Hybrid CNN-LSTM Model with Random Forest Classifier for Intrusion Detection in Connected Vehicles

Year 2025, Volume: 9 Issue: 4, 675 - 685, 31.12.2025

Mohammed Al-hubaishi , Mohammed Abdulraqeb

https://doi.org/10.30939/ijastech..1719423

Abstract

This paper proposes a hybrid deep learning method with a Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) network coupled with a Random Forest classifier for intrusion detection in connected vehicles. The model was trained and evaluated on the DECIMAL dataset, a realistic in-vehicle network intrusion data set with Controller Area Network (CAN) bus traffic. The CNN-LSTM model is trained on spatial-temporal features from CAN messages, while the Random Forest classifier exploits these features for accurate cyberattack classification. Experimental results demonstrate the superior performance of the model with an average detection accuracy of 99.62% and good precision and recall of various attack types. The hybrid approach outperforms traditional standalone approaches by addressing primary challenges of automotive cybersecurity, such as identification of sophisticated temporal patterns and reduction of false alarms. This research stresses the need for state-of-the-art machine learning techniques in the security of networked vehicles, particularly the Internet of Vehicles (IoV) environment. The findings emphasize the requirement for hybridization of deep learning with ensemble methods in order to boost real-time threat detection and system robustness. Future work will focus on optimizing the model for embedded automotive hardware and exploring its generalizability across diverse datasets. This study contributes to the development of secure intelligent transportation systems through the provision of a robust framework for identification and the containment of cyber-attacks on networked vehicles.

Keywords

Automotive Cybersecurity , Connected Vehicles , Deep Learning , Hybrid CNN-LSTM , Intrusion Detection System , Random Forest

Supporting Institution

Department of Computer, Faculty of Engineering,Halic University,34060,Istanbul, Turkey

