This article has been accepted for publication in IEEE Open Journal of Vehicular Technology.

This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/OJVT.2025.3547761

Received XX Month, XXXX; revised XX Month, XXXX; accepted XX Month, XXXX; Date of publication XX Month, XXXX; date of
current version 27 June, 2024.
Digital Object Identifier 10.1109/OJVT.2024.0627000

Adaptive RNN Hyperparameter Tuning

for Optimized IDS Across Platforms
Kamronbek Yusupov∗ , Md Rezanur Islam∗ , Ibrokhim Muminov (Member, IEEE)† ,
Mahdi Sahlabadi (Senior Member, IEEE)‡ , and Kangbin Yim‡
1∗
Department of Software Convergence, Soonchunhyang University, Asan-si, Korea
2† Department of Computer Software Engineering, Soonchunhyang University, Asan-si, Korea
3‡
Department of Information Security Engineering, Soonchunhyang University, Asan-si, Korea
CORRESPONDING AUTHOR: Kangbin Yim (e-mail: [email protected]).
This research was supported by the MSIT(Ministry of Science and ICT), Korea, under the Convergence security core talent training business
support program(IITP-2024-2710008611) supervised by the IITP(Institute for Information & Communications Technology Planning &
Evaluation) and Soonchunhyang University Research Fund.

ABSTRACT Modern vehicles are increasingly vulnerable to cyber-attacks due to the lack of encryption
and authentication in the Controller Area Network, which coordinates communication between Electronic
Control Units. This study investigates the use of Recurrent Neural Networks to improve the accuracy
and efficiency of Intrusion Detection Systems in vehicular networks. Focusing on sequential CAN data,
we compare the performance of different RNN architectures, including SimpleRNN, LSTM, and GRU, in
detecting common attack types like Denial-of-Service, Fuzzing, Replay, and Malfunction. Sixty-three RNN
models were tested with various hyperparameters, including optimizers and learning rates. Our findings
indicate that GRU models achieve superior detection performance, particularly in resource-constrained
environments, offering near 99% accuracy in identifying cyber threats. The study also explores the
implications of six different hardware choices, revealing that devices like Jetson and Raspberry Pi, when
paired with optimal hyperparameters, can deliver efficient real-time IDS performance at a lower cost.
These results contribute to the ongoing effort to secure vehicular communication systems and highlight
the importance of balancing accuracy, resource usage, and system cost in IDS deployment.

INDEX TERMS CAN, IVN, Vehicular IDS, RNN Family, Jetson & Raspberry Devices.

I. INTRODUCTION IDS are crucial for ensuring network security since they
ONTEMPORARY vehicles are equipped with more continuously monitor system activity and network traffic to
C than a hundred Electronic Control Units (ECUs) [1]
that coordinate the operation of crucial systems such as
identify possible cyber threats [7]. For detecting intrusions,
IDS use two main techniques: Rule-Based Detection [8]
the engine, brakes, and multimedia control interfaces. ECUs and Non-Rule-Based Detection [9]. Rule-Based Detection
successfully represent the combination of intelligence and in identifying cyber threats utilizes pre-established rules or
comfort while driving, facilitated by the Controller Area signatures of known risks [10]. Alerts are triggered when
Network (CAN) [2], a communication protocol that allows the monitored traffic matches established attack patterns,
smooth communication between the ECUs. Although the which are identified based on a dataset of known attack
CAN system is widely used for ECU communication, it does patterns. While this technique is successful in detecting
not provide encryption and authentication capabilities [3], known risk signatures, it lacks the ability to detect novel,
making vehicles vulnerable to cyber-attacks. Thus, Intrusion unrecognized risks. On the other hand, Non-Rule-Based one
Detection Systems (IDSs) have been invented by automotive detects uncommon patterns by establishing a standard set
security specialists as a viable remedy to these vulnera- of regular actions and detecting any deviations from it.
bilities [4], [5]. Through the integration of IDS with the Nevertheless, it demonstrates a greater frequency of false
CAN, the security of vehicular communication networks was positives, despite its capacity to detect novel and unfamiliar
substantially enhanced [6]. attacks.

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/

VOLUME 00, 2024 1

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
 This article has been accepted for publication in IEEE Open Journal of Vehicular Technology. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/OJVT.2025.3547761

Kamronbek et al.: Preparation of Papers for IEEE OPEN JOURNALS

Non-Rule-Based Detection is mainly highlighted in this for extracting features, proposing alternative configurations
research, which encompasses three types of IDS. The first for separate RNN models, and assessing inference times
type is Flow Traffic Analysis IDS. It conducts an analysis across different platforms. In addition, this research aims
of CAN network traffic flow patterns in order to detect to determine the optimal RNN model that provides high
anomalies, such as abrupt communications or surges of In- accuracy while minimizing the use of computer resources,
Vehicle Network (IVN) [11]. While this kind of IDS is good by conducting a thorough comparison of many models and
at detecting broad patterns of malicious activity [12], cyber- their respective outputs on five IoT platforms, such as Jetson
attacks that do not substantially change traffic patterns might AGX Xavier, Jetson Xavier NX, Jetson TX2, Jetson Nano,
remain undetected. On the other hand, Payload IDS uses Raspberry Pi4, and one PC.
deep packet inspection to find cyber threats by examining the Remaining of this paper is organized as follows. Section
content of data packets [13]. This technique helps the system II examines previous studies on automotive networking and
identify complex attacks that are hidden inside packets. points out the drawbacks of current IDS methodologies.
However, the operation of this device requires significant Section III explores the utilization of RNN for feature extrac-
amount of time and computational power. Hybrid IDS, tion, providing details on the algorithm, feature extraction
which combines rule-based and non-rule-based techniques, process, and data preprocessing techniques. Section IV pro-
is generally considered as a solution for securing vehicles vides an overview of the outcomes obtained from deploying
from cyber intrusion. It analyzes the correlation between different RNN models, offering guidance on architecture
each CAN data, enhancing precision of security breach and hyperparameters, and evaluating model performance in
identification, reducing the occurrence of false positives, and various scenarios. Section V delves into the strengths of our
enabling the adjustment of risk to emerging threats [14], [15]. proposed models with a focus on hyperparameters. Lastly,
Deep learning techniques are increasingly being used to Section VI concludes the paper, summarizing the research
improve the detection capabilities of Hybrid IDS because findings and discussing the implications.
of their ability to process large amounts of data and handle
complex features. To further enhance the efficiency of deep II. BACKGROUND
learning models, it is necessary to use advanced techniques In this section, we discuss the details of the CAN and its
for extracting the most relevant features and feeding the CAN variations based on their technical capabilities, highlighting
data [16]. As a reason, comprehensive feature extraction a comparative perspective of CAN 2.0A, CAN 2.0B, and
and preprocessing guarantee the accuracy and suitability of CAN FD. Additionally, we provide an in-depth discussion
data in IDS. Moreover, the accurate detection of threats on Recurrent Neural Networks (RNNs) and their variations,
depends on the effectiveness of deep learning models and including SimpleRNN, LSTM, and GRU, with a focus on
the optimization of their hyperparameters. their technical features and a comparative analysis of their
There are two main approaches to provide data to a deep performance and applications.
learning model for IDS: the direct input technique [17] and
the time-series input method [18]. The direct input technique
A. Controller Area Network
involves the immediate input of raw data into the models
without any processing. However, the effectiveness of IDS The CAN is a data transmission protocol developed by Bosch
might be unintentionally limited by overload problems in in 1983 [23], originally designed to optimize interactions
deep learning systems functioning in complex environments between ECUs in vehicles. The main objectives of CAN
[19]. The time-series approach, which arranges data in a were to minimize wiring, improve communication reliability,
sequential fashion according to time, offers advantages in and simplify the integration of various control systems.
handling vast volumes of data and enhancing system per- CAN represented a significant milestone in the evolution
formance in situations with substantial data volume, such as of automotive networks, enabling substantial advancements
IVNs. in both functionality and safety. The first mass production
Recurrent Neural Networks (RNNs) are particularly suit- integration of CAN in automotive systems occurred in 1991,
able for IDS because of the sequential nature of CAN data. after which it became an industry standard.
This characteristic allows RNNs to effectively handle and The CAN is a robust vehicle bus standard designed to
learn from this sort of data. Hence, the use of the time- enable efficient communication among ECUs. CAN has
series technique with RNNs results in enhanced performance evolved through three main versions: CAN 2.0A, CAN
in IDS [20]–[22]. 2.0B, and CAN FD, each catering to progressively advanced
In order to create an effective IDS for analyzing se- requirements, as detailed in Table 1. CAN 2.0A, as illustrated
quential data, especially for the CAN bus, it is important in Figure 1a, supports a standard identifier [24], limiting
to consider the following aspect. Consequently, finding the unique message IDs and making it suitable for simple
most appropriate RNN models and configurations that can control systems with basic communication needs. CAN 2.0B,
efficiently process sequential data is the main goal of this re- depicted in Figure 1b, extends the identifier length [25],
search. It includes the following tasks: enhancing techniques significantly increasing the number of unique message IDs
and enhancing its utility for complex systems requiring

