MOO-IDS: multi-objective optimization-based lightweight intrusion detection system for in-vehicle networks

Abstract

With the proliferation of intelligent connected vehicles, the Controller Area Network (CAN) bus, as the backbone of in-vehicle communication, is vulnerable to cyberattacks due to lack of authentication and encryption. Existing Intrusion Detection Systems (IDS) exhibit limitations in addressing data imbalance, complex attack recognition, and resource-constrained deployment. This paper proposes a lightweight intrusion detection system based on multi-objective optimization, termed MOO-IDS. The system integrates a Hybrid Deep Restricted Boltzmann Machine Generator (HyDRBM-Gen) to mitigate attack sample scarcity and class imbalance in vehicular network data. To address targeted ID fabrication and masquerade attacks, two novel features, ID Frequency (IDF) and ID-Data Correlation (IDC), are introduced. An Adaptive-Enhanced Non-Dominated Sorting Dung Beetle Optimizer (AE-NSDBO) optimizes XGBoost hyperparameters to achieve an optimal balance among F1-score, model size, and inference latency, enabling the optimized XGBoost to accomplish intrusion detection. Experimental results on the real-world dataset Real ORNL Automotive Dynamometer (ROAD) demonstrate that MOO-IDS achieves outstanding performance, with a weighted-average F1-score of 0.9907, a model size of only 0.199 MB, and substantially reduced inference latency. The model also performs excellently on the Car Hacking and Survival Analysis datasets. This study provides a high-precision, lightweight, and strongly generalizable multi-class intrusion detection model for resource-constrained vehicular environments.

Supplementary Information

The online version contains supplementary material available at https://doi.org/10.1038/s41598-026-68795-x.

Introduction

With the rapid evolution of intelligent connected vehicles and autonomous driving technologies, modern vehicles have developed into highly integrated and complex Cyber-Physical Systems (CPS) comprising numerous Electronic Control Units (ECUs) and millions of lines of software code¹. The Controller Area Network (CAN) bus, leveraging its advantages such as low cost and high reliability, has become the dominant in-vehicle communication protocol, covering safety-critical subsystems such as powertrain and chassis control². However, the CAN bus lacks authentication and encryption by design. Its broadcast-based architecture, where messages carry no explicit receiver address and sender identification is limited to the CAN ID, prevents receiving nodes from verifying message legitimacy³.

To address the inherent security vulnerabilities of the CAN bus, intrusion detection systems (IDS) have become the mainstream approach for in-vehicle cybersecurity, as they require no modifications to existing bus protocols, offer flexible deployment, and suit resource-constrained environments⁴. Recently, data-driven IDS have gradually replaced rule-based methods, offering better adaptability through autonomous learning⁵. However, in-vehicle environments impose stringent constraints on model lightweightness and real-time performance. Existing data-driven solutions still face notable limitations⁶: on real-world datasets like ROAD, detection accuracy remains insufficient when confronting complex and highly concealed attacks; meanwhile, some deep learning models, despite powerful feature extraction, suffer from large parameter sizes and high inference latency, hindering deployment on resource-constrained ECUs. Indeed, the trade-off between detection accuracy and resource overhead is not unique to vehicular networks. In resource-constrained dynamic network scenarios such as UAV communications⁷ and aerial-ground integrated ad hoc networks⁸, researchers commonly face the challenge of multi-objective joint optimization, where effectively balancing accuracy loss against efficiency gains remains the core issue⁹. To this end, this paper introduces the concept of multi-objective optimization into the field of vehicular intrusion detection, seeking a superior balance between detection performance and deployment feasibility.

To address the limitations of existing in-vehicle IDS, traditional machine learning models offer advantages in simplicity, low computational overhead, and interpretability, making them more suitable for resource-constrained embedded platforms. Therefore, this paper proposes a lightweight multi-objective optimization IDS based on machine learning, termed MOO-IDS. By synthesizing samples to balance data distribution and enhancing features to strengthen attack representation, this solution synergistically improves detection performance and deployment feasibility. The main contributions are as follows:

1. A Hybrid Deep Restricted Boltzmann Machine Generator (HyDRBM-Gen) is proposed to generate highly realistic synthetic attack samples, addressing the scarcity of attack samples and class imbalance in real-world scenarios, thereby providing balanced data support for multi-class training.

2. A temporal-content dual-dimensional feature set is designed to collaboratively capture the stealthy patterns of complex attacks, enhancing their distinguishability from normal traffic and overcoming the representational limitations of single features.

3. A multi-objective optimization algorithm, Adaptive-Enhanced Non-Dominated Sorting Dung Beetle Optimizer (AE-NSDBO), is proposed to synergistically optimize detection accuracy, model size, and inference latency, constructing a lightweight detection model that meets the resource constraints of in-vehicle ECUs.

4. Based on the rarely studied real-world automotive scenario ROAD dataset, accurate multi-class classification of attacks is achieved, with core detection performance surpassing existing models and demonstrating reliable generalization capability, providing support for engineering applications.

The remainder of this paper is organized as follows: “Background and related work” section introduces the background and related work; “Methodology” section presents the proposed MOO-IDS; “Experiment and result evaluation” section describes the experimental setup and performance evaluation; “Conclusion and future work” section concludes the paper and discusses potential future work.

Background and related work

This section introduces the working principles and security vulnerabilities of the CAN protocol, analyzes typical attack types targeting this bus, and reviews existing research on intrusion detection systems.

Fundamentals of the CAN protocol

Developed by Bosch in the 1980s¹⁰, the CAN protocol employs a message-based broadcast communication mechanism where all ECUs are connected in parallel to a shared bus, forming a multi-master network structure. Messages are identified by a unique CAN ID, which defines message content and determines bus arbitration priority, with lower values indicating higher priority.

The structure of a standard CAN data frame is shown in Fig. 1 It consists of a Start of Frame (SOF) bit, an arbitration field, a control field, a CRC field, an ACK field, and an End of Frame (EOF) field. The identifier (ID) in the arbitration field occupies 11 bits in the standard format and extendable to 29 bits in the extended format. The data field carries a payload of 0 to 8 bytes.

Fig. 1.

The general architecture of a CAN frame.

Typical attack types targeting the CAN bus

Due to the inherent security flaws of the CAN bus protocol, attackers with access to the bus can launch various attacks. The five most common attack types are as follows:

• Denial-of-Service (DoS) Attack: The attacker continuously transmits high-priority messages (e.g., 0 × 000) to dominate the bus¹¹, disrupting vehicle functions.

• Fuzzy Attack: Exploiting the lack of authentication on the CAN bus¹², the attacker injects messages with random IDs and payloads at high frequency, causing unpredictable system faults.

• Targeted ID Fabrication Attack: After reverse-engineering the message ID and signal encoding for a specific function, the attacker injects forged messages to precisely manipulate that function¹³.

• Replay Attack: The attacker records legitimate CAN message sequences and re-injects them onto the bus, deceiving vehicle functions with false status information.

• Masquerade Attack: The attacker suppresses the legitimate node for the target ID, then injects tampered messages with normal timing⁶, achieving highly stealthy deception.

Related work

IDS have emerged as a critical defense line in automotive cybersecurity research, evolving from reliance on prior knowledge to data-driven modeling. Early rule-based and statistical feature detection methods primarily identify anomalies through predefined rules or thresholds. In terms of physical feature utilization, intrinsic ECU characteristics such as voltage fingerprinting¹⁴ and clock skew¹⁵ are employed to detect masquerade and bus-off attacks. For statistical feature analysis, information entropy¹⁶, Hamming distance¹⁷, and anomaly scores derived from dynamic data entropy with multi-dimensional fusion¹⁸ are applied to detect various injection and fuzzy attack with relatively low computational complexity. However, these methods heavily depend on manual feature selection and parameter calibration, exhibiting poor generalization and insufficient adaptability to sophisticated stealthy attacks.

Traditional machine learning, integrating feature engineering with classical classification algorithms, has become a significant research direction in this domain. Aksu et al.¹⁹ employed a modified genetic algorithm (MGA) to optimize feature subsets, combined with decision trees to alleviate the bottleneck of redundant features. Park et al.²⁰ designed a multi-label hierarchical classification (MLHC) model, integrating decision trees and random forests to achieve multi-class classification detection. Ileri et al.²¹ proposed the MetaCAN framework, employing hybrid metaheuristic algorithms to optimize XGBoost hyperparameters. However, Aloraini et al.²² pointed out that traditional machine learning methods suffer from unstable classification performance under adversarial attacks and depend heavily on manual feature engineering, failing to fully capture complex temporal dependencies, which provides guidance for follow-up research.

With the advancement of deep learning, time-series modeling methods have become mainstream owing to their ability to automatically learn temporal patterns from raw message sequences. Hossain et al.²³ utilized LSTM to learn temporal features of CAN messages, achieving high-precision detection. Tariq et al.²⁴ used a rule-integrated RNN for temporal modeling. Lo et al.²⁵ proposed HyDL-IDS, combining CNN-based spatial feature extraction with LSTM-based temporal modeling. Desta et al.²⁶ introduced Rec-CNN, which transforms CAN ID sequences into images using recurrence plots and captures temporal dependencies through convolutional neural networks. However, the aforementioned methods still have drawbacks: they rely on large volumes of high-quality labeled data for training, incur substantial computational overhead, and are hard to deploy in resource-constrained in-vehicle environments.

