TL;DR
This paper presents a comprehensive and systematic review of deep learning techniques applied to cyber intrusion detection within IoV systems, conducted in accordance with the PRISMA framework across 83 selected studies published between 2020 and 2025.
The Controller Area Network (CAN) bus continues to serve as the core communication backbone of modern vehicles. However, its original design did not incorporate fundamental security mechanisms, leaving in-vehicle networks vulnerable to cyberattacks such as spoofing, replay, message injection, and denial-of-service. As a result, Intrusion Detection Systems (IDSs) have become an essential component of automotive cybersecurity, providing continuous monitoring of CAN traffic to identify malicious behavior. In recent years, researchers have increasingly turned to intelligent IDS solutions based on Machine Learning (ML), Deep Learning (DL), and hybrid learning approaches to enhance detection capability. Although many of these studies report impressive detection accuracy, their evaluation practices often vary significantly, and claims related to real-time performance or lightweight deployment are frequently made without sufficient practical validation. This survey provides a structured, deployment-focused review of learning-based IDSs for CAN bus security published between 2019 and 2025. Building on prior surveys that emphasize detection accuracy and high-level method categorization, this work evaluates IDS approaches from a practical perspective by considering detection performance alongside computational efficiency, real-time feasibility, and deployment readiness in resource-constrained automotive environments. ML-based, DL-based, and hybrid IDS approaches are organized within a unified taxonomy and systematically compared across model architectures, attack scenarios, datasets, real-time feasibility, lightweight design claims, and validation strategies. A key contribution of this survey is the introduction of explicit and consistent criteria for labeling IDSs as lightweight, real-time, or deployable, based only on substantiated evidence such as ECU-oriented runtime analysis, embedded evaluation, or real-vehicle experimentation. Through a set of unified comparative tables, the survey highlights common evaluation gaps, and mismatches between reported performance and practical feasibility.
In the era of contemporary data traffic routing, the concept of Intrusion Detection Systems (IDS) is substantially utilized. However, the efficacy of IDS is often decreased because of the reality that high-concentration traffic postfixes, sophisticated cyber criminals, and more and more stringent demands are tending to decrease in resource-limited environments. The paper presents the enhanced intrusion detection system based on deep learning architecture, which can be flexible, adaptive and as well maintain the high detection capability with confidence under changing or to-be changed network settings. The objectives of this and aforementioned also address the issue of avoiding strong overtting behavior by models during the transfer learning and even rich feature representation through the first-stage operation: moving to address and ideally preventing attacks rather than supporting other attacks. The work is tailored to the deployment of the light-weight and adaptive IDS design which is supposed to be large enough to work in real time on low-powered devices such as IoTs and edge devices that are nondominated in energy and computationally less demanding. Real-time adaptability of the model will be examined through operational deployment simulations. It is also expected that such simulations would take into account latency, throughput, and energy consumption of the IDS model. On the one hand, In a stage nested within the very last period of this research, the IDS model has been merged with Explainable AI technologies; now LIME and SHAP are also preserved to improve the interpretability of the model decisions and the level of decision-making. What kind of feature attributions are made with the intrusion data? How is Interpretability of the model evaluated in terms of fidelity, comprehensibility, and expert belief? Therefore, all the above-mentioned events will be a perfect example of how the technologically ingrained tasks, particularly in the technical discipline of security studies, can be wrapped into the very cognitive resource of human beings.
The fast-growing interconnectivity of networks and digital communication platforms, along with extensive information exchange, has made cybersecurity issues in modern computing environments more severe. The expansion of networking infrastructures always results in a massive flow of traffic, thus rendering traditional monitoring techniques and security tools ineffective. Modern cybersecurity systems often have problems detecting the changing nature of cyber threats since some of these have behaviors different from those associated with cyber attack signatures. This not only limits their effectiveness but also causes high rates of false alerts and late responses to complex threats like phishing, ransomware communications, distributed denial of service attacks, key logging activities, bot attacks, and packet sniffing. These all highlight the need for smart cybersecurity solutions that can analyze network activities effectively and detect any kind of threats. The designed model comprises two major layers, which are referred to as the data collection layer and the analysis layer. Network traffic details and system logs are collected using simulated or live data from either simulated or live environment and transformed into structured datasets to undergo the subsequent process steps. Preprocessing involves the removal of unnecessary data instances, cleansing of noise, and feature extraction to enable successful attack detection. This framework uses a combination of signature-based detection and anomaly detection methods to detect attacks through analysis of patterns that are consistent with an attack and patterns that are abnormal in terms of network behavior. This allows better detection of both current and new types of attacks. If a suspicious activity is observed in the network, then the design generates security alerts, stores the incident logs, and automatically responds by blocking the suspicious IP address.