2 VOLUME 00, 2024

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
 This article has been accepted for publication in IEEE Open Journal of Vehicular Technology. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/OJVT.2025.3547761

(a) CAN 2.0A: Standard 11-bit Identifier

(b) CAN 2.0B: Extended 29-bit Identifier

(c) CAN FD: Flexible Data Rate

FIGURE 1. Comparison of CAN Protocol Versions: CAN 2.0A, CAN 2.0B, and CAN FD

advanced addressing and compatibility. The modern CAN higher data rates and lower latency, such as brake control,
FD (Flexible Data Rate), shown in Figure 1c, introduces suspension, and power steering. These systems are critical
higher data transmission speeds and larger payload capacities for vehicle safety and performance, making C-CAN essential
[26], making it more suitable for the rapid transmission in modern vehicle designs. M-CAN, on the other hand,
of sensor data required by Advanced Driver Assistance handles multimedia and infotainment systems, managing
Systems (ADAS) components such as cameras, radars, and features like audio, video, and navigation data. M-CAN typi-
LiDARs. These versions are compared in Table 1, which cally operates at intermediate data rates to balance bandwidth
highlights key technical differences, including frame format, needs and system performance. These CAN channels are
data length, transmission speed, and error detection mech- structured to optimize communication within the IVN by
anisms. Operating on a CSMA/CR (Carrier Sense Multiple assigning speed and priority levels based on the criticality of
Access with Collision Resolution) mechanism [27], the CAN the systems they manage, ensuring efficiency and reliability
protocol ensures efficient communication by transmitting in various vehicle operations.
messages with identifiers that prioritize critical data, enabling As displayed in Fig 1c, the Start of Frame (SOF) marks
real-time systems to function without delays. This evolution the beginning of a new transmission with a single dominant
underscores the adaptability of CAN to meet the diverse bit, synchronizing all nodes on the CAN bus. The Identifier
and growing demands of modern automotive and industrial (ID) field varies between CAN versions, providing message
systems. priority through an 11-bit identifier in CAN 2.0A, a 29-bit
CAN is divided into specialized channels to cater to extended format in CAN 2.0B, and backward-compatible
specific vehicle functionalities, such as B-CAN (Body CAN), formats in CAN FD. The Remote Transmission Request
C-CAN (Chassis CAN), and M-CAN (Multimedia CAN) (RTR) and Identifier Extension (IDE) fields define the type
[28], [29]. B-CAN operates at lower data rates and prioritizes of frame and distinguish between standard and extended
non-critical communication for systems like climate control, identifiers, with CAN FD replacing RTR with the Frame
lighting, and central locking, where latency is less critical. Data Field (FDF) for flexible data rates. Reserved bits like
C-CAN is designed for chassis-related functions that require r0, r1, and others, fixed as dominant in CAN 2.0A and

VOLUME 00, 2024 3

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
 This article has been accepted for publication in IEEE Open Journal of Vehicular Technology. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/OJVT.2025.3547761

Kamronbek et al.: Preparation of Papers for IEEE OPEN JOURNALS

TABLE 1. Technical Differences Between CAN 2.0A, CAN 2.0B, and CAN FD
Feature CAN 2.0A CAN 2.0B CAN FD
Frame Format Standard 11-bit Identifier Extended 29-bit Identifier Standard and Extended (Backward Compatible)
Data Length Up to 8 bytes Up to 8 bytes Up to 64 bytes
Data Transmission Speed Up to 1 Mbps Up to 1 Mbps Up to 8 Mbps (arbitration phase retains CAN speed)
Protocol Efficiency Fixed data rate, high overhead Fixed data rate, high overhead Flexible data rate, reduced overhead
Error Detection 15-bit CRC 15-bit CRC 17-bit or 21-bit CRC (enhanced robustness)
Arbitration Method Non-destructive bitwise arbitration Non-destructive bitwise arbitration Non-destructive bitwise arbitration
Backward Compatibility N/A Yes (to CAN 2.0A) Yes (to CAN 2.0)
Bus Load Handling Limited Limited Enhanced (due to increased payload capacity)
Use Case Examples Basic ECUs and simple sensors Advanced ECUs, extended addressing ADAS and high-speed, high-reliability systems
Security Features None None Optional security extensions

(a) RNN: Recurrent Neural Network Architecture

(b) LSTM: Long Short-Term Memory Architecture (c) GRU: Gated Recurrent Unit Architecture

FIGURE 2. Comparison of RNN Family

2.0B, evolve in CAN FD to enable higher speeds and back- successful transmissions, with dominant or recessive bits
ward compatibility through additions like FDF and Bit Rate indicating acknowledgment status. The frame concludes with
Switching (BRS) [30]. Other essential components include the End of Frame (EOF), a 7-bit recessive field, and the
the Data Length Code (DLC), which specifies payload sizes Intermission (IFS), a 3-bit spacing that separates consecutive
ranging from 0 to 8 bytes in CAN 2.0A and 2.0B, and up to frames and ensures processing readiness.
64 bytes in CAN FD for high-bandwidth needs. The Payload In designing an effective Intrusion Detection System (IDS)
(Data Field) contains the transmitted data, while the Cyclic for CAN networks, it is essential to account for the diverse
Redundancy Check (CRC) ensures integrity, offering a 15-bit features present in CAN messages, which can vary across
CRC in CAN 2.0A and 2.0B, and a more robust 17- or 21-bit different protocol versions such as CAN 2.0A, CAN 2.0B,
CRC in CAN FD. The Acknowledge (ACK) field confirms and CAN FD. These variations influence the input features

