Intrusion Detection for Internet of Vehicles CAN Bus Communications Using Machine Learning: An Empirical Study on the CICIoV2024 Dataset
The rapid integration of connectivity and automation in modern vehicles has significantly expanded the attack surface of in-vehicle networks, particularly the Controller Area Network (CAN) bus, which lacks native security mechanisms. This study investigates machine learning-based intrusion detection for Internet of Vehicles (IoV) environments using the CICIoV2024 dataset. Unlike prior studies that rely on highly redundant traffic traces, this work applies strict de-duplication to eliminate repetitive CAN frames, resulting in a dataset of unique attack signatures. To ensure statistical robustness despite the reduced data size, Stratified K-Fold Cross-Validation was employed. Experimental results reveal that while traditional models like Random Forest (optimized with ANOVA feature selection) maintain stability (F1-Macro ≈ 0.64), Deep Learning models fail to generalize (F1-Macro < 0.55) when denied the massive redundancy they typically require. These findings challenge the “near-perfect” detection rates reported in the literature, suggesting that previous benchmarks may reflect data leakage rather than true anomaly detection capabilities. The study concludes that lightweight models offer superior resilience for resource-constrained vehicular environments when evaluated on realistic, non-redundant data.