Cybersecurity in Intelligent Transportation Systems (ITS): A Comparative Study on AI-Based Anomaly Detection and Threat Analysis

In terms of the transportation industry, automotive industry and its derivatives are turning vehicles from mechanized units into integrated cyber-physical systems. To this end the paradigm shift is being rapidly reinforced by the extensive use of Vehicle-everything (V2X) communication protocols such as vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), vehicle-to-pedestrian (V2P), and vehicle-to-network (V2N) [1], [2]. Built for connected vehicle systems, V2X tools can moderate autonomous operating systems and also improve autonomous driving for more comfort, safety, and energy efficiency. By 2025, the global connected vehicle market will be worth $166 billion. Although such growth is the key opportunity to provide efficiency and safety benefits for transportation, it also brings significant safety problems [3], [4].

Research in the field of connected vehicle safety has gained significant momentum over the past decade. Early demonstrations of remote vehicle exploitation have raised the urgency of automotive cybersecurity on a global scale. Researchers managed to control the vehicle remotely by using a vulnerability in the infotainment system of a Jeep Cherokee; this incident led to the recall of 1.4 million vehicles. Koscher et al. [5] experimentally demonstrated the security vulnerabilities of the in-vehicle Controller Area Network (CAN) bus; it has shown that the absence of authentication and encryption mechanisms poses serious threats. Checkoway et al. [6] have expanded this attack surface to include telematics, Bluetooth, and in-car entertainment systems. Nie et al. documented remote control vulnerabilities with their security analysis on Tesla Model S. Additional security analyses on production vehicles documented remote control vulnerabilities. Their scope of work clearly shows that connected vehicles need multi-layered security mechanisms. Modern connected vehicles include more than 100 Electronic Control Units (ECUs), more than 150 million lines of code, and a large number of wireless interfaces according to recent industry assessments [7]. This complexity significantly expands the attack surface. In-vehicle networks Controller Area Network (CAN), Local Interconnect Network (LIN), FlexRay, Ethernet have traditionally been designed without security in mind, making them vulnerable to modern cyber threats. Although V2X communication standards Dedicated Short-Range Communication/Wireless Access in Vehicular Environments (DSRC/WAVE), Cellular Vehicle-to-Everything (C-V2X) contain security mechanisms, there are vulnerabilities at the application level [8], [9]. Recent automotive cybersecurity assessments highlight a substantial increase in cyber incidents over recent years; this situation highlights the urgency of security solutions [7].

Traditional signature-based intrusion detection systems can only recognize known attack patterns; It is insufficient to detect zero-day attacks and polymorphic threats [10], [11], [12]. These systems require constant updating of attack signatures; it offers a reactive approach in the face of new threats. Machine learning methods have been proposed to overcome these limitations with anomaly detection systems [13], [14]. These different approaches can detect deviations by learning normal behavior systems. However, single-model approaches struggle to deliver consistent performance when faced with different attacks [15]. A particularly high-performance drop has been observed in the detection of low-level attack types (Worms, Shellcode, Backdoor) [16], [17]. The proposed community learning in this study offers a strategy to eliminate the limitations of single model proposals by combining the strengths of different learning paradigms. The success of community approaches is based on the diversity and complementarity of individual models [18]. Bagging [19], boosting [20], [21] and stacking [22] have shown promising results in network attack detection [23], [24], [25]. Gradient boosting decision trees such as XGBoost, LightGBM [26], and CatBoost [27], are among the most influential algorithms in this field. These algorithms correct previous errors in each iteration with sequential tree training; It provides high forecasting performance. On the other hand, TabNet [28] offers interpretable deep learning by adapting attention mechanisms to table data; performs attribute selection dynamically (Figure 1).

Explainable AI (XAI) is a critical component in safety applications, ensuring the transparency of model decisions [29], [30]. With the proliferation of black box models, the need to understand and validate model decisions has increased. SHapley Additive exPlanations (SHAP) calculates feature contributions using Shapley values from game theory [31]. TreeSHAP provides optimized computational power for tree-based models and delivers more accurate values in polynomial time [32]. In security-centric operations (in SOCs), the explainability of machine learning models is an important requirement in terms of prioritizing generated alarms more accurately and quickly (alarm triage), investigating possible proactive attacks (threat hunting), and meeting legal/regulatory requirements [33], [34], [35]. The European Union (EU) General Data Protection Regulation (GDPR) grants the right to explanation in autonomous decision-making systems [36].

The main contributions of the research can be summarized as follows: (1) Unique Hierarchical Classifier-Agnostic Boosted Stacking for Network Intrusion Detection (HCABS-NID) architecture that combines four different learning paradigms (LightGBM, XGBoost, CatBoost, TabNet) in a hierarchical community structure; (2) Improving learning of rare attack types with SMOTENC-based adaptive class balancing; (3) Interpretability of model decisions at global, local, and classroom level with TreeSHAP integration; (4) Evaluation of the reliability of the model under perturbations by adversarial durability analysis; (5) Meeting V2X safety requirements with 3.40ms inference latency. The rest of the article is organized as follows: In the second part, the theoretical foundations of network intrusion detection systems (NIDS) and related studies are discussed comprehensively. The third chapter details the research methodology and experimental design. In the fourth chapter, experimental findings are presented and conclusion and suggestions are summarized in the fifth chapter.

