A Stochastic Prototypical Network for Few-Shot Intrusion Detection in CAN-Based IoV Network

The Controller Area Network (CAN) acts as the backbone of intra-vehicle communication in modern Internet of Vehicles (IoV) systems, enabling real-time coordination among critical automotive subsystems. Despite its widespread adoption, CAN lacks essential security mechanisms such as encryption and message authentication, rendering it highly vulnerable to cyberattacks that can jeopardize vehicle safety and operational integrity. Developing an effective Few-Shot Learning (FSL)-based Intrusion Detection System (IDS) for CAN networks presents challenges due to data scarcity, noisy traffic, dynamic attack patterns, and the need for real-time efficiency. Existing FSL approaches often rely on deterministic models that struggle to capture the uncertainty and variability inherent in CAN network traffic. To address these challenges, we propose a Stochastic Prototypical Network based on a Random Neural Network (RaNN) for few-shot intrusion detection in CAN-based networks. RaNNs are inherently stochastic, enabling them to model uncertainty and variability in network traffic. By integrating RaNN with the prototypical network, the proposed framework computes stochastic prototypes that represent the distribution of normal and attack behaviors, improving robustness in noisy and dynamic environments. Additionally, the framework quantifies uncertainty in its predictions, enabling the system to flag ambiguous cases for further analysis, thereby reducing the risk of both false positives and negatives. The proposed approach demonstrates high classification performance across all FSL scenarios, achieving a maximum accuracy of 99.17% in a 15-shot configuration. The framework shows impressive computational efficiency with millisecond inference times and minimal training overhead, making it suitable for real-time deployment.