4 VOLUME 00, 2024

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
 This article has been accepted for publication in IEEE Open Journal of Vehicular Technology. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/OJVT.2025.3547761

that can be utilized for intrusion detection. In this study, ct = ft · ct−1 + it · tanh(Wc · [ht−1 , xt ] + bc ),
we focus on identifying the optimal combination of features
ot = σ(Wo · [ht−1 , xt ] + bo ), ht = ot · tanh(ct ).
that are effective across all versions of CAN messages. This
approach aims to develop a standardized IDS framework that where ft , it , and ot represent the forget gate, input gate,
ensures robust and reliable detection capabilities, regardless and output gate, respectively, and σ denotes the sigmoid
of the underlying CAN protocol version or application. Such activation function, which constrains values between 0 and
a unified system is critical for enhancing the security and 1.
resilience of in-vehicle networks across diverse automotive The forget gate
and industrial implementations. ft = σ(Wf · [ht−1 , xt ] + bf )
decides the proportion of the previous cell state (ct−1 ) to
B. Recurrent Neural Networks (RNN)
retain by evaluating the previous hidden state (ht−1 ) and the
Recurrent Neural Networks (RNN) are a class of artificial current input (xt ).
neural networks developed in the 1980s for processing time- The input gate
dependent and sequential data. Unlike traditional feed for-
ward neural networks, which assume independence between it = σ(Wi · [ht−1 , xt ] + bi )
input data, RNNs leverage a mechanism of recursion to determines which parts of the new information, modulated
incorporate information from previous time steps [31]. This by a tanh activation
makes them ideal for analyzing sequential data such as text,
tanh(Wc · [ht−1 , xt ] + bc ),
time-series data, and audio signals. However, as mentioned in
Table 2, the basic RNN architecture has limitations related are relevant to add to the cell state.
to training on long sequences [32], which has led to the The cell state (ct ) is updated by combining the retained
development of improved versions like Long Short-Term information from the forget gate
Memory (LSTM) [33] and Gated Recurrent Unit (GRU) [34]. ft · ct−1
SimpleRNN shown in Fig. 2a, is the basic architecture of
recurrent neural networks. It includes a hidden state that is and the new information from the input gate
updated at each time step based on the current input and it · tanh(...).
the state from the previous step. The update formula for the
hidden state (ht ) is as follows: The output gate

ht = σ(Wxh · xt + Whh · ht−1 + bh ), ot = σ(Wo · [ht−1 , xt ] + bo )

where Wxh and Whh are weight matrices, bh is a bias vector, controls how much of the updated cell state contributes to
and σ is an activation function, such as tanh. the hidden state (ht ), which is further processed through a
SimpleRNN performs well on tasks that require capturing tanh activation function
short-term dependencies. However, it faces significant chal- ht = ot · tanh(ct ).
lenges when training on long sequences due to vanishing
These mechanisms enable LSTM to handle long-term de-
and exploding gradients during Backpropagation Through
pendencies effectively, making it particularly useful in tasks
Time (BPTT) [35]. This limitation restricts the model’s
such as text analysis and prediction of time series. However,
ability to effectively learn long-term dependencies, making
the complexity of the LSTM model increases computational
it less suitable for complex sequential tasks. To address
costs, which can be a critical factor in resource-constrained
the issue of vanishing gradients, the LSTM architecture
environments.
was introduced. Unlike SimpleRNN, LSTM incorporates
GRU was proposed as a simplified version of LSTM
specialized components called ”gates” that manage the flow
shown in Fig. 2c. GRU reduces computational complexity
of information, as shown in Fig. 2b. These gates allow the
by combining the forget and input gates into a single ”update
model to preserve important long-term dependencies while
gate” (zt ) and introducing a ”reset gate” (rt ) to control the
filtering out irrelevant data. The main components of LSTM
flow of information. The update equations in GRU are as
include “forget gate”, “input gate”, and “output gate”. The
follows:
input gate decides which new information should be stored
from the current input. On the other hand, the forget gate
determines which information from the previous state should zt = σ(Wz · [ht−1 , xt ] + bz ), rt = σ(Wr · [ht−1 , xt ] + br ),
be discarded. Output gate is responsible for regulating which h̃t = tanh(Wh · [rt · ht−1 , xt ] + bh ),
part of the cell state contributes to the current output.
The update of the cell state (ct ) and the hidden state (ht ) ht = zt · ht−1 + (1 − zt ) · h̃t .
in LSTM is defined by the following equations: Where zt and rt represent the update gate and reset gate,
respectively, and σ is the sigmoid activation function, which
ft = σ(Wf · [ht−1 , xt ] + bf ), it = σ(Wi · [ht−1 , xt ] + bi ),

VOLUME 00, 2024 5

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
 This article has been accepted for publication in IEEE Open Journal of Vehicular Technology. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/OJVT.2025.3547761

Kamronbek et al.: Preparation of Papers for IEEE OPEN JOURNALS

TABLE 2. Comparison of SimpleRNN, LSTM, and GRU

Feature SimpleRNN LSTM GRU
Architecture Basic RNN with a single hidden state Incorporates forget, input, and output gates for Combines forget and input gates into an update
updated at each time step. controlling information flow. gate and adds a reset gate for simpler structure.
Memory Capability Limited to short-term dependencies Handles long-term dependencies effectively with Handles long-term dependencies similarly to
due to vanishing gradients. controlled memory gates. LSTM but slightly reduced for very long
sequences.
Gradient Issues Suffers from vanishing and exploding Mitigates vanishing gradients through gate Also mitigates vanishing gradients but with a
gradients in long sequences. mechanisms. simpler design.
Computational Cost Low computational complexity due to High computational cost due to complex gates. Lower computational cost than LSTM, suitable
simplicity. for resource-constrained environments.
Flexibility Less flexible, suitable for tasks Highly flexible, suitable for complex and Flexible and optimized for environments with
requiring short-term memory. long-term sequential tasks. limited computational power.
Performance Limited performance on long High performance for tasks requiring long-term Comparable to LSTM with fewer parameters and
sequences. memory. faster training.
Applications Suitable for simple tasks like basic Ideal for complex tasks such as language Effective for resource-constrained tasks, real-time
time-series prediction. modeling, translation, and sequence forecasting. applications, and mobile systems.

outputs values between 0 and 1 to control the degree of III. RELATED WORK
information flow. A systematic review of related studies [41] shows that
The update gate deep learning-based approaches, especially Long Short-Term
zt = σ(Wz · [ht−1 , xt ] + bz ) Memory (LSTM) and Gated Recurrent Unit (GRU) from the
RNN family, were determined to be the most efficient in
determines how much of the previous hidden state (ht−1 ) detecting attacks on vehicles. The reason is that LSTM and
should be retained and carried forward. GRU effectively handle sequential data tasks and learn long-
The reset gate term dependencies with high accuracy, minimizing the risk
rt = σ(Wr · [ht−1 , xt ] + br ) of vanishing gradients. Due to its unique architecture, LSTM
can control the flow of information through internal gates,
controls how much of the previous hidden state should be helping retain relevant information and discard unnecessary
ignored when computing the candidate hidden state (h̃t ). data. GRU models are a simplified version of LSTMs that
The candidate hidden state also effectively handle long-term data while using fewer
h̃t = tanh(Wh · [rt · ht−1 , xt ] + bh ) computational resources, making them suitable for the ve-
hicle IDS.
is computed by combining the reset-modulated previous
Previous studies that focused on enhancing IDS through
hidden state and the current input (xt ), processed through
RNN-family models and provide comprehensive details
a tanh activation function.
about the research technique, as shown in Table 3, were
Finally, the hidden state
gathered from the existing literature. To be more specific,
ht = zt · ht−1 + (1 − zt ) · h̃t the selection criteria for the existing literature are based on
is updated as a weighted combination of the previous hidden feature extraction techniques, RNN model types, input data,
state (zt · ht−1 ) and the candidate hidden state ((1 − zt ) · h̃t ), attack types, and, especially, details about the inference time
with the weights controlled by the update gate. on various devices where the tests were conducted. This
This simplified structure of GRU effectively manages resulted in the identification of five studies closely related
long-term dependencies while reducing computational com- to this study: three using LSTMs and two using GRUs.
plexity compared to LSTM. Zhu et al. proposed a multi-task intrusion detection
Due to its simplified structure, GRU requires fewer re- method [36] for IVN using LSTM and Mobile Edge Com-
sources while maintaining a performance comparable to that puting (MEC). The proposed model includes two separate
of LSTM. GRU is particularly effective in tasks with limited LSTM neural networks processing data based on temporal
computational resources and has shown excellent results in and content features. The multi-task LSTM architecture
sequential data processing. includes a shared hidden layer processed locally, after which
In this study, we utilize all three types of RNNs, Sim- data and temporal features are processed in parallel on the
pleRNN, LSTM, and GRU, to identify the most effective MEC server. The effectiveness of this model was confirmed
IDS solution for in-vehicle networks, leveraging their unique with a high accuracy of 89.3%. Furthermore, the research
strengths and addressing their respective limitations to ensure indicated that the average run time used for each CAN
optimal performance and reliability. detection took only 0.61 ms. Despite the high detection
speed, the use of MEC might cause network delays when
transmitting CAN messages to the server. Another research
[37] developed CAN-ADF (The Controller Area Network
- Attack Detection Framework) to address multi-class clas-