References

• [1] Nagarajan J, Mansourian P, Shahid MA, Jaekel A, Saini I, Zhang N, et al. Machine Learning based intrusion detection systems for connected autonomous vehicles: A survey. Peer-to-Peer Networking and Applications. 2023;16(5):2153-85. https://doi.org/10.1007/s12083-023-01508-7.
• [2] Bindu GH, Dasari DR. Federated Learning Framework for Intrusion Detection System in Internet of Vehicles with Memory-Augmented Deep Autoencoder.Research Square. 2024. https://doi.org/10.21203/rs.3.rs-5007599/v1.
• [3] Colhak F, Coskun H, Cyrille TNR, Hoxa T, Ecevit M˙I, Aydın MN. Accelerating IoV Intrusion Detection: Benchmarking GPU-Accelerated vs CPU-Based ML Libraries. arXiv preprint. 2025. https://doi.org/10.48550/arXiv.2504.01905.
• [4] Jayasri C, Balaji V, Nalayini C, Pradeep S.Detecting cyber attacks in vehicle networks using improved LSTM based optimization methodology. Scientific Reports. 2025;15(1):1-19. https://doi.org/10.1038/s41598-025-04643-8.
• [5] Kumar A, Das TK. CAVIDS: Real time intrusion detection system for connected autonomous vehicles using logical analysis of data.Vehicular Communications. 2023;43:100652. https://doi.org/10.1016/j.vehcom.2023.100652.
• [6] Aloqaily M, Otoum S, Ridhawi IA, Jararweh Y. An intrusion detection system for connected vehicles in smart cities. Ad Hoc Networks.2019;90:101842. https://doi.org/10.1016/j.adhoc.2019.02.001.
• [7] Alferaidi A, Yadav K, Alharbi Y, Razmjooy N, Viriyasitavat W, Gulati K, et al. Distributed Deep CNN-LSTM Model for Intrusion Detection Method in IoT-Based Vehicles. Mathematical Problems in Engineering. 2022;2022:3424819. https://doi.org/10.1155/2022/3424819.
• [8] Banaamah AM, Ahmad I.Intrusion detection in IoT using deep learning. Sensors. 2022;22(21):8417. https://doi.org/10.3390/s22218417.
• [9] Zhang Y, Muniyandi RC, Qamar F.A Review of Deep Learning Applications in Intrusion Detection Systems: Overcoming Challenges in Spatiotemporal Feature Extraction and Data Imbalance. Applied Sciences. 2025;15(3):1552. https://doi.org/10.3390/app15031552.
• [10] Palma ´A, Antunes M, Bernardino J, Alves A. MultiClass Intrusion Detection in Internet of Vehicles: Optimizing Machine Learning Models on Imbalanced Data. Future Internet. 2025;17(4):162.https://doi.org/10.3390/fi17040162.
• [11] Tanksale V. Intrusion detection system for controller area network. Cybersecurity. 2024;7(1):4. https://doi.org/10.1186/s42400-023-00195-4.
• [12] Neto ECP, Taslimasa H, Dadkhah S, Iqbal S, Xiong P, Rahman T, et al.CICIoV2024:Advancingrealistic IDS approaches against DoS and spoofing attack in IoV CAN bus.Internet of Things.2024;26:101209. https://doi.org/10.1016/j.iot.2024.101209.
• [13] Lampe B, Meng W. A survey of deep learning-based intrusion detection in automotive applications.Expert Systems with Applications. 2023;221:119771. https://doi.org/10.1016/j.eswa.2023.119771.
• [14] Rai R, Grover J, Sharma P, Pareek A.Securing the CAN bus using deep learning for intrusiondetection in vehicles. Scientific Reports. 2025;15(1):13820. https://doi.org/10.1038/s41598-025-98433-x.
• [15] Suwwan R, Alkafri S, Elsadek L, Afifi K, Zualkernan I, Aloul F. Intrusion Detection for CAN Using Deep Learning Techniques.In: Proceedings of the International Conference on Applied CyberSecurity, ACS 2021. vol. 378 of Lecture Notes in Networks and Systems. Springer; 2022. p. 13-9. https://doi.org/10.1007/978-3-030-95918-0_2.
• [16] Song J, Qin G, Liang Y, Yan J, Sun M.DGIDS:Dynamic graph-based intrusion detection system for CAN. Computers Security. 2024;147:104076. https://doi.org/10.1016/j.cose.2024.104076.
• [17] Cao B, Li C, Song Y, Qin Y, Chen C. Network intrusion detection model based on CNN and GRU. Applied Sciences. 2022;12(9):4184. https://doi.org/10.3390/app12094184.
• [18] Sajid M, Malik KR, Almogren A, Malik TS, Khan AH, Tanveer J, et al. Enhancing intrusion detection: a hybrid machine and deep learning approach. Journal of Cloud Computing. 2024;13(1):123. https://doi.org/10.1186/s13677-024-00685-x.
• [19] Aldhyani TH, Alkahtani H. Attacks to automatous vehicles: A deep learning algorithm for cybersecurity. Sensors. 2022;22(1):360. https://doi.org/10.3390/s22010360.
• [20] Aliyu I, Van Engelenburg S, Mu’Azu MB, Kim J, Lim CG. Statistical detection of adversarial examples in blockchain-based federated forest in-vehicle network intrusion detection systems. IEEE Access. 2022;10:109366-84. https://doi.org/10.1109/ACCESS.2022.3212412.
• [21] Joloudari JH, Haderbadi M, Mashmool A, Ghasemigol M, Band SS, Mosavi A.Early Detection of the Advanced Persistent Threat Attack Using Performance Analysis of Deep Learning. IEEE Access. 2020;8:186125-37. https://doi.org/10.1109/ACCESS.2020.3029202.
• [22] Han X, Li C, Li X, Lu T.Research on APT Attack Detection Technology Based on DenseNet Convolutional Neural Network. In:2021 International Conference on Computer Information Science and Artificial Intelligence (CISAI). IEEE; 2021. p. 440-8. https://doi.org/10.1109/CISAI54367.2021.00091.
• [23] LeCun Y, Bottou L, Bengio Y, Haffner P. Gradientbased learning applied to document recognition. Proceedings of the IEEE. 2002;86(11):2278-324.https://doi.org/10.1109/5.726791.
• [24] Hochreiter S, Schmidhuber J.Long short-term memory. Neural Computation. 1997; 9(8):1735-80. https://doi.org/10.1162/neco.1997.9.8.1735.
• [25] Breiman L. Random forests. Machine Learning. 2001;45:5-32. https://doi.org/10.1023/A:1010933404324.
• [26] P. Kattarde, "CICI OV 2024 Decimal CSV," Kaggle, 2024. [Online].Available: https://www.kaggle.com/datasets/pushpakattarde/ciciov2024decimalcsv. [Accessed: Dec. 30, 2025].
• [27] Hossain MD, Inoue H, Ochiai H, Fall D, Kadobayashi Y.LSTM-based intrusion detection system for in-vehicle CAN bus communications. IEEE Access. 2020;8:185489-502. https://doi.org/10.1109/ACCESS.2020.3029307.
• [28] Gueriani A, Kheddar H, Mazari AC. Enhancing IoT security with CNN and LSTM-based intrusion detection systems. In: 6th International Conference on Pattern Analysis and Intelligent Systems (PAIS). IEEE; 2024. p. 1-7. https://doi.org/10.1109/PAIS62114.2024.10541178.