To fully exploit communication correlation features among ECUs on the CAN bus, graph-based intrusion detection methods map CAN IDs to nodes and construct communication relationships as edges to mine spatial correlation features. Islam et al.²⁷ proposed the GGNB model, integrating PageRank and Gaussian Naive Bayes to achieve lightweight classification. Park et al.²⁸ utilized graph structural features, combining threshold classifiers and random forests to detect and classify attacks. Ye et al.²⁹ introduced GDT-IDS, incorporating graph-theoretic features and employing decision trees for attack detection. Al-Absi et al.³⁰ first fused graph convolutional networks with the Transformer architecture, subsequently proposing the use of dynamic spatial-temporal graph transformers to adaptively learn evolutionary patterns³¹. Even so, graph-based methods still have limitations: they rely on prior knowledge for graph construction, adapt poorly to dynamic topologies, and entail high computational complexity.

Meanwhile, Transformer-based methods have been widely adopted due to their capability to capture long-range dependencies. Wei et al.³² proposed the AMAEID model, combining attention mechanisms with denoising autoencoders to enhance feature extraction efficiency. Nguyen et al.³³ designed a dual-mode attention network, integrating transfer learning to adapt to multiple vehicle models. Zhang et al.³⁴ constructed a two-stage Transformer within a federated framework to tackle data imbalance. Wang et al.³⁵ introduced Swin Transformer combined with wavelet transform to improve detection efficiency. However, Transformers involve large parameter sizes and depend on large-scale training data, posing challenges for deployment in resource-constrained environments.

This section has systematically reviewed the mainstream technical trajectory in the field of in-vehicle network intrusion detection. Despite notable progress, existing methods still face challenges in recognizing sophisticated attacks and achieving lightweight deployment. This paper proposes a multi-class intrusion detection framework that is lightweight, high-precision, and strongly generalizable.

Methodology

Overall system architecture

This study proposes a three-stage intelligent detection system, termed MOO-IDS, designed for CAN bus intrusion detection. The overall architecture is illustrated in Fig. 2.

Fig. 2.

Overall architecture of our proposed MOO-IDS.

The framework consists of three modules: data generation, feature engineering, and multi-objective optimization mechanism. The data generation module synthesizes high-quality attack samples using the proposed HyDRBM-Gen, mitigating the weak generalization ability of models caused by insufficient attack data. The feature engineering module enables collaborative detection of sophisticated attacks by constructing dual-dimensional features based on temporal behavior and data content. The multi-objective optimization mechanism jointly optimizes detection accuracy, model complexity, and inference efficiency, ensuring that the model maintains high classification performance while meeting the stringent requirements of in-vehicle devices for real-time operation and low resource consumption.

Data preprocessing and dual-dimensional feature engineering

To ensure data quality and construct effective discriminative features, this study first performs data cleaning on raw CAN logs, including handling missing values (removing unparsable message lines) and unifying data length (padding data fields shorter than 8 bytes to 8 bytes with 0 × 00 from the right end). After cleaning, the timestamp  t, arbitration identifier ID, data length code DLC, and data payload Data of each message are parsed and extracted as basic fields.

Given the high complexity and stealth of masquerade attacks and targeted ID fabrication attacks on the in-vehicle CAN bus, traditional single-dimensional features fail to provide sufficient discriminative information. To effectively distinguish between these two attack types, this paper introduces two critical features based on their attack mechanisms: ID Frequency (IDF) and ID-Data Correlation (IDC). The calculation methods for these features are as follows:

• IDF: To capture short-term ID frequency anomalies caused by malicious message injection, for the  i-thmessage, count the occurrences of its within a sliding window of length ending at its timestamp :

  1
• IDC: To quantify the degree of data tampering, a statistical baseline (mean , standard deviation )is pre-established for each data byte position  k of each ID from clean normal traffic, with the normal range defined as . For the message under test, the maximum standardized deviation of its data byte values beyond the normal range is calculated as:

  2

The sliding window is set to 100 ms, a duration that not only spans multiple complete cycles of high-frequency CAN signals (with periods of approximately 10–50 ms) to ensure representative statistical features, but also ensures rapid response to burst injection attacks. The threshold is grounded in the statistical principle that approximately 95% of normal values in a Gaussian distribution fall within , achieving a balance between detection sensitivity and false positive rate: an excessively small threshold would misclassify normal fluctuations as attacks, causing excessive false positives, whereas an excessively large threshold risks missing certain data tampering attacks. Given that in-vehicle CAN sensor data may exhibit multimodal or skewed distributions, this paper independently computes the statistical parameters of each data field for every CAN ID, preventing cross-ID distribution mixing from distorting the thresholds. Meanwhile, the IDC serves merely as one of multiple input features to XGBoost, with the final decision made through comprehensive evaluation by the ensemble model rather than by direct threshold-based classification into normal and abnormal. This design reduces the sensitivity of the final detection results to threshold settings.

Subsequently, the original timestamp is converted into the inter-message time difference , and each feature value is transformed into a binary vector for subsequent processing by the RBM generator. Meanwhile, numerical features are standardized before being fed into the model. Eventually, each message is represented as a unified feature vector:

Attack data augmentation based on hybrid deep RBM

To address the constraints imposed by scarce attack samples and class imbalance in the in-vehicle CAN network on IDS performance, this study proposes a Hybrid Deep Restricted Boltzmann Machine Generator (HyDRBM-Gen). This model aims to adaptively select the optimal generation strategy according to the scale of raw attack data, synthesize high-quality and diverse attack samples, and provide balanced and sufficient training data for the IDS model.

The Restricted Boltzmann Machine (RBM) is an energy-based generative stochastic neural network proposed by Smolensky in 1986³⁶. As an unsupervised learning model, it captures core data patterns to generate low-dimensional, highly discriminative features³⁷. Compared with Generative Adversarial Networks (GANs), RBM avoids mode collapse and is well-suited for learning discrete binary data, aligning with CAN frame characteristics^38,39.

The RBM employs a two-layer undirected probabilistic graph comprising a visible layer and a hidden layer, with no intra-layer connections and only full inter-layer connections, effectively reducing computational complexity⁴⁰. This model characterizes the joint probability distribution of visible and hidden state vectors via an energy function , reflecting the intrinsic statistical regularities of data⁴¹:

3

where and denote the bias vectors of the visible and hidden layers, respectively, and represents the inter-layer weight matrix.

However, the standard RBM exhibits limited representational capacity, struggling to effectively capture multi-level, nonlinear feature structures in complex attack patterns. Therefore, this study proposes HyDRBM-Gen, a deep RBM-based attack data generator.

At the core of HyDRBM-Gen is a deep network of multiple stacked RBM (structure shown in Fig. 3, with three stacked RBMs as an example), where the hidden layer units of the preceding RBM share the same set of units with the visible layer units of the subsequent RBM, forming a chain structure for feature abstraction layer by layer. During training, the model learns multi level feature representations of data from low level bit patterns to high level semantic patterns through layer wise greedy unsupervised pre-training; during generation, random sampling is performed from the top hidden layer and reconstructed layer by layer from top to bottom, ultimately synthesizing samples consistent with the original data distribution.

Fig. 3.

The structure of deep RBM.

This generator operates at the fine-grained attack subclass level, adaptively selecting a generation strategy based on each subclass’s sample size, generating data separately and then merging the generated samples with the original ones to construct a more balanced dataset. Different sample sizes have fundamentally different requirements for generative models: scarce samples easily cause overfitting, while shallow models fail to capture complex distributions when samples are sufficient, meaning a unified strategy cannot achieve optimal results across all sample scales.

Based on statistical analysis of the sample sizes ( N) of different attack types in the dataset, the attack types are categorized into small sample, medium sample, and large sample classes according to their natural distribution characteristics.This classification also takes into account the feasibility of RBM training: small-sample classes are handled with shallow network structures to avoid overfitting, whereas large-sample classes, with sufficient data, support deep RBMs to capture more complex feature patterns. HyDRBM-Gen dynamically selects the corresponding generation path according to the sample size labels, as shown in part (b) of Fig. 2.

1. Small sample ( N<2000): Directly train the shallow stacked RBM model; for attack types with extremely scarce samples ( N<100), first apply Kernel Density Estimation (KDE) oversampling to avoid overfitting, then use this shallow structure for generation.

2. Medium sample ( 2000<N<10000): Train and generate with the medium-depth RBM.

3. Large sample ( N>10000): Use a deeper network structure, adding tiny random binary perturbations during generation to boost sample diversity.

This generator mitigates severe class imbalance in in-vehicle CAN bus data by producing large-scale, distribution-conforming data regardless of whether raw attack samples number in the dozens or thousands, thereby providing a balanced and high-quality training foundation for subsequent intrusion detection models. Its pseudocode is shown in Algorithm 1.