6 VOLUME 00, 2024

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
 This article has been accepted for publication in IEEE Open Journal of Vehicular Technology. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/OJVT.2025.3547761

TABLE 3. Summary of Previous Studies on Inference Time and Accuracy in Vehicular IDS Using RNN Models
Author Type Dataset Feature Extraction Classification Type Device Inference Time Accuracy%
Zhu et al. [36] LSTM Self-Created Dataset Payload Binary Classification Intel i5 GPU 3.3GHz 0.61 ms 89.3
Tariq et LSTM Self-Created Dataset CAN ID and Payload Multiclass Classification CPU Intel Xeon 73 ms 99.54
al. [37] E5-1650 3.60GHz, GPU
GTX 1080Ti
Khan et LSTM UNSWNB-15, Car PCA on full dataset Binary Classification Intel i5 3.20 GHz 0.023 ms 98-99
al. [38] Hacking Dataset (HCRL)
Kukkala et GRU SynCAN Payload Binary Classification Jetson TX2 CPU ARM 80 ms 99
al. [39] Cortex-A57
Haoyu et GRU HRCL Payload Sum, Time Multiclass Classification Jetson Xavier NX 890 ms 99
al. [40] Variance, Time Gap, MAD

sification tasks aimed at detecting intrusions in the CAN model required 890 ms to analyze and detect all these
communication system. This model is considered hybrid messages, which points out the challenge of ensuring real-
as it combines rule-based detection methods and LSTM to time performance on embedded devices with limited compu-
identify anomalies in vehicular communication systems. The tational power, indicating the need for further simplification
attack detection accuracy of the proposed model reached up or improved hardware capabilities. In conclusion, this study
to 99% with the attack detection time of 73 ms. Khan et al. takes a broader approach to the aspects outlined in Table 1.
proposed an advanced multi-stage deep learning system for Whereas most of the aforementioned studies utilized self-
detecting malicious activities in autonomous vehicles [38]. created CAN data, a standard HRCL dataset was chosen for
The proposed approach combines two methods, such as the this research. As a reason, the reliability of synthetic data
Bloom filter and bidirectional LSTM, to ensure security is a point of discussion in terms of data representativeness,
and provide highly accurate anomaly detection in the CAN privacy preservation, and, most importantly, potential biases
communication system. Several methods, including feature [42]. Furthermore, minimal elements of the CAN data, Time
transformation, reduction using principal component analysis Gap and CAN ID, were chosen for feature extraction, as they
(PCA), and standardization, were applied for thorough data can cover all CAN Protocol Attack types, as shown in Table
preprocessing. It has consequently resulted in the anomaly 4. Consequently, multiclass classification had to be selected
detection accuracy of 98.88% and 99.11% for the UNSW- for each proposed RNN model. This study primarily tested
NB15 and Car Hacking Dataset, respectively. Although a both LSTM and GRU models with various hyperparameter
temporal analysis of the testing showed that anomaly detec- configurations across different IoT devices, identifying the
tion took only 0.023 ms, this method is considered highly optimal model configuration for each device.
resource-intensive for an IDS, which may pose challenges
in environments with limited computational power. IV. EXPERIMENTAL SETUP
In terms of the studies that implemented a GRU for A. FEATURE EXTRACTION
enhancing a vehicle’s IDS, Kukkala et al. presented an The datasets used in this study are sourced from HCRL’s [43]
IDS based on an autoencoder using the GRU model [39] KIA SOUL vehicles and has the following features. They
for automotive sensor networks. In the study, they com- include four different types of attacks mentioned in Table 4
pared their model with previously proposed LSTM-based along with an attack-free dataset. These datasets underwent
autoencoders. The results demonstrated that their model rigorous analysis, cleaning, and standardization. Key features
outperforms LSTM in detection speed while maintaining include “Time offset” and “CAN ID”. CAN ID defines the
the same high accuracy. The results also showed that the payload’s priority along with the sender and receiver ECUs’
developed IDS can detect anomalies in the CAN network information. Time offset represents the payload generation
with 99% accuracy. However, it is worth noting that the time via CAN ID. To streamline model training and reduce
use of autoencoders and GRU requires significant compu- computational complexity, the study focused on extracting
tational resources. The analysis and anomaly detection were features solely from the CAN ID and the time interval
performed using a Jetson TX2 device, providing a detection between messages. The dataset was then transformed using
time of 80 ms. Thus, despite the high efficiency and speed of a LabelEncoder. This preprocessing step was critical for
the proposed solution, its implementation requires powerful enhancing the performance of RNN models in the subsequent
hardware to ensure stable operation in real-world conditions. analysis.
On the other hand, Haoyu Ma et al. developed a lightweight
IDS that utilizes a GRU neural network [40]. Proposed GRU
B. PLATFORM SELECTION
model demonstrated high accuracy, achieving F1-scores of
0.9992 for DoS, 0.9922 for Fuzzy, and 0.9963 for Spoofing The platforms listed in Table 5 were utilized for the practical
attacks. IDS was tested for intrusion detection time on the implementation of an intrusion detection system on in-
Jetson Xavier NX device using 5000 CAN messages. The vehicle networks where all devices are commonly used as
single broad computer as shown in related works. These

VOLUME 00, 2024 7

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
 This article has been accepted for publication in IEEE Open Journal of Vehicular Technology. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/OJVT.2025.3547761

Kamronbek et al.: Preparation of Papers for IEEE OPEN JOURNALS

TABLE 4. Table of CAN Protocol Attack Types and Characteristics

Type of Attack Description Method Example CAN IDs Timing Constraints Effects
DoS Interferes with regular operation by Floods the CAN network causing 0x00 0.0003 to 0.0005 Disruption of normal system
flooding the network with network congestion and eventual seconds functioning, potential
high-priority messages. failure. dangerous driving conditions.
Fuzzing Identifies system weaknesses by Sends identification messages with 0x000 to 0.0003 to 0.0005 Reveals system weaknesses,
sending false information including priorities ranging from high to low. 0x7FF seconds potential malfunction.
various priority messages.
Replay Steals and retransmits valid Retransmits messages seen as N/A 0.0003 to 0.0005 Confusion inside the system,
communications to cause confusion. original, causing unintended actions seconds potential unintended actions.
or system setting changes.
Malfunction Sends false signals to manipulate Randomly selects CAN IDs and 0x153 17 false signals Anomalous system responses,
data field values. alters data fields. every 5-20 potential system failure.
seconds

