TL;DR
This paper presents a comprehensive and systematic review of deep learning techniques applied to cyber intrusion detection within IoV systems, conducted in accordance with the PRISMA framework across 83 selected studies published between 2020 and 2025.
A key contribution of this survey is the introduction of explicit and consistent criteria for labeling IDSs as lightweight, real-time, or deployable, based only on substantiated evidence such as ECU-oriented runtime analysis, embedded evaluation, or real-vehicle experimentation.
In the era of contemporary data traffic routing, the concept of Intrusion Detection Systems (IDS) is substantially utilized. However, the efficacy of IDS is often decreased because of the reality that high-concentration traffic postfixes, sophisticated cyber criminals, and more and more stringent demands are tending to decrease in resource-limited environments. The paper presents the enhanced intrusion detection system based on deep learning architecture, which can be flexible, adaptive and as well maintain the high detection capability with confidence under changing or to-be changed network settings. The objectives of this and aforementioned also address the issue of avoiding strong overtting behavior by models during the transfer learning and even rich feature representation through the first-stage operation: moving to address and ideally preventing attacks rather than supporting other attacks. The work is tailored to the deployment of the light-weight and adaptive IDS design which is supposed to be large enough to work in real time on low-powered devices such as IoTs and edge devices that are nondominated in energy and computationally less demanding. Real-time adaptability of the model will be examined through operational deployment simulations. It is also expected that such simulations would take into account latency, throughput, and energy consumption of the IDS model. On the one hand, In a stage nested within the very last period of this research, the IDS model has been merged with Explainable AI technologies; now LIME and SHAP are also preserved to improve the interpretability of the model decisions and the level of decision-making. What kind of feature attributions are made with the intrusion data? How is Interpretability of the model evaluated in terms of fidelity, comprehensibility, and expert belief? Therefore, all the above-mentioned events will be a perfect example of how the technologically ingrained tasks, particularly in the technical discipline of security studies, can be wrapped into the very cognitive resource of human beings.
The fast-growing interconnectivity of networks and digital communication platforms, along with extensive information exchange, has made cybersecurity issues in modern computing environments more severe. The expansion of networking infrastructures always results in a massive flow of traffic, thus rendering traditional monitoring techniques and security tools ineffective. Modern cybersecurity systems often have problems detecting the changing nature of cyber threats since some of these have behaviors different from those associated with cyber attack signatures. This not only limits their effectiveness but also causes high rates of false alerts and late responses to complex threats like phishing, ransomware communications, distributed denial of service attacks, key logging activities, bot attacks, and packet sniffing. These all highlight the need for smart cybersecurity solutions that can analyze network activities effectively and detect any kind of threats. The designed model comprises two major layers, which are referred to as the data collection layer and the analysis layer. Network traffic details and system logs are collected using simulated or live data from either simulated or live environment and transformed into structured datasets to undergo the subsequent process steps. Preprocessing involves the removal of unnecessary data instances, cleansing of noise, and feature extraction to enable successful attack detection. This framework uses a combination of signature-based detection and anomaly detection methods to detect attacks through analysis of patterns that are consistent with an attack and patterns that are abnormal in terms of network behavior. This allows better detection of both current and new types of attacks. If a suspicious activity is observed in the network, then the design generates security alerts, stores the incident logs, and automatically responds by blocking the suspicious IP address.
This review presents a comprehensive analysis of machine learning-based intrusion detection systems, covering a wide range of techniques including supervised learning, unsupervised learning, ensemble learning, and deep learning models, and discusses critical challenges affecting the deployment of ML-based IDS.
Topicality. Today’s information and communication systems (ICS) face a growing number of complex cyber threats, making active defense mechanisms absolutely necessary. Yet, running these security tools constantly, especially Intrusion Detection and Prevention Systems (IDS/IPS), takes a toll on network bandwidth and creates heavy computational loads at the routing level. The subject of the study is the direct impact of IDS/IPS on the performance characteristics of an isolated network segment under various load conditions, with an emphasis on resource depletion due to fragmentation at layer 3 of the OSI model. The purpose of this work is to measure the real-world trade-off between security and performance. We aim to assess how much computational power is lost and precisely measure the latency caused by deep packet inspection and interrupt handling. The following results were obtained. We built a complete field-testing environment using isolated virtual machines. We carefully tracked packet processing latency and CPU usage across three states: a baseline with no security, standard traffic with IDS logging enabled, and a simulated high-volume fragmented DDoS attack. The data showed that a basic unprotected router uses very few resources (about 3% CPU, 2.2 ms latency). Turning on security rules bumped the latency to 4.3 ms. More importantly, when hit with a fragmented flood attack, the router’s CPU load spiked to 48%. This spike was mostly caused by the kernel handling software interrupts (ksoftirqd), which eventually caused legitimate packets to drop. Conclusion. Securing a network strongly increases the computational strain on the router. We observed significant performance drops, including CPU exhaustion and denial of service for regular users during volumetric fragmentation attacks. This shows that organizations must constantly refine their firewall policies and look into kernel-bypass technologies to keep their ICS networks running smoothly.
Per-ID behavioral residualization is presented, a CAN-specific representation that extracts fourteen temporal, protocol, and payload features from sliding windows and residualizes them against each arbitration ID's normal baseline, which improves mean F1 in the majority of evaluations.