Algorithm 1.

HyDRBM-Gen: hierarchical attack data generation.

AE-NSDBO: a multi-objective optimization algorithm for XGBoost

As the core of MOO-IDS, AE-NSDBO aims to address the multi-constraint trade-offs among detection accuracy, model size, and inference latency in in-vehicle environments. Traditional single-objective optimization struggles to comprehensively balance such conflicting objectives. This algorithm integrates non-dominated sorting into DBO, while introducing dynamic weight adjustment, adaptive phase detection and hybrid mutation strategies to enhance global exploration capability and local exploitation capabilities in high-dimensional complex search spaces. This section first formulates the multi-objective optimization problem, then introduces the baseline model XGBoost, the DBO algorithm, and the non-dominated sorting mechanism, and finally presents the complete implementation pathway of AE-NSDBO.

Multi-objective optimization problem formulation

This study formulates the XGBoost hyperparameter optimization problem as a multi-objective optimization problem, synergistically optimizing detection performance, model size, and inference efficiency. This problem can be formalized as the following three-objective minimization problem:

4

where denotes the decision variable vector, representing a set of XGBoost hyperparameters; represents the decision space, defined by the valid ranges of all hyperparameters; denotes the objective vector, mapping the decision space to the objective space. The three objective functions and correspond to model size (in MB), negative F1-score (negated to convert to a minimization problem), and per-sample inference latency (in ms), respectively, all of which are to be minimized.

Due to the conflicting nature of these three objectives, no single solution yields simultaneous optimality for all objectives; therefore, a set of Pareto-optimal solutions must be sought: solutions where no objective can be improved without degrading at least one other objective. Ultimately, the algorithm selects a balanced solution from this set as the optimal hyperparameter combination based on weighted objective function values.

Extreme Gradient Boosting (XGBoost)

Extreme Gradient Boosting (XGBoost) is a highly scalable ensemble learning algorithm proposed by Tianqi Chen and Carlos Guestrin⁴². Built upon the gradient boosting decision tree framework, it uses regularization to control model complexity and prevent overfitting, while supporting parallel and distributed computing for large-scale data^43,44.

For a training dataset with N samples, XGBoost adopts an additive model where the predicted output is the weighted sum of the predictions from  K decision trees:

5

where denotes the  k-th decision tree, and is the function space consisting of all possible decision trees.

For multi-class classification, XGBoost employs the softmax function to output a normalized class probability distribution. The probability that a sample is classified as attack class  c is given by:

6

where  C is the total number of attack classes, and is the output value of the model for class  c.

Since the performance of XGBoost largely depends on its hyperparameter configuration, AE-NSDBO optimizes eight key parameters to fully exploit its potential in multi-class classification problems: n_estimators, max_depth, learning_rate, subsample, reg_alpha, reg_lambda, min_child_weight, and gamma.

Dung Beetle Optimizer (DBO) and non-dominated sorting mechanism

The Dung Beetle Optimizer (DBO) is a novel metaheuristic optimization algorithm proposed by Xue and Shen, inspired by the natural behaviors of dung beetles⁴⁵. Through mathematical modeling, these bionic behaviors are transformed into iterative search mechanisms, effectively coordinating global exploration and local exploitation, demonstrating strong optimization capability and robustness in complex optimization problems⁴⁶. The algorithm achieves population position updates by simulating four core behaviors: the rolling ball behavior enables large-scale exploration, ensuring coverage of more potentially high-quality solution regions⁴⁷; the breeding and foraging behaviors focus on local exploitation, further intensifying the search in high-quality regions; the stealing behavior introduces random perturbations to maintain population diversity and avoid premature convergence.

The synergy and dynamic role allocation of these behaviors enable DBO to achieve an adaptive balance between exploration and exploitation during the search process. Leveraging its efficient bionic search mechanism⁴⁸, DBO can efficiently search for optimal hyperparameter combinations for classifiers.

Since traditional DBO is a single-objective optimization algorithm, while the current problem belongs to multi-objective optimization, the non-dominated sorting mechanism is introduced to construct a multi-objective optimization framework. This mechanism stratifies population individuals through dominance relationships, maintaining the distribution diversity of the solution set⁴⁹, thereby effectively guiding the search process toward the Pareto front, where solutions in the set are mutually non-dominated in the objective space⁵⁰.

The dominance relationship is defined as follows: for any two solutions and , if is not inferior to in all objectives and is strictly superior to in at least one objective, then is said to dominate (denoted as )⁵¹. Based on this, non-dominated sorting partitions the population into different fronts and calculates crowding distances, preferentially retaining solutions with larger crowding distances to ensure broad distribution of the solution set⁵².

This study integrates the non-dominated sorting mechanism with DBO, leveraging the efficient search capability of DBO to expand the coverage of solutions, while employing the non-dominated sorting mechanism to select balanced solutions, forming an improved algorithm framework tailored for multi-objective optimization requirements, providing core support for the subsequent construction of the AE-NSDBO algorithm.

Hyperparameter optimization of XGBoost

AE-NSDBO retains the core behavioral patterns of DBO, including rolling, breeding, and foraging behaviors, but improves and reorganizes them to better adapt to multi-objective optimization tasks. The algorithm flowchart is shown in Fig. 4.

Fig. 4.

Flowchart of the AE-NSDBO. max_iter represents the maximum number of iterations.

1. Population initialization.

    M individuals are randomly generated within the decision space to form the initial population, where each individual represents a set of XGBoost hyperparameters to be optimized. Meanwhile, a Pareto front archive independent of the population is initialized to store the non-dominated solutions discovered during the algorithm’s execution. A baseline weight vector is set for the three objectives, reflecting the initial preferences for the three objectives and balancing the disparate impacts arising from their heterogeneous scales. The current weights are initialized to the baseline weights.

2. Dynamic weight adjustment.

   During optimization, the weights are updated based on the distribution of solutions in the current Pareto front. Specifically, the standard deviation of each objective value in the front is calculated. A smaller standard deviation indicates that the solutions are more concentrated in that objective, suggesting a larger weight should be assigned to encourage exploration. Temporary weights are computed based on the baseline weights:

   7

   This design ensures that each weight adjustment remains anchored to the initial preference, correcting it according to the current solution distribution to avoid excessive weight drift. The temporary weights are then clipped and normalized to obtain new weight vectors for use in subsequent generations.Since the weight adjustment in this formula is based on the relative ratios of the standard deviations of the objectives, and these ratios inherently provide normalization, the adjustment is insensitive to scale differences.

3. XGBoost hyperparameter optimization.

   1. Parent selection
      The weighted objective vector is calculated for each individual based on the current weights. Non-dominated sorting is performed in the weighted objective space. Binary tournament selection is adopted, prioritizing individuals with lower non-dominated ranks and larger crowding distances within the same rank. This process is repeated  M times to form the parent population.
   2. Adaptive stage detection
      To balance convergence and diversity in the multi-objective optimization algorithm, this study employs two quantitative metrics, namely population diversity  D and convergence speed  C, to assess the population state. The diversity of the current generation is obtained by computing the mean Euclidean distance among individuals:

      8
      where  t denotes the current iteration number. The convergence speed is measured by the rate of change in the hypervolume of the Pareto front between two consecutive generations:

      9
      where represents the hypervolume of the Pareto front at generation  t.
      The diversity and convergence thresholds are dynamically computed as follows⁵³, where , , and denote the high/low thresholds for diversity and convergence, respectively, , , and , , are the maximum, minimum, and mean values of the diversity and convergence metrics in the current generation:

      10

      11

      12

      13
      where and are adjustment coefficients. This dynamic thresholding mechanism allows the stage division to adaptively adjust to the actual distribution of the population.
      Based on the physical interpretations of  D and  C, a joint decision rule is adopted for stage classification, and the corresponding dung beetle behaviors are selected for parent individuals to generate preliminary offspring:
      Exploration phase (): indicating that the population is dispersed and converges slowly, the rolling ball behavior is adopted, moving toward a randomly selected Pareto solution while incorporating random perturbations:

      14
      where is a random direction, is a guiding individual randomly selected from the current Pareto front, is the adaptively decaying noise intensity (), is a standard normal random vector, and  T is the maximum number of iterations.
      Balance phase (): indicating that the population state is well balanced, the breeding behavior is adopted, moving toward elite solutions, and the step size decays with iterations:

      

      15
      where is an elite individual randomly selected from the current set of non-dominated optimal solutions, and the step size  L adaptively decreases with iterations, ensuring large perturbations in early stages and fine-tuning in later stages.
      Exploitation phase (): indicating that the population is concentrated and converges rapidly, the foraging behavior is adopted, applying boundary perturbations in a random dimension  k:

      16
      where and are the lower and upper bounds of the  k-th dimension, and the perturbation amplitude factor is set to 0.1, restricting the search to the neighborhood of the optimal solution. The remaining dimensions remain unchanged.
      When the decision results based on  D and  C conflict, the iteration ratio is used as a corrective reference: the exploration judgment is prioritized in the early stage, while the exploitation judgment is prioritized in the later stage, consistent with the iteration-decay mechanism of the original DBO.
   3. Hybrid mutation strategy
      To enhance the ability to escape local optima, a hybrid mutation strategy is introduced. Preliminary offspring individuals undergo mutation with different probabilities depending on the current stage: in the exploration stage, polynomial mutation is applied with a high probability to enable large jumps; in the balance stage, a combination of polynomial, Gaussian, and Cauchy mutations is used; in the exploitation stage, small-step Gaussian mutation is primarily employed. After mutation, the complete offspring population is obtained.
   4. Individual evaluation and population update
      The XGBoost model is trained with the hyperparameter configurations of the offspring individuals, and both the original objective values and the weighted objective values are computed. The parent and offspring populations are merged, and non-dominated sorting and crowding distance calculation are performed in the weighted objective space. The new population is selected based on lower non-dominated ranks and larger crowding distances within the same rank. Simultaneously, non-dominated solutions based on the original objective values are extracted from the merged population to update the Pareto front archive, with the archive size controlled to maintain diversity.
      The process returns to step (2) until the preset number of iterations is reached.