devices, ranging from low-power single-board computers uates combinations of hyperparameters to determine the
like the Raspberry Pi 4, Jetson Nano, and Jetson NX, to optimal configuration for a model. This approach tested
more advanced platforms such as the Jetson TX2, Jetson various learning rates (e.g., 0.0001, 0.001, 0.01, and 0.5)
AGX Xavier, and a high-performance PC, provide a diverse and optimizers, including Adam, AdamW, Nadam, Adadelta,
range of computational capabilities. The specifications in- Adagrad, and RMSprop. As noted in Md. Delowar et al.’s
clude varying CPU architectures, GPU processing power, findings, lower learning rates such as 0.0001 and 0.001
and memory bandwidths, enabling the evaluation of IDS typically lead to stable training and improved model perfor-
performance across different hardware configurations. This mance, while higher rates like 0.5 can introduce instability
setup ensures a comprehensive analysis of the IDS under and hinder convergence. Based on this grid search process,
resource-constrained environments, such as those in em- the selected configurations for the RNN models were fi-
bedded automotive systems, as well as high-performance nalized and are detailed in Table 6. These configurations
systems for real-time detection. served as the foundation for the experimental evaluation,
ensuring a systematic and optimized approach to training
C. DATA PRE-PROCESSING the models for intrusion detection in in-vehicle networks.
In this research, mean normalization was utilized to enhance This meticulous hyperparameter tuning process was crucial
the performance of RNN within the context of a CAN bus to achieving robust and reliable performance across diverse
IDS. The preparation of data is a critical step that directly system environments.
impacts the quality of input data, subsequently improving
model training efficacy and boosting the accuracy of predic- V. EVALUATION
tions. By applying mean normalization technique, the data Developing an IDS for IVN with optimal inference time
is centered around zero and scaled according to the standard and state-of-the-art accuracy was achieved through a two-
deviation, which helps in compensating for variations in stage experiment. In the first stage, sixty-three models using
feature scales and reduces the risk of numerical instability different RNN architectures and hyperparameter settings
during model training. Standardizing the dataset using these were evaluated, as shown in Table 6 for hyperparameters
calculations ensures that the features contribute uniformly to and Table 7 for accuracy. The results indicate that for
the model, thereby enhancing the learning process. DoS, fuzz, and malfunction attacks, the majority of models
Further, we applied the Time Series Input technique to attained nearly 100% accuracy. Nevertheless, the accuracy
effectively manage sequential CAN bus data, optimizing the significantly dropped for replay attacks. Therefore, we pri-
training process by using ten-line windows. This method oritized each model’s ability to identify replay attacks when
enables the model to efficiently identify patterns of malicious choosing the optimal option for the IDS, as it was crucial
and attack free behavior by sequentially analyzing the data. for comprehensive attack detection.
If a cyber-attack is detected in any of the ten consecutive
time intervals, all intervals are marked as compromised; A. ACCURACY MATRIX
otherwise, they are labeled safe. This cyclic process across In Fig. 3. and Table 8 represent the accuracy metrics of multi-
the dataset allows the model to proficiently classify data ple RNN models, on Fig. 3 the x-axis denoting the learning
segments and recognize attack patterns, making time series rates and the y-axis representing different optimizers. The
analysis essential for detecting CAN bus vulnerabilities. SimpleRNN model has lower performance compared to the
GRU and LSTM models, as illustrated in Figures 3a, 3c, and
D. HYPER-PARAMETER CONFIGURATION 3b, respectively. Significantly, except for settings utilizing a
In this study, hyperparameter selection was performed using learning rate of 0.001 and optimizers like Adamax, Adagrad,
a grid search strategy, following the methodology outlined and Adadelta, most models attained an overall accuracy
by Md. Delowar et al. Grid search systematically eval- of 98%. 21 of the 63 assessed models shown in Table 7

8 VOLUME 00, 2024

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
 This article has been accepted for publication in IEEE Open Journal of Vehicular Technology. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/OJVT.2025.3547761

TABLE 5. Enhanced Device Specifications

Device CPU Specifications GPU Specifications Memory and Bandwidth
Raspberry Pi 4 Quad-core ARM Cortex-A72 Clocked at 1.5 VideoCore VI Clocked at 600 MHz 8 GB LPDDR4
GHz or 1.8 GHz
Jetson Nano Quad-core ARM Cortex-A57 Maxwell Architecture 128 NVIDIA CUDA cores 4 GB 64-bit LPDDR4
Jetson NX 6-core NVIDIA Carmel ARM® v8.2 64-bit CPU 384-core NVIDIA Volta™ GPU with 48 Tensor Cores 8 GB 128-bit LPDDR4x
Jetson TX2 Dual-core NVIDIA Denver 2 Quad-core ARM 256-core NVIDIA Pascal™ GPU Optimized for 8 GB 128-bit LPDDR4
Cortex-A57 64-bit CPU power efficiency
Jetson AGX 8-core NVIDIA Carmel ARM® v8.2 64-bit CPU 512-core NVIDIA Volta™ GPU with 64 Tensor Cores 32 GB 256-bit LPDDR4x Bandwidth:
Xavier 8MB L2 + 4MB L3 AI acceleration support 136.5 GB/s
PC AMD Ryzen 5 3600XT 6-Core Clocked at 3.79 GTX 1660 Super Turing Architecture 16 GB DDR4
GHz

(a) SimpleRNN (b) LSTM (c) GRU

FIGURE 3. Performance analysis of RNN models for replay attack detection: a comparative evaluation of optimizers
and learning rates

were selected as the ideal RNN-based IDS configuration for Furthermore, the performance evaluation across various
further evaluation. The IDS performance evaluation in Table hyperparameters underscores the importance of tuning for
8 shows that both GRU and LSTM models achieve high ac- specific hardware. Proper tuning enables even low-cost de-
curacy (97-98%) across all configurations, with GRU Nadam vices like the Raspberry Pi 4 to achieve near real-time
slightly outperforming others at 98% accuracy. Precision, detection, whereas the Jetson Nano did not perform as well
recall, and F1-scores for critical attack classes like DoS, compared to other devices. For example, using the Nadam
Fuzz, and Malfunction consistently reach 1.00, indicating optimizer with a learning rate of 0.001 for the LSTM, and
excellent detection capabilities. Replay attacks demonstrate the AdamW optimizer with the same learning rate for the
slight variations in performance, with GRU Nadam achieving GRU on the Raspberry Pi 4, delivered results comparable
the highest F1-score of 0.94. to the best-performing setups, despite the Raspberry Pi’s
limited computational resources. This suggests that careful
B. INFERENCE TIME optimization can achieve an effective balance between cost
In the second stage of the study, the selected LSTM and and performance in embedded systems, particularly with
GRU models were thoroughly tested on five different IoT GRU models. While the Jetson AGX Xavier offers superior
platforms and one PC to evaluate their inference time, as performance, the cost-effectiveness of the Raspberry Pi 4,
shown in Fig. 4. As a result, the Jetson AGX Xavier stands especially when paired with appropriate hyperparameters
out as the highest performer when paired with the Adam like Nadam and AdamW at a 0.001 learning rate, cannot be
optimizer at a learning rate of 0.001 for both LSTM and missed for budget-sensitive applications. This study empha-
GRU, achieving the fastest inference times. However, its sizes the vital role of hyperparameter tuning in maximizing
higher cost restricts its feasibility for cost-sensitive appli- performance while managing costs, particularly in resource-
cations. On the other hand, the Jetson Xavier NX delivers constrained environments.
nearly comparable performance with all hyperparameters at In Fig. 5, a comparative analysis illustrates the deploy-
a significantly lower price point, making it a more cost- ment of the proposed model across six devices, with their
effective alternative. Though Jetson TX2 provide poor per- specifications detailed in Table 5. In contrast, most previous
formance compared to Jetson Xavier NX. This highlights the studies evaluated their models primarily on PCs, with a few
critical trade-off between performance and cost, which must exceptions, such as Haoyu et al., who tested on the Jetson
be carefully considered when selecting embedded systems Xavier NX, and Kukkala et al., who utilized the Jetson
for real-time applications. TX2. However, this study provides a broader evaluation by

VOLUME 00, 2024 9

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
 This article has been accepted for publication in IEEE Open Journal of Vehicular Technology. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/OJVT.2025.3547761