The rapid expansion of interconnected networks, cloud computing, Internet of Things (IoT) devices, and digital communication technologies has significantly increased the complexity of modern cyber threats, making traditional network security mechanisms increasingly inadequate. Intrusion Detection Systems (IDS) are essential components of cybersecurity infrastructures, designed to monitor network activities and identify malicious behavior before it compromises system integrity. However, conventional signature-based and rule-based IDS are primarily effective against previously known attack patterns and often fail to detect zero-day attacks, advanced persistent threats (APTs), and other evolving cyber threats. To address these limitations, machine learning (ML) has emerged as a transformative technology that enables adaptive, intelligent, and data-driven intrusion detection by learning complex patterns from network traffic and system behavior. This review presents a comprehensive analysis of machine learning-based intrusion detection systems, covering a wide range of techniques including supervised learning, unsupervised learning, ensemble learning, and deep learning models. The paper examines widely used benchmark datasets, feature selection and feature engineering methods, data preprocessing techniques, and commonly adopted performance evaluation metrics for assessing intrusion detection effectiveness. It also reviews various IDS deployment architectures, including centralized, distributed, edge-based, cloud-enabled, and hybrid frameworks, highlighting their strengths and limitations in different networking environments. To provide a clear understanding of intelligent intrusion detection mechanisms, the review introduces two conceptual frameworks: a machine learning-based intrusion detection pipeline that illustrates the end-to-end process from data acquisition to threat classification, and a layered network security architecture demonstrating the integration of ML techniques into modern cybersecurity infrastructures. Furthermore, the paper discusses critical challenges affecting the deployment of ML-based IDS, including data imbalance, scalability, computational complexity, model interpretability, adversarial machine learning attacks, privacy preservation, and real-time processing constraints.
Topicality. Today’s information and communication systems (ICS) face a growing number of complex cyber threats, making active defense mechanisms absolutely necessary. Yet, running these security tools constantly, especially Intrusion Detection and Prevention Systems (IDS/IPS), takes a toll on network bandwidth and creates heavy computational loads at the routing level. The subject of the study is the direct impact of IDS/IPS on the performance characteristics of an isolated network segment under various load conditions, with an emphasis on resource depletion due to fragmentation at layer 3 of the OSI model. The purpose of this work is to measure the real-world trade-off between security and performance. We aim to assess how much computational power is lost and precisely measure the latency caused by deep packet inspection and interrupt handling. The following results were obtained. We built a complete field-testing environment using isolated virtual machines. We carefully tracked packet processing latency and CPU usage across three states: a baseline with no security, standard traffic with IDS logging enabled, and a simulated high-volume fragmented DDoS attack. The data showed that a basic unprotected router uses very few resources (about 3% CPU, 2.2 ms latency). Turning on security rules bumped the latency to 4.3 ms. More importantly, when hit with a fragmented flood attack, the router’s CPU load spiked to 48%. This spike was mostly caused by the kernel handling software interrupts (ksoftirqd), which eventually caused legitimate packets to drop. Conclusion. Securing a network strongly increases the computational strain on the router. We observed significant performance drops, including CPU exhaustion and denial of service for regular users during volumetric fragmentation attacks. This shows that organizations must constantly refine their firewall policies and look into kernel-bypass technologies to keep their ICS networks running smoothly.
Per-ID behavioral residualization is presented, a CAN-specific representation that extracts fourteen temporal, protocol, and payload features from sliding windows and residualizes them against each arbitration ID's normal baseline, which improves mean F1 in the majority of evaluations.