4. Optimal solution selection.

   Finally, the solution that minimizes the final weighted objective value is selected from the final Pareto front as the optimal hyperparameter combination:

   17

   where is the final weight vector. This solution represents the best trade-off among the three objectives and is output as the optimal hyperparameter combination. It should be noted that each component of this weighted objective is evaluated on the validation set to ensure that the selected model simultaneously considers generalization performance and resource efficiency.

AE-NSDBO deeply embeds these three core mechanisms into the iterative optimization process, synergistically driving population evolution to effectively balance the multiple constraints in intrusion detection model optimization. The pseudocode of the algorithm is presented in Algorithm 2.

Algorithm 2.

AE-NSDBO pseudo code.

Code availability

The custom codes developed for the proposed multi-objective optimization framework (MOO-IDS), including the HyDRBM-Gen generator and the AE-NSDBO optimizer, are available as Supplementary Information (Code S1). The codes can be accessed by downloading the supplementary file from the article’s online page. No restrictions apply.

Experiment and result evaluation

Evaluation metrics

To systematically evaluate the comprehensive performance of the model, this study employs multi-dimensional metrics for analysis. All classification performance metrics are computed based on the confusion matrix, encompassing True Positives (TP), True Negatives (TN), False Positives (FP), and False Negatives (FN). The core classification metrics are defined as follows:

• Accuracy: The proportion of correctly classified samples.

18

• Precision: The proportion of actual attacks among samples classified as attacks by the model, measuring the confidence of prediction results and the level of false alarms.

19

• Recall (Detection Rate): The proportion of actual attack samples successfully detected by the model, directly reflecting the model’s coverage capability for security threats.

20

• F1-score: The harmonic mean of precision and recall, providing a balanced comprehensive evaluation for class-imbalanced data.

21

To assess the deployment feasibility of the model in resource-constrained vehicular environments, this study adopts model size and average inference latency as key efficiency metrics, both directly determining storage occupancy and real-time processing capability.

Furthermore, given that this study employs a generator for data augmentation, the following quantitative metrics are introduced to assess the effectiveness of the synthesized attack data:

• Cosine Similarity³⁹: Computes the average cosine similarity between generated data and real data in feature space, measuring the similarity of overall distribution trends.

• Kullback-Leibler (KL) divergence⁵⁴: Measures the information discrepancy between the distribution of generated data and that of real data; lower values indicate closer probability distributions.

• Silhouette Coefficient⁵⁵: Evaluates the degree to which generated data points integrate into the clustering structure of original real data, used to measure the consistency of data structure.

Experimental environment

For the ROAD dataset, all comparison models were reproduced by us under identical experimental conditions. For the Survival Analysis and Car-Hacking datasets, we reproduced the comparison models whose source code was publicly available; for a few methods whose source code was not disclosed, we directly cited the results reported in their original papers.

Experimental platform

The models in this experiment are implemented in Python 3.10.18 using the PyTorch 2.8.0 framework. The experiments are conducted on a computer running Windows 10, equipped with an Intel Core i5-6500 processor, 16 GB of RAM, a 1 TB hard drive, and an NVIDIA GeForce GTX 1660 graphics card.

Experimental parameter configuration

The parameters involved in this experiment are mainly divided into two categories: the HyDRBM-Gen generator parameters and the AE-NSDBO optimization algorithm parameters.

HyDRBM-Gen generator parameters: The deep RBM employs layer-wise greedy pre-training. The number of pre-training epochs for each RBM is set to 50, the learning rate is set to 0.001, and the number of Gibbs sampling steps in the contrastive divergence algorithm is set to 1. For attack types with extremely small sample sizes, KDE with default configuration is employed for smoothing-based augmentation to reach a sample size sufficient for effective RBM training. The random binary perturbation rate ε introduced during large-sample generation is set to 0.01.

AE-NSDBO optimization algorithm parameters: The population size is set to 20, and the maximum number of iterations is set to 30. In evolutionary computation, the dynamic mutation probability is typically controlled within the range of 0.1 to 0.5, which has been widely adopted as a reference basis for balancing exploration and exploitation⁵⁶. Based on this, this paper adopts a mutation probability that decreases with the search stage in the AE-NSDBO algorithm, a “coarse‑to‑fine” parameter adjustment strategy consistent with the commonly adopted practice in evolutionary computation⁵⁷: in the exploration stage, a relatively high mutation probability of 0.3 is set, with polynomial mutation as the dominant operator to promote extensive searching across the solution space. After entering the balance stage, the mutation probability is reduced to 0.2, where Gaussian mutation and Cauchy mutation are combined. The Cauchy mutation enhances global exploration capability while the Gaussian mutation ensures local convergence accuracy, and their combination effectively balances search breadth and precision⁵⁸. In the exploitation stage, the mutation probability is further reduced to 0.1, and small-step Gaussian mutation is adopted for fine-tuning to accelerate convergence to the optimal solution.

In addition, XGBoost in this experiment adopts the multi‑class objective function multi: softmax. The inference latency is measured in a per‑sample manner (batch size = 1), with repeated runs on the test set samples. Outliers are removed using the Interquartile Range (IQR) method, and the remaining results are averaged to ensure the stability of the measurements.

Datasets

This study primarily employs the ROAD dataset for model performance evaluation. This dataset originates from a real, undisclosed vehicle driven during a 3.5-hour activity on a dynamometer at Oak Ridge National Laboratory (ORNL), reproducing various benign driving behaviors, thereby collecting both normal and attack data¹³. It contains over 12 fine-grained attack categories, which can be broadly classified into three main types based on their mechanisms and characteristics: fuzzy attack (termed ‘fuzzing attacks’ in ROAD), targeted ID fabrication attack, and masquerade attack. In addition, the dataset includes an extra attack referred to as the “accelerator attack”; however, due to the severity of the vulnerability, the authors did not disclose its labeling information, and thus this attack is not included in the detection scope of this study⁶. To construct a classification task that closely reflects practical detection requirements and exhibits strong generalization capability, these labeled attack categories, together with normal traffic, are used as the training and evaluation targets for the model. The specific data distribution is presented in Table 1.

Table 1.

Data distribution of the ROAD dataset.

No	Attack class	attack type	Normal records	Attack records
1.	Fuzzy	Fuzzy	93,870	1061
2.	Correlated signal fabrication	Targeted ID Fabrication	187,255	5493
3.	Max engine coolant temp fabrication		61,880	43
4.	Max speedometer fabrication		561,148	11,694
5.	Reverse light off fabrication		302,905	5480
6.	Reverse light on fabrication		457,200	8034
7.	Correlated signal masquerade	Masquerade	181,765	5493
8.	Max engine coolant temp masquerade		61,838	43
9.	Max speedometer masquerade		549,457	11,694
10	Reverse light off masquerade		297,428	5480
11.	Reverse light on masquerade		449,169	8034
12.	Normal (attack free)	Normal	24,148,243

To evaluate the generalization capability of the model across different vehicle environments, additional experiments are conducted on two benchmark datasets from the Hacking and Countermeasure Research Lab (HCRL). The Car-Hacking dataset, collected from a modern vehicle and primarily containing basic attack types such as DoS, fuzzy and spoofing. Due to its relatively simple attack patterns and abundant data volume, it is widely adopted as an evaluation benchmark in academia. The Survival Analysis dataset, also provided by HCRL, characterized by attack data collected from three different vehicle models: Hyundai Sonata, Kia Soul, and Chevrolet Spark. It mainly involves DoS, fuzzy, and malfunction attacks⁵⁹, enabling assessment of cross-platform adaptability. These two datasets effectively complement ROAD dataset in attack complexity, data scale and vehicle platforms, offering a multi-dimensional benchmark for comprehensively validating the model’s performance. Their detailed data compositions are shown in Tables 2 and 3.

Table 2.

Data distribution of the car-hacking dataset.

No	Attack class	Normal records	Attack records
1.	DoS	3,078,250	587,521
2.	Fuzzy	3,347,113	491,847
3.	Gear spoofing	3,845,890	597,252
4.	RPM spoofing	3,966,805	654,897
5.	Normal (attack free)	988,872

Table 3.