Kamronbek et al.: Preparation of Papers for IEEE OPEN JOURNALS

TABLE 6. RNN Hyperparameter Configuration TABLE 7. Accuracy of Different RNN Models Configu-
Hyperparameter Value rations by Optimizer
SimpleRNN
Optimizer Learning Rate SimpleRNN (%) GRU (%) LSTM (%)
Model Type GRU
LSTM LR 0.0001 0.98 0.99 0.99
Input Size 2 Adam LR 0.001 0.98 0.99 0.99
Sequence Length 10 LR 0.01 0.89 0.94 0.93
Number of RNN Layers 2 LR 0.0001 0.97 0.99 0.99
Hidden Size (RNN models) 128 (first layer)
Nadam LR 0.001 0.98 0.99 0.98
64 (second layer)
Dropout Rate 0.2 LR 0.01 0.87 0.91 0.92
Batch Normalization After each RNN layer LR 0.0001 0.96 0.98 0.98
Fully Connected Layers 1 Adamax LR 0.001 0.98 0.99 0.99
Output Layer Softmax
LR 0.01 0.89 0.91 0.90
Loss Function CategoricalCrossentropy
Adadelta LR 1.0 0.96 0.98 0.99
Adagrad Adadelta LR 0.1 0.97 0.98 0.98
Adam LR 0.01 0.96 0.96 0.95
Optimizer Adamax
LR 0.001 0.91 0.94 0.93
AdamW
Nadam Adagrad LR 0.01 0.96 0.98 0.97
RMSprop LR 0.1 0.80 0.99 0.99
0.0001 LR 0.0001 0.98 0.99 0.99
0.001
AdamW LR 0.001 0.98 0.99 0.99
Learning Rate 0.01
0.1 LR 0.01 0.90 0.91 0.91
1.0 LR 0.0001 0.98 0.99 0.99
Number of Classes 5 RMSprop LR 0.001 0.97 0.99 0.99
Number of Epochs 50
LR 0.01 0.89 0.90 0.90
Batch Size 128

including a wider range of commonly used IoT platform. when comparing the performance on other devices, such as
It is important to note that the performance of models the Jetson AGX Xavier, Jetson Nano, and Raspberry Pi 4,
evaluated on PCs cannot be standardized due to the varying the proposed model delivered inference times under 10 ms
specifications of these machines. Haoyu et al.’s study on in most cases, demonstrating the efficiency and scalability
the Jetson Xavier NX model employed a learning rate of of this approach across different IoT platform. Moreover,
0.01 with the Adam optimizer, achieving an inference time by fine-tuning hyperparameters, such as the learning rate
of 890 ms for 5000 sequential inputs. When the model and optimizer, the model’s performance can be further en-
was adjusted to a window size of 10, the inference time hanced, ensuring efficient operation across various hardware
was 1.78 ms. In contrast, the proposed model utilizing a platforms.
GRU with the Nadam optimizer and a learning rate of
0.001 achieved an inference time of approximately 7.5 ms
on the Jetson Xavier NX. The re-implementation of Haoyu C. CROSS VALIDATION
et al.’s model revealed certain limitations. Their approach To evaluate the performance and robustness of the proposed
relies on an extensive feature extraction process but omits IDS models, a 7-fold Cross-Validation method was applied,
time series windowing and excludes Replay attack analysis. as shown in Fig. 6. This approach, chosen for its balance
Consequently, the model demonstrated a significantly higher between computational efficiency and performance, divides
false positive rate at around 10% on DoS, Fuzz and Spoofing the dataset containing millions of records into seven equal
attack in real-world, dynamic scenarios, underscoring the subsets while maintaining class balance (e.g., normal data
weakness of their proposed model in handling diverse and and anomalies). In each iteration, six folds are used for
evolving conditions. training, and the remaining fold is reserved for testing,
Similarly, Kukkala et al.’s study on the Jetson TX2 with ensuring that every fold is used as a test set exactly once.
a GRU model used a learning rate of 0.0001 with the This systematic process is repeated seven times, providing a
Adam optimizer, resulting in an inference time of 80 ms comprehensive assessment of the models’ capabilities. The
with a window size of 20; with a window size of 10, results highlight consistent accuracy across all folds, with
the inference time was 40 ms. In contrast, the proposed GRU achieving a maximum accuracy of 98% using the
GRU model by this study on the same device, with the Nadam optimizer and LSTM performing competitively with
AdamW optimizer and a learning rate of 0.001, significantly up to 97% accuracy. These findings validate the effectiveness
reduced the inference time to just 7.55 ms. Additionally, of the proposed system in detecting intrusions within in-

10 VOLUME 00, 2024

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
 This article has been accepted for publication in IEEE Open Journal of Vehicular Technology. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/OJVT.2025.3547761

TABLE 8. Performance Metrics of Models with Different Configurations

Model Class Precision Recall F1-score Accuracy Macro Avg (P/R/F1) Weighted Avg (P/R/F1)
Normal 0.88 0.99 0.93
DoS 1.00 1.00 1.00
GRU AdamW Fuzz 1.00 1.00 1.00 0.97 0.97 0.97
Replay 0.99 0.87 0.92
Malfunction 1.00 1.00 1.00
Normal 0.93 0.91 0.92
DoS 1.00 1.00 1.00
LSTM AdamW Fuzz 1.00 1.00 1.00 0.97 0.97 0.97
Replay 0.91 0.93 0.92
Malfunction 1.00 1.00 1.00
Normal 0.92 0.97 0.94
DoS 1.00 1.00 1.00
GRU Nadam Fuzz 1.00 1.00 1.00 0.98 0.98 0.98
Replay 0.97 0.91 0.94
Malfunction 1.00 1.00 1.00
Normal 0.94 0.91 0.92
DoS 1.00 1.00 1.00
LSTM Nadam Fuzz 1.00 1.00 1.00 0.97 0.97 0.97
Replay 0.91 0.95 0.93
Malfunction 1.00 1.00 1.00

(a) LSTM (b) GRU

FIGURE 4. Comparative inference time analysis of RNN models with diverse hyperparameters on five IoT devices
and one PC.

vehicle networks, showcasing a reliable and unbiased eval- showcase that GRU models outperform traditional LSTM
uation methodology. models in both inference time and computational efficiency,
making them well-suited for resource-constrained environ-
VI. DISCUSSION ments. Additionally, the study highlights the adaptability
The study demonstrates significant advancements in utilizing of the model across different hardware platforms, offering
RNNs, particularly GRU models, for intrusion detection in both cost-effective and high-performance solutions. This
IVNs. By optimizing hyperparameters and employing time- capability ensures the model’s broader applicability, from
series data input based on CAN ID sequence and time low-cost embedded systems to more advanced processing
interval, which is applicable to all types of CAN versions, units, all while maintaining high detection rates.
the system achieves high accuracy, nearly 99%, for various The choice of optimizer and learning rate significantly
cyber-attack types such as DoS, fuzz, and malfunction. impacts model performance and accuracy. While optimiz-
However, the accuracy for replay attacks is comparatively ers like Adagrad, Adadelta, and RMSprop adapt learning
lower at 94%. Replay attacks are hard to detect because rates over time, they often lack momentum, making them
they mimic normal network flow, lacking distinct anomalies, slower and less efficient in resource-constrained environ-
and ML models struggle with their high similarity to normal ments. Adam is a popular choice due to its adaptive learning
data. Limited contextual features and under-representation rate and momentum, but it can be sensitive to low learning
in datasets further reduce detection accuracy. The results rates, such as 0.0001, which may lead to overfitting and

VOLUME 00, 2024 11

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
 This article has been accepted for publication in IEEE Open Journal of Vehicular Technology. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/OJVT.2025.3547761

Kamronbek et al.: Preparation of Papers for IEEE OPEN JOURNALS

FIGURE 5. Comparative inference time evaluation of vehicular IDS across five IoT devices and one PC, with
previous study benchmarks.

