Exploring adaptive machine learning applications in edge-IDS for vehicular systems

Lorente Lemoine, Loic 2025. Exploring adaptive machine learning applications in edge-IDS for vehicular systems. PhD Thesis, Cardiff University. Item availability restricted.

Preview	PDF - Accepted Post-Print Version Available under License Creative Commons Attribution Non-commercial No Derivatives. Download (67MB) | Preview
	PDF (Cardiff University Electronic Publication Form) - Supplemental Material Restricted to Repository staff only Download (267kB) | Request a copy

Abstract

Replacing the eras of horse-drawn carriages, vehicles have shaped the way today’s world operates. From planes, that enable frequent continental and international travel, to consumer cars, which provide city and cross-country transportation for employment or leisure commuting. However, the introduction of electronic hardware and corresponding software into vehicles has created cybersecurity risks. This is observed in decades-old technology, such as the defense-less CAN bus, as well as newer EV infrastructure protocols. The resulting social and economic threats are ever more prominent when considering the volume, cost, and dangers of vehicles. As the latency- and resource-constrained vehicular environments limit the applicable security techniques, machine learning has risen as an effective method for defending the CAN. However, diverged data over time, which may be derived from different drivers, road types, or unseen attacks, can impact model performance in various use cases. Additionally, existing solutions may require support from external computation, such as cloud infrastructure, for inference and adaptation, which introduces additional communication latency. Additionally, such connectivity cannot be assumed given the mobility and longevity of vehicles. To address this, this thesis explores edge-based intrusion detection with adaptive methods for vehicular networks. Initially, continual learning on EV infrastructure is presented, where a reverse autoencoder learns to reconstruct a new attack while maintaining reliable initial-task performance. This then platforms the main contribution of Tiny Machine Learning and Tiny Online Learning for the CAN bus. Individually trained and evaluated on three CAN IDs, the models demonstrate reliable attack detection with the main fully-connected model achieving F1-scores of 0.993, 0.984, and 0.975 respectively. The online learning method is evaluated locally with an early-stage model, where output-only updates enable improvements over time, such as a peak F1-score increase of 0.04, while deployed computation times present a viable system for in-vehicle use. Lastly, a test-rig provides further insights into model quality

Item Type:	Thesis (PhD)
Date Type:	Completion
Status:	Unpublished
Schools:	Schools > Computer Science & Informatics
Subjects:	Q Science > QA Mathematics > QA75 Electronic computers. Computer science Q Science > QA Mathematics > QA76 Computer software
Funders:	Thales Group
Date of First Compliant Deposit:	9 February 2026
Date of Acceptance:	6 January 2026
Last Modified:	09 Feb 2026 13:54
URI:	https://orca.cardiff.ac.uk/id/eprint/184547

Actions (repository staff only)

Edit Item