Data distribution of the survival analysis dataset.

NO	Attack class	Normal records			Attack records
		Sonata	Soul	Spark	Sonata	Soul	Spark
1.	Flooding	117,125	148,760	97,983	32,422	33,141	22,587
2.	Fuzzy	117,552	210,178	59,853	18,118	39,812	5812
3.	Malfunction	116,677	162,515	71,740	15,974	7401	8047
4.	Attack free state	117,173	192,516	136,934

To ensure the reliability and generalization capability of the optimization evaluation, a five-fold stratified cross-validation (StratifiedKFold) strategy is adopted for data partitioning. Specifically, the entire dataset is first split into 80% for training and validation and 20% for an independent test set. The training and validation set is further divided into training and validation subsets with an 8:2 ratio. All partitions are stratified based on fine-grained attack subclass labels, ensuring that each fold maintains the original distribution of attack categories, thereby providing a stable and balanced evaluation foundation for multi-objective optimization.

Effectiveness validation of HyDRBM-Gen

To quantitatively assess HyDRBM-Gen, this section evaluates its performance from two perspectives: data reliability and impact on model detection performance.

Reliability assessment of generated data

To verify the reliability of the data generated by the generator HyDRBM-Gen, this study employs cosine similarity, KL divergence, and silhouette coefficient to evaluate the generated data from three perspectives: feature distribution consistency, probability distribution discrepancy, and structural compatibility. Meanwhile, to validate the necessity of the stacked structure, this experiment compares the generation quality of a single-layer RBM (RBM-Gen) under identical conditions. In addition, for two attack types with extremely small sample sizes, the metric variations after removing KDE preprocessing (HyDRBM-Gen-nokde) are additionally evaluated to verify the effectiveness of KDE for such samples. Table 4 presents the quantitative evaluation results for various attack types on the ROAD dataset under the three generation configurations.

Table 4.

Quantitative evaluation of data quality under different generation configurations on the ROAD dataset.

Attack type	Generation strategy	Cosine similarity	KL divergence	Silhouette coefficient
Correlated signal fabrication	HyDRBM-Gen	0.950568	0.000264	0.002586
	RBM-Gen	0.894780	0.001322	0.018035
Correlated signal masquerade	HyDRBM-Gen	0.950542	0.000261	0.002156
	RBM-Gen	0.894144	0.001307	0.018211
Fuzzing	HyDRBM-Gen	0.926710	0.000100	0.000119
	RBM-Gen	0.910050	0.000761	0.000386
Max engine coolant temp fabrication	HyDRBM-Gen	0.911876	0.000541	− 0.016079
	RBM-Gen	0.836126	0.001808	− 0.029977
	HyDRBM-Gen-nokde	0.865745	0.001437	− 0.029540
Max engine coolant temp masquerade	HyDRBM-Gen	0.887331	0.000536	− 0.010755
	RBM-Gen	0.834168	0.015446	− 0.034211
	HyDRBM-Gen-nokde	0.857142	0.006754	− 0.027063
Max speedometer fabrication	HyDRBM-Gen	0.760867	0.009109	0.003118
	RBM-Gen	0.716327	0.016840	0.015479
Max speedometer masquerade	HyDRBM-Gen	0.762626	0.010161	0.003306
	RBM-Gen	0.715958	0.016760	0.015373
Reverse light off fabrication	HyDRBM-Gen	0.744245	0.003564	0.008319
	RBM-Gen	0.712198	0.010573	0.018553
Reverse light_off masquerade	HyDRBM-Gen	0.782954	0.002949	0.007444
	RBM-Gen	0.711563	0.010498	0.018912
Reverse light on fabrication	HyDRBM-Gen	0.744245	0.002920	0.004411
	RBM-Gen	0.676077	0.016054	0.016151
Reverse light on masquerade	HyDRBM-Gen	0.744992	0.003727	0.004880
	RBM-Gen	0.665592	0.015283	0.015575

Quantitative evaluation results show that HyDRBM-Gen consistently outperforms RBM-Gen across all 11 attack categories, achieving higher cosine similarity, lower KL divergence, and generally superior silhouette coefficients, thereby validating the superiority of the stacked structure in capturing the complex distribution of CAN data. Specifically, Correlated signal attacks achieve cosine similarity exceeding 0.95, with most categories maintaining values above 0.74, indicating high fidelity to real attack characteristics. For Fuzzing attacks, the KL divergence is as low as 0.0001, reflecting high consistency in feature distribution and probability density with real data. For the two attack types with extremely small sample sizes (Max engine coolant temp), removing KDE preprocessing (HyDRBM-Gen-nokde) leads to a notable decrease in cosine similarity and a significant increase in KL divergence, confirming the effectiveness of KDE. Their silhouette coefficients remain slightly negative under all three configurations, primarily due to the extremely limited sample sizes that hinder the formation of valid clustering structures; in contrast, all other categories yield positive silhouette coefficients, suggesting favorable structural compatibility with minimal conflicts. These results collectively demonstrate the effectiveness of HyDRBM-Gen and thereby the reliability of the generated data.

Impact of HyDRBM-Gen on model performance

To verify the practical improvement of synthetic data on detection performance, this experiment, without incorporating the IDF and IDC features, employs the proposed classification model to compare its detection performance on the original imbalanced (Original), RBM-Gen augmented (RBM-Gen), and HyDRBM-Gen augmented (HyDRBM-Gen) datasets. As shown in Table 5, HyDRBM-Gen achieves optimal or comparable performance on the vast majority of attack types. For the most challenging targeted ID fabrication attacks, the F1-score on the original data is only 0.3633; the single-layer RBM not only fails to improve it but further degrades it to 0.1005, whereas HyDRBM-Gen significantly raises it to 0.4985. For masquerade attacks, although the single-layer RBM achieves a relatively high recall of 0.8406, its precision is only 0.4991, indicating that the high recall comes at the cost of numerous false positives rather than stemming from effective feature learning. HyDRBM-Gen adjusts the recall to 0.4922 while increasing precision to 0.5000, effectively suppressing the generation of spurious samples. For normal traffic and fuzzing attacks, the single-layer RBM exhibits a slight decrease in F1-score,, whereas HyDRBM-Gen achieves F1-scores of 0.9980 and 1.0000, perfectly preserving the original performance. These results indicate that the single-layer RBM struggles to balance the generation quality across different attack types, whereas HyDRBM-Gen achieves significant improvements on the most difficult attacks while maintaining detection accuracy on the majority of classes, demonstrating superior overall performance.

Table 5.

Comparison of detection performance between original data and data augmented by different generators on the ROAD dataset.

Attack type	Data	Accuracy	Precision	Recall	F1-score
Normal	Original	0.9917	0.9916	1.0000	0.9958
	RBM-Gen	0.9753	0.9675	0.9999	0.9834
	HyDRBM-Gen	0.9970	0.9961	0.9998	0.9980
Fuzzing	Original	1.0000	1.0000	1.0000	1.0000
	RBM-Gen	0.9997	0.9977	0.9893	0.9936
	HyDRBM-Gen	1.0000	1.0000	1.0000	1.0000
Targeted ID fabrication	Original	0.9904	0.4853	0.2903	0.3633
	RBM-Gen	0.8781	0.4882	0.0560	0.1005
	HyDRBM-Gen	0.8785	0.5001	0.4970	0.4985
Masquerade	Original	0.9905	0.4931	0.2566	0.3376
	RBM-Gen	0.8781	0.4991	0.8406	0.6263
	HyDRBM-Gen	0.8782	0.5000	0.4922	0.4961

In summary, HyDRBM-Gen outperforms the single-layer RBM in terms of generated data quality, and the effectiveness of its stacked structure and KDE preprocessing has been validated. Meanwhile, in the detection performance comparison, HyDRBM-Gen achieves a substantial F1-score improvement for targeted ID fabrication attacks while maintaining stable or superior performance across all attack types. Together, these results confirm the reliability of the data generated by HyDRBM-Gen and its effective enhancement of model detection performance, fully demonstrating the necessity and superiority of complex deep generative structures for data augmentation in CAN bus intrusion detection.

Validation of feature engineering effectiveness

To address highly stealthy complex attacks, this study designs two key discriminative features: IDF and IDC. This section aims to verify whether the joint introduction of these two features effectively enhances the model’s ability to distinguish complex attacks.

Comparative visualization analysis of feature space

To intuitively verify the discriminative capability of the designed features for different attack types, this study employs t-SNE for dimensionality reduction and visualization of the feature space. In the visualization stage, 500 samples are randomly selected from each category to avoid the low computational efficiency and sample overlap issues associated with full-dataset t-SNE, while ensuring statistical representativeness of the feature distribution, as shown in Fig. 5.

Fig. 5.

t-SNE visualization of feature distributions for different attack types on the ROAD dataset: (a) original feature space, (b) enhanced feature space.

