An Autoencoder and Double Random Forest-Based Intrusion Detection System for Unknown Attack Defense

With the rapid advancement of technology and the growing prevalence of connected vehicle architectures, security concerns in vehicle networks have become increasingly critical, the vehicles are high-value assets. Thus, unauthorized intrusions can pose substantial financial and safety risks. Although many researchers have employed deep learning techniques for vehicle network intrusion detection, existing methods often struggle to efficiently extract network traffic features and handle unknown or evolving malicious attacks. In this paper, we propose a novel Internet of Vehicles intrusion detection system (IDS) that combines an autoencoder (AE) with a double random forest (DRF). Our two-layer architecture is designed to accurately distinguish between unknown attacks, known attacks, and normal traffic. We evaluated the performance of the proposed DRF algorithm against six traditional machine learning and deep learning methods and compared it with relevant state-of-the-art solutions. The experimental results demonstrate that our method outperforms existing approaches.