FIGURE 6. IDS performance evaluation using K-Fold cross-validation, demonstrating accuracy results for GRU
and LSTM models with different optimizers (AdamW and Nadam) and a learning rate of 0.001 across various folds
of training and testing data.

slower convergence. In contrast, Nadam and AdamW, both than other optimizers, as they ensure faster updates, better
with a learning rate of 0.001, strike an optimal balance adaptation, and enhanced performance, even in environments
between speed and stability. As a reason, Nadam builds with limited computational power. When combined with a
on Adam by incorporating Nesterov momentum, which learning rate of 0.001, these optimizers consistently deliver
anticipates the gradient direction before updating, resulting superior results in terms of both performance and efficiency.
in faster and smoother convergence, particularly on low-
resource devices. AdamW, on the other hand, addresses
the problem of overfitting by incorporating weight decay, VII. CONCLUSION
improving generalization without sacrificing momentum. This paper presents an in-depth analysis of deploying IDS us-
These features make Nadam and AdamW more effective ing RNNs for IVNs. The study explores the effectiveness of
various RNN architectures, such as SimpleRNN, LSTM, and

12 VOLUME 00, 2024

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
 This article has been accepted for publication in IEEE Open Journal of Vehicular Technology. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/OJVT.2025.3547761

GRU, in detecting cyber-attacks like DoS, Fuzz, Replay, and [11] O. Y. Al-Jarrah, C. Maple, M. Dianati, D. Oxtoby, and A. Mouzakitis,
Malfunction on the CAN bus. The findings show that GRU “Intrusion detection systems for intra-vehicle networks: A review,”
Ieee Access, vol. 7, pp. 21 266–21 289, 2019.
models outperform others in terms of both accuracy and [12] K. Yusupov, M. R. Islam, I. Oh, M. Sahlabadi, and K. Yim, “Security
computational efficiency, making them particularly suitable assessment of in-vehicle network intrusion detection in real-life scenar-
for real-time detection in resource-constrained environments. ios,” in 12th International Conference of Security, Privacy and Trust
Management (SPTM 2024), ser. Computer Science & Information
By tuning hyperparameters such as the learning rate and Technology (CS & IT), D. C. Wyld and D. Nagamalai, Eds., vol. 14,
optimizer, the model achieved nearly 99% accuracy across no. 11, Sydney, Australia, June 22–23 2024.
all tested devices, demonstrating its adaptability to different [13] M. Hassan, M. E. Haque, M. E. Tozal, V. Raghavan, and R. Agrawal,
“Intrusion detection using payload embeddings,” IEEE Access, vol. 10,
hardware specifications. pp. 4015–4030, 2021.
One of the limitations of deploying IDS across different [14] L. Yang, A. Moubayed, and A. Shami, “Mth-ids: A multitiered hybrid
IVN-based systems is the variability in hardware specifi- intrusion detection system for internet of vehicles,” IEEE Internet of
Things Journal, vol. 9, no. 1, pp. 616–632, 2021.
cations. For instance, while high-performance devices like [15] E. M. Maseno, Z. Wang, and H. Xing, “A systematic review on hybrid
the Jetson AGX Xavier showed excellent results with low intrusion detection system,” Security and Communication Networks,
inference times, lower-cost devices like the Raspberry Pi 4 vol. 2022, no. 1, p. 9663052, 2022.
[16] J. Lee, W. Kim, J.-H. Cho, D. S. Kim, T. J. Moore, F. F. Nelson, and
required careful hyperparameter tuning to achieve similar H. Lim, “Deep learning approach for attack detection in controller
results. This variability poses challenges for standardizing area networks,” in Artificial Intelligence and Machine Learning for
IDS deployment across different IVNs. Consequently, future Multi-Domain Operations Applications III, vol. 11746. SPIE, 2021,
pp. 195–200.
work will focus on developing lightweight IDS solutions [17] O. Y. Al-Jarrah, K. El Haloui, M. Dianati, and C. Maple, “A novel de-
tailored to specific IVN architectures and exploring more tection approach of unknown cyber-attacks for intra-vehicle networks
sophisticated techniques such as federated learning and edge using recurrence plots and neural networks,” IEEE Open Journal of
Vehicular Technology, vol. 4, pp. 271–280, 2023.
computing to balance performance and resource limitations. [18] Y. Kamronbek, I. M. Rezanur, I. Oh, and K. Yim, “Time series mean
Additionally, the integration of emerging security measures normalization for enhanced feature extraction in in-vehicle network
for autonomous vehicles, such as encrypted communication intrusion detection system,” in International Conference on Broadband
and Wireless Computing, Communication and Applications. Springer,
protocols, can further enhance the robustness of IDS solu- 2023, pp. 302–311.
tions in automotive environments. [19] A. Gazdag, S. Lestyán, M. Remeli, G. Ács, T. Holczer, and G. Biczók,
“Privacy pitfalls of releasing in-vehicle network data,” Vehicular
Communications, vol. 39, p. 100565, 2023.
REFERENCES [20] B. Lampe and W. Meng, “Intrusion detection in the automotive
domain: A comprehensive review,” IEEE Communications Surveys &
[1] M. Bozdal, M. Samie, and I. Jennions, “A survey on can bus protocol: Tutorials, 2023.
Attacks, challenges, and potential solutions,” in 2018 International [21] V. Tanksale, “Intrusion detection system for controller area network,”
Conference on Computing, Electronics & Communications Engineer- Cybersecurity, vol. 7, no. 1, p. 4, 2024.
ing (iCCECE). IEEE, 2018, pp. 201–205. [22] M. R. Islam, M. Sahlabadi, K. Kim, Y. Kim, and K. Yim, “Cf-aids:
[2] H. M. Song and H. K. Kim, “Discovering can specification using on- Comprehensive frequency-agnostic intrusion detection system on in-
board diagnostics,” IEEE Design & Test, vol. 38, no. 3, pp. 93–103, vehicle network,” IEEE Access, 2023.
2020. [23] C. Specification, “Bosch,” Robert Bosch GmbH, Postfach, vol. 50,
[3] S. Nie, L. Liu, and Y. Du, “Free-fall: Hacking tesla from wireless to p. 15, 1991.
can bus,” Briefing, Black Hat USA, vol. 25, no. 1, p. 16, 2017. [24] T. C. Dönmez, “Anomaly detection in vehicular can bus using message
[4] E. Aliwa, O. Rana, C. Perera, and P. Burnap, “Cyberattacks and identifier sequences,” IEEE Access, vol. 9, pp. 136 243–136 252, 2021.
countermeasures for in-vehicle networks,” ACM computing surveys [25] M. Marchetti and D. Stabili, “Read: Reverse engineering of automo-
(CSUR), vol. 54, no. 1, pp. 1–37, 2021. tive data frames,” IEEE Transactions on Information Forensics and
[5] S.-F. Lokman, A. T. Othman, and M.-H. Abu-Bakar, “Intrusion Security, vol. 14, no. 4, pp. 1083–1097, 2018.
detection system for automotive controller area network (can) bus [26] Y. Xie, P. Huang, W. Liang, and Y. He, “Comparison between can
system: a review,” EURASIP Journal on Wireless Communications and and can fd: A quantified approach,” in 2017 IEEE International
Networking, vol. 2019, no. 1, pp. 1–17, 2019. Symposium on Parallel and Distributed Processing with Applications
and 2017 IEEE International Conference on Ubiquitous Computing
[6] M. Gmiden, M. H. Gmiden, and H. Trabelsi, “Cryptographic and
and Communications (ISPA/IUCC). IEEE, 2017, pp. 1399–1403.
intrusion detection system for automotive can bus: Survey and con-
[27] M. K. Ishak, C. C. Leong, and E. A. Sirajudin, “Embedded ethernet
tributions,” in 2019 16th International Multi-Conference on Systems,
and controller area network (can) in real time control communication
Signals & Devices (SSD). IEEE, 2019, pp. 158–163.
system,” in 10th International Conference on Robotics, Vision, Signal
[7] S. Jin, J.-G. Chung, and Y. Xu, “Signature-based intrusion detection Processing and Power Applications: Enabling Research and Innova-
system (ids) for in-vehicle can bus network,” in 2021 IEEE interna- tion Towards Sustainability. Springer, 2019, pp. 133–139.
tional symposium on circuits and systems (ISCAS). IEEE, 2021, pp. [28] T.-N. Hoang, M. R. Islam, K. Yim, and D. Kim, “Canperfl: Improve
1–5. in-vehicle intrusion detection performance by sharing knowledge,”
[8] M. H. Shahriar, Y. Xiao, P. Moriano, W. Lou, and Y. T. Hou, Applied Sciences, vol. 13, no. 11, p. 6369, 2023.
“Canshield: Deep-learning-based intrusion detection framework for [29] Y. An, J. Park, I. Oh, M. Kim, and K. Yim, “Design and implementa-
controller area networks at the signal level,” IEEE Internet of Things tion of a novel testbed for automotive security analysis,” in Innovative
Journal, vol. 10, no. 24, p. 22111–22127, Dec. 2023. [Online]. Mobile and Internet Services in Ubiquitous Computing: Proceedings of
Available: http://dx.doi.org/10.1109/JIOT.2023.3303271 the 14th International Conference on Innovative Mobile and Internet
[9] K. Agrawal, T. Alladi, A. Agrawal, V. Chamola, and A. Benslimane, Services in Ubiquitous Computing (IMIS-2020). Springer, 2021, pp.
“Novelads: A novel anomaly detection system for intra-vehicular 234–243.
networks,” IEEE Transactions on Intelligent Transportation Systems, [30] N. Lodge, N. Tambe, and F. Saqib, “Addressing vulnerabilities in can-
vol. 23, no. 11, pp. 22 596–22 606, 2022. fd: An exploration and security enhancement approach,” IoT, vol. 5,
[10] L. Zhang and D. Ma, “A hybrid approach toward efficient and accurate no. 2, pp. 290–310, 2024.
intrusion detection for in-vehicle networks,” IEEE Access, vol. 10, pp. [31] L. Kozachkov, M. Ennis, and J.-J. Slotine, “Rnns of rnns: Recursive
10 852–10 866, 2022. construction of stable assemblies of recurrent neural networks,” Ad-