As illustrated in the figure, in the feature space using only basic features (Fig. 5a), samples of targeted ID fabrication attacks, masquerade attacks, and normal traffic exhibit significant overlap, with blurred class boundaries, making effective differentiation difficult. In contrast, in the augmented feature space incorporating IDF and IDC features (Fig. 5b) shows improved clustering compactness and inter-class separation, with substantially reduced overlap. This demonstrates that the IDF and IDC features effectively capture behavioral differences among attack patterns, significantly enhancing feature discriminability and providing a more discriminative feature foundation for subsequent classification models.

Classification performance evaluation based on feature augmentation

Building on this, we further quantify the contribution of the new features to classification performance by comparing the detection performance of the proposed classification model using the original feature set (Original Features) versus the augmented feature set (Augmented Features) incorporating IDF and IDC, without using data augmentation. The experimental results are presented in Table 6.

Table 6.

Comparison of detection performance between original and augmented features on the ROAD dataset.

Attack type	Feature set	Accuracy	Precision	Recall	F1-Score
Normal	Original features	0.9917	0.9916	1.0000	0.9958
	Augmented features	0.9997	0.9998	0.9999	0.9999
Fuzzy	Original features	1.0000	1.0000	1.0000	1.0000
	Augmented features	1.0000	1.0000	1.0000	1.0000
Targeted ID fabrication	Original features	0.9904	0.4853	0.2903	0.3633
	Augmented features	1.0000	0.9985	0.9979	0.9982
Masquerade	Original features	0.9905	0.4931	0.2566	0.3376
	Augmented features	0.9997	0.9919	0.9777	0.9848

The results show that after introducing the augmented features, the model’s detection performance for normal traffic and fuzzy attacks remains stable with slight improvements. Notably, for stealthy rare attacks such as targeted ID fabrication and masquerade attacks, the detection performance achieves substantial enhancement, with recall for both attack types increasing dramatically from below 0.3 to above 0.97, accompanied by a magnitude-level improvement in precision and F1-score. This indicates that the augmented features effectively compensate for the deficiency of original features in discriminating stealthy attack patterns, substantially reducing the rates of missed detections and false alarms for such attacks.

To further quantify the contribution of each feature to model decision-making, this study employs the SHAP method to analyze feature importance in the XGBoost model. As shown in Fig. 6, features are arranged in descending order of mean absolute SHAP values, with colors characterizing their contribution distributions to normal traffic (normal), masquerade attacks (masquerade), fabrication attacks (fabrication), and fuzzing attacks (fuzzing).

Fig. 6.

SHAP feature importance bar plot on the enhanced feature set.

The results demonstrate that IDF and IDC exhibit significantly higher importance than all other features. IDF presents higher SHAP contribution values for masquerade and fabrication, while its contributions to normal and fuzzing are relatively limited, indicating that this feature demonstrates specific discriminative capability for attack patterns involving frequency anomalies of a specific ID. In contrast, IDC contributes significantly to normal, masquerade, and fabrication, exhibiting a more balanced multi-class distribution, indicating that through quantifying deviations in data payloads, it offers general discriminative capability for data tampering attacks.

The SHAP values of the remaining features are markedly lower than those of IDF and IDC. Although some features also also contribute to multiple classes, their overall impact on model decisions is limited, failing to effectively substitute the core features.

Combined with the performance gains brought by the augmented features in Table 6, the SHAP analysis further validates that the proposed IDF and IDC can effectively capture complex attack patterns, providing the model with highly discriminative decision-making evidence.

Performance evaluation and analysis of MOO-IDS

To validate the comprehensive performance of MOO-IDS, this section conducts evaluation from two perspectives: model comparison and parameter analysis. We first perform comparative experiments with other models to assess detection accuracy and efficiency; subsequently, we investigate the influence of parameter variations to determine and analyze the final configuration.

Performance comparison of classification models

The proposed MOO-IDS model is systematically evaluated against several state-of-the-art (SOTA) models, as shown in Table 7.

Table 7.

Results analysis of each model for different attacks in ROAD dataset.

Data	Models	Attack type	Accuracy	Precision	Recall	F1-Score	Model size (MB)	Detection latency (ms)
Road dataset	RF	Normal	0.9999	0.9999	1.0000	0.9999	181.177	55.269
		Fuzzy	1.0000	1.0000	1.0000	1.0000
		Targeted ID fabrication	0.9920	0.9490	0.9870	0.9677
		Masquerade	0.9919	0.9865	0.9466	0.9661
	LightGBM	Normal	0.9999	0.9999	0.9999	0.9998	1.102	2.610
		Fuzzy	1.0000	1.0000	1.0000	1.0000
		Targeted ID fabricatio n	0.9427	0.9993	0.9702	0.9925
		Masquerade	0.9988	0.9388	0.9679	0.9924
	CNN	Normal	0.9865	0.9983	0.9832	0.9907	0.445	104.332
		Fuzzy	0.9999	0.9999	0.9991	0.9995
		Targeted ID fabrication	0.9851	0.8967	0.9912	0.9416
		Masquerade	0.9999	0.9366	0.9235	0.9300
	CAN-ADF24	Normal	0.9945	0.9980	0.9945	0.9963	45.213	74.546
		Fuzzy	0.9999	1.0000	0.9984	0.9992
		Targeted ID fabricatio n	0.9876	0.9149	0.9899	0.9509
		Masquerade	0.9882	0.9808	0.9212	0.9501
	LSTM23	Normal	0.9990	0.9992	0.9994	0.9993	81.039	0.414
		Fuzzy	0.9999	0.9999	0.9997	0.9998
		Targeted ID Fabrication	0.9990	0.9330	0.9982	0.9645
		Masquerade	0.9907	0.9972	0.9264	0.9605
	HyDL-IDS25	Normal	0.9502	0.9675	0.9645	0.9660	0.471	72.159
		Fuzzy	0.9956	0.9688	0.8356	0.8973
		Targeted ID fabrication	0.8532	0.4478	0.8946	0.5968
		Masquerade	0.8776	0.4257	0.0200	0.0382
	Rec-CNN26	Normal	0.9726	0.9766	0.9923	0.9844	32.566	114.653
		Fuzzy	0.9998	0.0000	0.0000	0.0000
		Targeted ID fabricatio n	0.9295	0.3273	0.0526	0.0907
		Masquerade	0.9285	0.4868	0.7886	0.6020
	TAN33	Normal	0.9967	0.9978	0.9977	0.9977	0.279	256.930
		Fuzzy	0.9999	0.9996	0.9984	0.9990
		Targeted ID fabrication	0.9895	0.9299	0.9881	0.9581
		Masquerade	0.9884	0.9822	0.9212	0.9507
	MetaCAN21	Normal	0.9999	0.9999	0.9999	0.9999	1.583	2.427
		Fuzzy	1.0000	1.0000	1.0000	1.0000
		Targeted ID Fabrication	0.9891	0.9424	0.9986	0.9697
		Masquerade	0.9890	0.9984	0.9386	0.9670
	XGBoost42	Normal	0.9999	0.9999	0.9999	0.9999	1.026	0.502
		Fuzzy	1.0000	1.0000	1.0000	1.0000
		Targeted ID fabrication	0.9431	0.9993	0.9704	0.9926
		Masquerade	0.9988	0.9394	0.9682	0.9925
	Our (MOO-IDS)	Normal	0.9983	0.9991	0.9987	0.9989	0.199	0.367
		Fuzzy	1.0000	1.0000	1.0000	1.0000
		Targeted ID fabrication	0.9919	0.9413	0.9959	0.9678
		Masquerade	0.9912	0.9912	0.9359	0.9627

Regarding detection accuracy, HyDRBM-Gen effectively alleviates data imbalance through synthetic sample generation, enabling the model to adequately learn minority-class attack patterns; meanwhile, the IDF and IDC features enhance the discriminability of stealthy attacks from two perspectives, frequency anomaly and data content deviation. Consequently, MOO-IDS achieved results comparable to the best-performing models across multiple metrics. Specifically, for fuzzy attack detection, the proposed method, MetaCAN, and XGBoost all attained classification performance metrics of 1.0000. For the more complex targeted ID fabrication attacks, the F1-score of MOO-IDS reached 0.9678, showing minimal deviation from the baseline XGBoost (0.9926) while surpassing CNN (0.9416), HyDL-IDS (0.5968), and other models. For masquerade attack detection, MOO-IDS achieved a precision of 0.9912, demonstrating a low false alarm rate.

However, the primary advantage of the proposed method lies in its significant improvement in model efficiency. The comparison with the baseline model XGBoost illustrates this point: the model size of MOO-IDS (0.199 MB) was merely 19.4% of that of XGBoost (1.026 MB), with inference latency reduced by 26.9%. MOO-IDS is substantially more compact than MetaCAN (1.583 MB), LightGBM (1.102 MB), and deep learning models (CNN, LSTM), reaching only 12.6% of MetaCAN’s size, while maintaining comparable or superior accuracy and delivering over two orders of magnitude faster inference. This result confirms that AE-NSDBO treats model size, inference latency, and detection accuracy as joint objectives during optimization, enabling substantial model compression and inference acceleration with minimal performance degradation, thereby ensuring that the model satisfies the resource constraints of in-vehicle ECUs while maintaining competitive accuracy.

