CATwin-IDS: Context-Aware Intrusion Detection System for Both In-Vehicle and External-Vehicle Networks via Digital Twin

With the rapid development of the Internet of Vehicles (IoV), the tight coupling between In-Vehicle Networks (IVN) and External Vehicle Networks (EVN) has made vehicular systems vulnerable to sophisticated cross-network attack chains. Existing Intrusion Detection Systems (IDS), however, typically operate in isolation on either IVN or EVN, and lack effective context-aware mechanisms for capturing inter-domain dependencies. To overcome this limitation, we propose CATwin-IDS, a context-aware intrusion detection framework that integrates digital twin technology with a lightweight Distilled Bidirectional Encoder Representations from Transformers (DistilBERT) model. In our design, Conditional Mutual Information (CMI) and Borderline Synthetic Minority Over-sampling Technique (Borderline-SMOTE) are applied for feature optimization and data balancing, while Temporal Self-Attention (TSA) enhances the modeling of spatiotemporal dependencies across heterogeneous traffic. The digital twin provides real-time bidirectional synchronization and a simulation environment, enabling proactive adaptation to dynamic threats. Experimental results on benchmark datasets (Car-Hacking, CICIoV2024, CICIDS2018, CICIoT2023) demonstrate that CATwin-IDS achieves higher accuracy and real-time efficiency compared with state-of-the-art methods, providing a holistic solution for securing IoV against cross-network intrusions.