VOLUME 00, 2024 13

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
 This article has been accepted for publication in IEEE Open Journal of Vehicular Technology. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/OJVT.2025.3547761

Kamronbek et al.: Preparation of Papers for IEEE OPEN JOURNALS

vances in neural information processing systems, vol. 35, pp. 30 512– Ibrokhim Muminov a member of IEEE Intelli-
30 527, 2022. gent Transportation Systems Society (ITSS), IEEE
[32] M. Kaur and A. Mohta, “A review of deep learning with recurrent Computer Society (CS), and an IEEE Student
neural network,” in 2019 International Conference on Smart Systems Member, is currently pursuing a Bachelor of Sci-
and Inventive Technology (ICSSIT). IEEE, 2019, pp. 460–465. ence degree in Computer Software Engineering
[33] F. Laghrissi, S. Douzi, K. Douzi, and B. Hssina, “Intrusion detection as a Korean Government Scholarship recipient
systems using long short-term memory (lstm),” Journal of Big Data, at Soonchunhyang University, South Korea. His
vol. 8, no. 1, p. 65, 2021. research interests encompass Big Data Analysis,
[34] A. Pudikov and A. Brovko, “Comparison of lstm and gru recurrent Artificial Intelligence, and Computer Vision, with
neural network architectures,” in International Scientific and Practical a focus on driver state recognition. He is passionate
Conference in Control Engineering and Decision Making. Springer, about developing innovative solutions to enhance
2020, pp. 114–124. driver and vehicle safety through advanced technologies.
[35] A. Tjandra, S. Sakti, R. Manurung, M. Adriani, and S. Nakamura,
“Gated recurrent neural tensor network,” in 2016 International Joint
Conference on Neural Networks (IJCNN). IEEE, 2016, pp. 448–455. Mahdi Sahlabadi an IEEE Senior Member, holds
[36] K. Zhu, Z. Chen, Y. Peng, and L. Zhang, “Mobile edge assisted a Ph.D. in Industrial Computing from the National
literal multi-dimensional anomaly detection of in-vehicle network University of Malaysia. His academic journey in-
using lstm,” IEEE Transactions on Vehicular Technology, vol. 68, cludes research positions at the Japan Advanced
no. 5, pp. 4275–4284, 2019. Institute of Science and Technology (JAIST), Sin-
[37] S. Tariq, S. Lee, H. K. Kim, and S. S. Woo, “Can-adf: The controller gapore Management University (SMU), Sharif
area network attack detection framework,” Computers & Security, University of Tehran (SUT), University Ke-
vol. 94, p. 101857, 2020. bangsaan Malaysia(UKM), and Soonchunhyang
[38] I. A. Khan, N. Moustafa, D. Pi, W. Haider, B. Li, and A. Jolfaei, “An University (SCH), South Korea. His areas of re-
enhanced multi-stage deep learning framework for detecting malicious search interest are process mining, software archi-
activities from autonomous vehicles,” IEEE Transactions on Intelligent tecture, cybersecurity, and quality assurance.
Transportation Systems, vol. 23, no. 12, pp. 25 469–25 478, 2021.
[39] V. K. Kukkala, S. V. Thiruloga, and S. Pasricha, “Indra: Intrusion
detection using recurrent autoencoders in automotive embedded sys- Kangbin Yim is a Professor in the Department
tems,” IEEE Transactions on Computer-Aided Design of Integrated of Information Security Engineering at Soonchun-
Circuits and Systems, vol. 39, no. 11, pp. 3698–3710, 2020. hyang University, where he has been since 2003.
[40] H. Ma, J. Cao, B. Mi, D. Huang, Y. Liu, and S. Li, “A gru-based He received his B.S., M.S., and Ph.D. degrees
lightweight system for can intrusion detection in real time,” Security in Electronics Engineering from Ajou University,
and Communication Networks, vol. 2022, no. 1, p. 5827056, 2022. South Korea, in 1992, 1994, and 2001, respec-
[41] F. Luo, J. Wang, X. Zhang, Y. Jiang, Z. Li, and C. Luo, “In-vehicle
tively. For over 20 years, his primary research has
network intrusion detection systems: a systematic survey of deep focused on vulnerability identification, threat anal-
learning-based approaches,” PeerJ Computer Science, vol. 9, p. e1648, ysis, and proof-of-concept (PoC) development for
2023.
both software and hardware. He is also passionate
[42] Y. Lu, M. Shen, H. Wang, X. Wang, C. van Rechem, and W. Wei, about designing and implementing hardware and
“Machine learning for synthetic data generation: a review,” arXiv software frameworks for system evaluations and commercial services. His
preprint arXiv:2302.04062, 2023. recent work has centered on HILS-based dynamic analysis for distributed
[43] OCSLAB, “Ocs: Open cyber security lab datasets,” embedded software, leading a research team of over 30 members in his
https://ocslab.hksecurity.net/.
lab, LISA. Currently, the lab’s top priorities include deep-learning-driven
analysis of heterogeneous field data with a particular focus on automotive
vehicles, industrial control systems, and mobile baseband.
Kamronbek Yusupov received his B.S. de-
gree in Information Security Engineering from
Soonchunhyang University, South Korea, in 2023.
He is currently pursuing his M.S. degree in Soft-
ware Convergence at Soonchunhyang University,
South Korea. His research interests include deep
learning, cybersecurity for in-vehicle networks
(IVN), anomaly detection, and big data analysis,
reflecting his commitment to utilizing advanced
technologies in these areas.

Md Rezanur Islam received B.Sc. in Electrical

and Electronic Engineering from the University of
Asia Pacific, Bangladesh, in 2016, and an M.Sc. in
Mobility Convergence from Soonchunhyang Uni-
versity, South Korea, in 2023. Currently pursuing a
Ph.D. in Software Convergence at Soonchunhyang,
his research focuses on deep learning, anomaly de-
tection, malware detection, computer vision, with
a specialization in driver state recognition.

14 VOLUME 00, 2024

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/