Furthermore, it should be noted that the experiments in Table 7 were conducted on the augmented dataset, whose test set covers a more diverse range of attack patterns, making the evaluation more challenging than that on the original test set used in Table 6. Under this more challenging augmented data setting, the F1-score of MOO-IDS is slightly lower than that achieved with the augmented features alone on the original data in Table 6. This observation, however, reflects the stable discriminative capability of the IDF and IDC features. Even when the data distribution shifts and the testing difficulty increases, the model maintains high detection accuracy, which validates the robustness of MOO-IDS in real-world deployment scenarios.

Meanwhile, Fig. 7 presents the confusion matrix of MOO-IDS on the augmented ROAD dataset, confirming the model’s high accuracy and low false alarm rate. Figure 8 compares the classification performance of each model, highlighting the comprehensive advantages of MOO-IDS. Figure 9 shows the per-attack performance comparison for (a) fuzzy, (b) targeted ID fabrication, and (c) masquerade attacks, demonstrating stable and superior performance across all scenarios.

Fig. 7.

Confusion Matrices of MOO-IDS on ROAD dataset.

Fig. 8.

Compared models evaluation result on ROAD dataset.

Fig. 9.

Model’s comparative results based on different attacks. (a) Fuzzy attacks, (b) Targeted ID Fabrication attacks, (c) Masquerade.

Impact of hyperparameters on model performance

To analyze the impact of each hyperparameter on model performance, Fig. 10 presents the relationship between each hyperparameter and the F1-score (Y-axis) as well as model size (color mapping) during the AE-NSDBO optimization process, where the red star marks the finally selected optimal solution. Overall, all parameters have a relatively limited impact on the F1-score within the search range, but their influence on model size varies significantly. Among them, n_estimators and max_depth are the primary parameters affecting model size: when n_estimators increases from 50 to 200, model size grows substantially while F1 remains nearly unchanged; max_depth exhibits a similar trend from 3 to 10, where F1 improvement is limited but model size increases noticeably. In contrast, min_child_weight and gamma show the opposite pattern: larger parameter values result in smaller models while F1 remains largely stable. This is because these two parameters constrain tree growth by regulating the minimum sum of instance weights required for a leaf node to split and the minimum loss reduction required for a node to split, respectively, thereby effectively controlling model complexity. Therefore, prioritizing larger values for min_child_weight and gamma helps achieve model lightweighting without significantly compromising accuracy. The scatter distributions of other parameters are relatively dispersed, with no significant direct impact on the objectives, yet they exhibit complex interactions with key parameters, such as the coupling between learning rate and the number of trees. This observation indicates that the AE-NSDBO algorithm achieves an effective balance between performance and resource consumption, demonstrating the practical value of multi-objective optimization. The finally selected optimal solution is a balanced configuration that comprehensively considers the joint effects of all parameters, with the corresponding parameter values listed in Table 8.Although inference latency is not directly shown in the figure, it is highly positively correlated with model complexity and computational cost, thereby optimizing model size correspondingly reduces inference latency. Furthermore, although the optimal parameters vary across datasets due to differences in data distribution, the parameter sensitivity patterns remain largely consistent, indicating that the proposed multi-objective optimization framework exhibits stable adaptability to different data distributions.

Fig. 10.

Impact of parameter selection on performance. (a) n_estimators, (b) max_depth, (c) learning_rate, (d) subsample, (e) reg_alpha, (f) reg_lambda, (g) min_child_weight, (h) gamma.

Table 8.

The hyperparameters of XGBoost, their upper and lower bounds, and optimal values obtained through the optimization process in ROAD dataset.

Name	Upper and lower bounds	ROAD
n_estimators	[50,200]	52
max_depth	[3,10]	3
learning_rate	[0.01,0.3]	0.3
subsample	[0.6,1.0]	0.6
reg_alpha	[0,1]	0.849
reg_lambda	[0,1]	1.0
min_child_weight	[1,10]	10
gamma	[0,5]	4.853

The optimized parameter combinations in Table 8 explain, from the parameter perspective, how MOO-IDS achieves its efficiency advantage. Specifically, AE-NSDBO reduces n_estimators from the default value of 100 to 52 and max_depth from 6 to 3, directly reducing model complexity. Enhanced regularization (reg_alpha = 0.849, reg_lambda = 1.0) further compresses the model without sacrificing generalization capability. These adjustments reduce the number of parameters by 65% and shorten decision paths by 70% while maintaining high detection accuracy, providing an ideal lightweight solution for resource-constrained in-vehicle intrusion detection systems.

Convergence analysis of AE-NSDBO

To further evaluate the convergence performance of AE-NSDBO, we compare it with the classical multi-objective optimization algorithm NSGA-II, with both algorithms adopting the same population size (20) and maximum number of generations (30). As shown in Fig. 11, the two solid curves represent the convergence trajectories of AE-NSDBO and NSGA-II, respectively, with the dashed lines indicating the generations at which each algorithm stabilizes: AE-NSDBO converges at approximately 15 generations, while NSGA-II converges at approximately 22 generations.

Fig. 11.

Comparison of hypervolume (HV) convergence curves between AE-NSDBO and NSGA-II on the ROAD dataset.

It can be observed from the figure that AE-NSDBO rapidly approaches the Pareto front within the first 10 generations and stabilizes after about 15 generations, demonstrating a faster overall convergence speed than NSGA-II. This advantage is attributed to its adaptive phase detection mechanism, which dynamically adjusts the search strategy according to population diversity and convergence status, effectively balancing exploration and exploitation. In contrast, the convergence speed of NSGA-II is relatively moderate, gradually stabilizing only after about 22 generations.Therefore, the maximum number of generations is set to 30 in this study, ensuring optimization effectiveness while maintaining computational efficiency. In terms of population size, as shown in Fig. 10, the 30 Pareto-optimal solutions generated under this configuration are uniformly distributed across all hyperparameter dimensions, covering the effective range of the search space. This indicates that a population size of 20 is sufficient to maintain population diversity and avoid premature convergence, further validating the rationality of the algorithm configuration.

In summary, MOO-IDS effectively balances detection accuracy and model efficiency, with the AE-NSDBO optimization algorithm demonstrating fast convergence speed and favorable search stability, achieving a high-performance intrusion detection solution suitable for resource-constrained in-vehicle environments.

Evaluation of generalization capability

To thoroughly evaluate the generalization capability and overall efficacy of MOO-IDS, this experiment conducts assessment on two publicly available benchmark datasets with distinct data distributions and attack characteristics, and performs comparative analysis against mainstream models trained on each dataset.

Given the similar experimental results across the three vehicle models in the Survival Analysis dataset, all demonstrating excellent detection performance, this paper takes the Hyundai Sonata as a representative to showcase the results. As shown in Table 9, the LSTM model, leveraging its powerful sequential modeling capability; however, its model size is substantial (4.100 MB) with high inference latency (63.444 ms). XGBoost and graph-based models (G-IDCS, GNAT) also perform well. The MetaCAN model, through meta-heuristic optimization, achieves F1-scores approaching 1.000 across all attack types, with a model size of 0.814 MB, yet its latency remains relatively high. In contrast, the proposed MOO-IDS achieves equally excellent classification performance while delivering improvements of several orders of magnitude in efficiency compared to other models.

Table 9.

Results analysis of each model for different attacks in survival analysis datasets.

Data	Models	Attack type	Accuracy	Precision	Recall	F1-score	Model size (MB)	Detection latency (ms)
Survival analysis datasets (Sonata)	LSTM23	Normal	–	–	1.0000	1.0000	4.100	63.444
		Flooding	–	–	1.0000	1.0000
		Fuzzy	–	–	0.9995	0.9996
		Malfunction	–	–	1.0000	1.0000
	XGBoost42	Normal	0.9999	0.9999	0.9999	0.9998	1.102	0.236
		Flooding	1.0000	1.0000	1.0000	1.0000
		Fuzzy	0.9427	0.9993	0.9702	0.9925
		Malfunction	0.9988	0.9388	0.9679	0.9924
	G-IDCS28	Normal	–	–	–	–	–	–
		Flooding	0.9973	0.9972	0.9974	0.9272
		Fuzzy	1.0000	1.0000	1.0000	1.0000
		Malfunction	0.9985	1.0000	0.9964	0.9982
	GNAT60	Normal	0.9998	0.9998	0.9999	0.9999	1.335	34.814
		Flooding	0.9999	1.0000	0.9999	1.0000
		Fuzzy	0.9921	0.9486	0.9889	0.9683
		Malfunction	0.9921	0.9884	0.9458	0.9666
	TAN33	Normal	0.9981	0.9973	0.9981	0.9977	0.279	78.832
		Flooding	0.9834	0.9991	0.9834	0.9912
		Fuzzy	0.9975	0.9695	0.9975	0.9833
		Malfunction	0.9823	0.9970	0.9823	0.9896
	CANintelliIDS61	Normal	–	–	1.0000	1.0000	3.475	80.127
		Flooding	–	–	1.0000	1.0000
		Fuzzy	–	–	0.9995	0.999
		Malfunction	–	–	1.0000	1.0000
	MetaCAN21	Normal	0.999972	0.999968	1.00000	0.999984	1.583	37.613
		Flooding	1.000000	1.000000	1.000000	1.000000
		Fuzzy	0.999972	1.000000	0.999165	0.999582
		Malfunction	1.000000	1.000000	1.000000	1.000000
	Our (MOO-IDS)	Normal	0.999833	0.999801	0.999929	0.999865	0.168	0.360
		Flooding	0.999947	1.000000	0.999636	0.999818
		Fuzzy	0.999850	0.999339	0.999413	0.999376
		Malfunction	0.999947	0.999924	0.999621	0.999773

