ECF-IDS: An Enhanced Cuckoo Filter-Based Intrusion Detection System for In-Vehicle Network

With the rapid advancement of vehicle connectivity and intelligent technologies, an increasing number of vehicles are now connected to the Internet. However, these connected vehicles are vulnerable to malicious attacks, posing serious security events. In particular, the in-vehicle controller area network (CAN) bus has witnessed a rise in incidents involving various network attacks, such as denial of service (DoS), fuzzy attacks, and gear attacks. In response, this paper proposes an enhanced cuckoo filter-based intrusion detection system (ECF-IDS) for in-vehicle network. The ECF-IDS builds on an enhanced version of the cuckoo filter. It first utilizes the cuckoo filter to establish two lists (a normal list and an intrusion list) based on the labeled dataset using Car Hacking Dataset (CHD) and can-train-and-test dataset. Then, the input CAN traffic is sequentially compared with these two lists, where the conflicting traffic is further identified using a BERT-based model. The ECF-IDS is experimentally validated using the CHD and can-train-and-test dataset, demonstrating higher detection efficiency, lower resource consumption, and detection success exceeding 99% compared to other algorithms presented in previous studies. Furthermore, we conducted real in-vehicle environment testing on the ECF-IDS model, and its detection performance proved to be excellent.