In-Vehicle CAN Intrusion Detection With Lightweight Ensemble Models

The patent segments the intrusion detection task into two distinct phases: an offline training phase that uses deep learning methods to build comprehensive detection models, and an online detection phase that employs lightweight inference algorithms. This segmentation allows the system to leverage the high accuracy of deep learning during training while minimizing computation costs during real-time operation in resource-constrained in-vehicle environments.

The patent performs preliminary action by pre-training deep learning models offline using extensive datasets and computational resources. The trained models are then deployed to in-vehicle systems where they perform lightweight inference. This preliminary training phase captures complex attack patterns beforehand, enabling efficient real-time detection without requiring heavy computation during actual intrusion detection in the vehicle.

The patent merges multiple machine learning algorithms (Random Forest, XGBoost, LightGBM) into an ensemble system that leverages the strengths of each individual algorithm. By combining these models, the system achieves higher detection accuracy than any single algorithm could provide alone, while maintaining computational efficiency through optimized inference processes suitable for in-vehicle environments.

The patent creates a composite detection system that integrates multiple algorithmic 'materials' with different properties. Each machine learning algorithm contributes unique detection capabilities, and their combination forms a robust composite model that achieves high accuracy while maintaining computational efficiency. This composite approach allows the system to benefit from diverse detection strategies simultaneously.

The patent extracts and selects only the most discriminative features from a large pool of potential features using feature importance analysis and selection algorithms. This extraction process identifies and retains the critical features that contribute most to detection accuracy while discarding redundant or less informative features, thereby reducing model complexity without significantly compromising detection performance.

The patent applies local quality by assigning different weights and importance levels to different features based on their discriminatory power. Rather than treating all features uniformly, the system identifies specific high-value features that are locally optimal for detecting particular types of intrusions, creating a more efficient and less complex model structure that focuses computational resources on the most informative features.