Results on the Car-Hacking dataset (Table 10) reveals that deep models such as LSTM and Rec-CNN perform excellently on classification tasks, achieving F1-scores above 0.98 on multi-class attacks; however, their model volumes are substantial (4.100 MB and 32.566 MB respectively) with high inference latency, making them difficult to satisfy real-time requirements. The lightweight model TAN (0.279 MB) exhibits relatively inferior accuracy on certain attacks, with latency high. Although these graph-based models are relatively lightweight, some classification metrics show slight gaps compared to the proposed model. The proposed model similarly demonstrates excellence in balancing accuracy and efficiency on this dataset, maintaining F1-scores above 0.999 for all attack types while preserving an extremely lightweight 0.249 MB size and ultra-low 0.872 ms latency, fully satisfying deployment requirements for vehicular environments.

Table 10.

Results analysis of each model for different attacks in car-hacking dataset.

Data	Models	Attack type	Accuracy	Precision	Recall	F1-score	Model size (MB)	Detection latency (ms)
Car-Hacking dataset	LSTM23	Normal	0.98890	0.97650	0.99120	0.98380	4.10	66.268
		DoS	0.98334	0.91972	0.98158	0.94965
		Fuzzy	0.99181	0.94431	0.99479	0.96889
		Gear	0.99140	0.94992	0.98796	0.96857
		RPM	0.98779	0.95844	0.95549	0.95697
	Rec-CNN26	Normal	0.99520	0.99120	0.99810	0.99460	32.566	77.498
		DoS	0.99477	0.98986	0.99970	0.99476
		Fuzzy	0.98255	0.96951	0.99572	0.98244
		Gear	0.99278	0.99331	0.99227	0.99278
		RPM	0.99150	0.98368	0.99936	0.99146
	GGNB27	Normal	–	0.99852	0.99784	0.99816	–	–
		DoS	–	0.99790	0.99750	0.99770
		Fuzzy	–	0.99890	0.99890	0.99890
		Gear	–	0.96650	0.99634	0.97810
		RPM	–	0.96500	0.99634	0.97810
	G-IDCS28	Normal	0.99613	0.99012	0.99334	0.99172	–	–
		DoS	0.99440	0.98110	0.98860	0.99330
		Fuzzy	0.99280	0.99710	0.99000	0.99350
		Gear	0.99520	1.00000	0.99806	0.99540
		RPM	0.99200	0.99550	0.98690	0.99270
	DST-IDS31	Normal	1.00000	1.00000	1.00000	1.00000	–	0.180
		DoS	1.00000	1.00000	1.00000	1.00000
		Fuzzy	0.99999	0.99995	0.99998	0.99996
		Gear	0.99999	0.99995	0.99998	0.99996
		RPM	1.00000	1.00000	1.00000	1.00000
	GDT-IDS29	Normal	–	0.99210	0.99430	0.99320	–	–
		DoS	–	0.98440	0.98880	0.99860
		Fuzzy	–	0.99880	0.99930	0.99910
		Gear	–	0.99810	0.99780	0.99800
		RPM	–	0.99870	0.99800	0.99840
	TAN33	Normal	1.00000	1.00000	1.00000	1.00000	0.279	82.493
		DoS	1.00000	1.00000	1.00000	1.00000
		Fuzzy	0.99966	0.99999	0.99933	0.99966
		Gear	0.99865	0.98340	0.99896	0.99865
		RPM	0.99750	0.99565	0.99936	0.99750
	HyDL-IDS25	Normal	1.00000	1.00000	1.00000	1.00000	0.471	63.247
		DoS	1.00000	1.00000	1.00000	1.00000
		Fuzzy	0.99983	0.99985	0.99887	0.99936
		Gear	1.00000	1.00000	1.00000	1.00000
		RPM	0.99750	0.99565	0.99936	0.99750
	STC-GraphFormer30	Normal	0.99980	0.99960	0.99940	0.99950	–	–
		DoS	0.99996	0.99983	0.99906	0.99945
		Fuzzy	0.99955	0.99764	0.99683	0.99724
		Gear	0.99951	0.99978	0.99943	0.99960
		RPM	0.99960	0.99889	0.99957	0.99973
	Our (MOO-IDS)	Normal DoS	0.99998 0.99999	0.99997 1.00000	1.00000 0.99979	0.99999 0.99999	0.249	0.872
		Fuzzy	0.99999	0.99994	0.99965	0.99980
		Gear	1.00000	1.00000	0.99996	0.99998
		RPM	1.00000	1.00000	0.99999	0.99999

The confusion matrices corresponding to both datasets (Fig. 12) intuitively confirm the high classification accuracy and low misclassification rate of the proposed model. Overall, the proposed model demonstrates exceptional generalization capability across both datasets and substantial potential for deployment in actual vehicular embedded environments.

Fig. 12.

Confusion matrices of MOO-IDS on different datasets. (a) Survival analysis datasets for the Sonata, (b) car-hacking dataset.

Conclusion and future work

The proposed MOO-IDS effectively alleviates the scarcity of attack samples and mitigates class imbalance issues through HyDRBM-Gen. The introduced IDF and IDC features enhance the representation of complex attacks from the dimensions of temporal behavior and content statistics. Meanwhile, the AE-NSDBO algorithm achieves multi-objective synergistic optimization of F1-score, model size, and inference latency. Experimental results demonstrate that MOO-IDS achieves excellent performance across all three datasets. On the Survival Analysis and Car-Hacking datasets, it attains F1-scores of at least 0.9993 for all attack types. Even on the ROAD dataset, which presents more complex attack patterns and higher recognition difficulty, the F1-scores across various attack types remain above 0.96. Meanwhile, the model size is as low as 0.157 MB and inference latency is as low as 0.360 ms. Compared with mainstream models, the proposed method achieves comparable or superior detection accuracy while reducing model size by one to three orders of magnitude and improving inference speed by over two orders of magnitude, fully meeting the deployment requirements of resource-constrained vehicular environments and providing a high-precision, lightweight, and strongly generalizable multi-class intrusion detection solution for intelligent connected vehicles.

Although MOO-IDS has achieved significant breakthroughs in detection accuracy, model efficiency, and cross-dataset generalization, there remains room for further expansion and optimization as in-vehicle network technologies evolve and attack methods become more sophisticated. Future work will proceed in two directions: first, in-depth investigation of the quantitative impact of adaptive mechanisms and hybrid mutation strategies in AE-NSDBO, and on this basis, integration with federated learning, differential privacy, and model compression techniques to achieve collaborative optimization of privacy protection and lightweight deployment; second, construction of an end-to-end feature extraction model fusing spatiotemporal convolutional networks and Transformer, extending to multi-protocol scenarios such as in-vehicle Ethernet to enhance robustness against novel attacks.

Supplementary Information

Below is the link to the electronic supplementary material.

Supplementary Material 1 ^{(17.6KB, zip)}

Author contributions

Y.H. contributed to conceptualization, methodology, software, validation, formal analysis, investigation, data curation, writing—original draft, writing—review & editing, and visualization. H.B. and S.A. contributed to validation and writing—original draft. J.Z. contributed to formal analysis and writing—review & editing. X.F. contributed to conceptualization, methodology, resources, supervision, and funding acquisition. H.L. contributed to conceptualization, methodology, resources, supervision, project administration, funding acquisition, and writing—review & editing. All authors reviewed the manuscript.

Funding

This work was supported by the National Natural Science Foundation Project (No. U25A20528), the Inner Mongolia Natural Science Foundation Key Project (No. 2025ZD012), the Inner Mongolia Autonomous Region Challenge-Based Project (No. 2025KJTW0026), the Inner Mongolia Autonomous Region Key Laboratory Project (No. 2025KYPT0076), the Inner Mongolia Natural Science Foundation Project (No. 2024MS06002), and the Inner Mongolia Autonomous Region Universities Innovative Research Team Project (No. NMGIRT2313).

Data availability

The datasets analyzed during this study are publicly available. The Real ORNL Automotive Dynamometer (ROAD) CAN Intrusion Dataset is available from Zenodo (https://doi.org/10.5281/zenodo.10462796). The Car Hacking dataset and the Survival Analysis dataset are available from the Hacking and Countermeasure Research Lab (https://ocslab.hksecurity.net/Datasets/).

Declarations

Competing interests

The authors declare no competing interests.