusion detection for CAN using deep learning techniques","author":"Suwwan","year":"2021"},{"issue":"1","key":"10.7717\/peerj-cs.3108\/ref-42","doi-asserted-by":"publisher","first-page":"267","DOI":"10.1111\/j.2517-6161.1996.tb02080.x","article-title":"Regression shrinkage and selection via the lasso","volume":"58","author":"Tibshirani","year":"1996","journal-title":"Journal of the Royal Statistical Society Series B: Statistical Methodology"},{"issue":"4","key":"10.7717\/peerj-cs.3108\/ref-43","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1155\/2007\/74706","article-title":"State of the art: embedding security in vehicles","volume":"2007","author":"Wolf","year":"2007","journal-title":"EURASIP Journal on Embedded Systems"},{"key":"10.7717\/peerj-cs.3108\/ref-44","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1109\/tits.2014.2351612","article-title":"A practical wireless attack on the connected car and security protocol for in-vehicle CAN","volume":"34","author":"Woo","year":"2014","journal-title":"IEEE Transactions on Intelligent Transportation Systems"},{"key":"10.7717\/peerj-cs.3108\/ref-45","doi-asserted-by":"crossref","DOI":"10.1109\/GLOBECOM38437.2019.9013892","article-title":"Tree-based intelligent intrusion detection system in internet of vehicles","author":"Yang","year":"2019"},{"key":"10.7717\/peerj-cs.3108\/ref-46","doi-asserted-by":"publisher","first-page":"3545","DOI":"10.1109\/GLOBECOM48099.2022.10001280","article-title":"LCCDE: a decision-based ensemble framework for intrusion detection in the internet of vehicles","author":"Yang","year":"2022"},{"issue":"5","key":"10.7717\/peerj-cs.3108\/ref-47","doi-asserted-by":"publisher","first-page":"3843","DOI":"10.1109\/TITS.2023.3323622","article-title":"In-vehicle network intrusion detection system using CAN frame-aware features","volume":"25","author":"Yeonseon","year":"2023","journal-title":"IEEE Transactions on Intelligent Transportation Systems"},{"issue":"1","key":"10.7717\/peerj-cs.3108\/ref-48","doi-asserted-by":"publisher","first-page":"204","DOI":"10.3390\/app14010204","article-title":"ICVTest: a practical black-box penetration testing framework for evaluating cybersecurity of intelligent connected vehicles","volume":"14","author":"Zhang","year":"2023","journal-title":"Applied Sciences"}],"container-title":["PeerJ Computer Science"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/peerj.com\/articles\/cs-3108.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/peerj.com\/articles\/cs-3108.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/peerj.com\/articles\/cs-3108.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/peerj.com\/articles\/cs-3108.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,19]],"date-time":"2025-08-19T08:28:07Z","timestamp":1755592087000},"score":1,"resource":{"primary":{"URL":"https:\/\/peerj.com\/articles\/cs-3108"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,8,19]]},"references-count":48,"alternative-id":["10.7717\/peerj-cs.3108"],"URL":"https:\/\/doi.org\/10.7717\/peerj-cs.3108","archive":["CLOCKSS","LOCKSS","Portico"],"relation":{},"ISSN":["2376-5992"],"issn-type":[{"value":"2376-5992","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,8,19]]},"article-number":"e3108"}}