NIDS are security mechanisms which is designed to determine various activities in computer networks. In this section, the historical development of NIDS, machine learning-based applications, community learning paradigms, and explainable artificial intelligence (XAI) concepts are systematically discussed. The existing literature provides the positioning of the current study in the context of connected vehicle safety; reveals research gaps and original contributions.

The conceptual foundations of IDS are based on Anderson [37] work in security threat modeling. Anderson systematically classified threats originating from within and outside; suggested that abnormal user behavior could be detected by statistical methods. Within the scope of the study, he established the theoretical foundations of intrusion detection and guided the research of the following decades. Denning [10] developed the Intrusion Detection Expert System (IDES) model by concretizing these suggestions. IDES uses statistical techniques to create user activity profiles; It marks deviations from normal behavior as anomalies. This approach was the pioneer of anomaly-based attack detection and is still relevant today. The 1990s saw the rise of network-based intrusion detection. Heberlein et al. [38] introduced the concept of network layer monitoring with Network Security Monitor (NSM); this paradigm has formed the basis of today's NIDS architectures. NSM performs protocol analysis by capturing network packets; It looks for known attack patterns. Paxson [39] developed the Bro (now Zeek) network analysis framework, integrating protocol analysis with intrusion detection. Bro allows flexible rule definition with its policy-based detection mechanism. Roesch [40] presented the Snort open source intrusion detection system; This tool is still widely used. Vigna and Kemmerer [41] applied state transition analysis to network security with the NetSTAT system; It has made it possible to detect complex attack scenarios. The Event Monitoring Enabling Responses to Anomalous Live Disturbances (EMERALD) framework also advanced distributed event-correlation for intrusion response [42]. Benchmarking datasets have been critical in standardizing progress in the field. The The KDD Cup 1999 dataset provided the first comprehensive evaluation framework [43]. This study, supported by DARPA, includes 4.9 million network connection records and covers four key attack categories (Denial of Service (DoS), Probe, Remote-to-Local (R2L), User-to-Root (U2R)). However, this dataset has become outdated over time; it has been determined that it contains excess and artificial patterns [44]. When McHugh critiqued the methodological difficulties presented by the datasets, the community and researchers needed new datasets. Though the NSL-KDD dataset partially addressed these shortcomings, it remains inadequate to present conditions in today’s network traffic. The other generated datasets (Canadian Institute for Cybersecurity Intrusion Detection System 2017 (CICIDS2017) [45] and University of New South Wales Network-Based 15 (UNSW-NB15) [46]) are newer and more effective in real-time attacks on current attack types. With high data size and abundant training-test set, they are now recognized as industry standard benchmark datasets used for today's tools. For security research in any location or field where Internet of Things (IoT) devices are used, the Bot-IoT [47] and ToN-IoT [48] datasets are specifically designed (Table 1).

The field of machine learning for intrusion detection dates from the late 1990s when researchers first realised the potential of data-driven methodologies in detecting malicious behaviour on networks [49], [50]. A key contribution was by Lee and Stolfo [51] who showed that data mining techniques — specifically sequential pattern analysis and association rule mining — can be systematically applied on raw network traffic for obtaining meaningful discriminative features. Their work set the stage for an early conceptual understanding that later became a cornerstone for much of the work that followed. When the field matured, Support Vector Machines (SVMs) arose as a popular system that can handle high-dimensional classification tasks [52], [53]. By transforming input features into a higher-dimensional space with the help of kernel functions, SVMs are capable of creating a non-linear decision boundary and generalising nicely in scenarios where labelled training samples are difficult to come by — an attribute of significant practical importance in security domains where attack instances are inherently rare. Decision trees and ensemble methods based on them became quite popular, mainly due to their interpretability and computational tractability, making them attractive for operational deployment [54-56].The Random Forest algorithm, in particular, addressed a well-known limitation of individual decision trees by applying the bagging principle — training multiple trees on bootstrapped subsets of the data and aggregating their predictions — thereby substantially reducing variance without a corresponding increase in bias.Since the mid-2010s, deep learning (DL) approaches have been applied in intrusion detection [57]. Javaid et al. [58] achieved 88.39% accuracy in NSL-KDD on an autonomous system using supervised learning and sparse autoencoders. Related deep-learning IDS studies report consistent gains in real-time settings [59]. Autoencoders learn normal traffic patterns and detect anomalies through reconstruction error. Kim et al. [60] demonstrated the potential of long-short-term memory (LSTM) networks in time-series-based attack detection. LSTM can model sequential network traffic by capturing long-term dependencies; It is especially advantageous in detecting slow attacks. Wang et al. [61] processed with convolutional neural networks (CNN) by converting raw network traffic into visual representations; This approach has achieved over 99% accuracy. Hybrid models combine the strengths of traditional and deep learning approaches [62], [63], [64], [65]. CNN-LSTM hybrid architectures are able to capture spatial and temporal patterns simultaneously.

Transfer learning and pre-trained models constitute a new area of research in attack detection [66], [67]. Zhao et al. performed model transfer between different network environments using domain adaptation techniques. Wu et al. applied the federated learning approach to connected vehicle security. Blockchain-supported federated paradigms have also been explored for autonomous vehicles [68]. Federated learning protects data privacy with decentralized model training; it makes it possible for vehicles to train a common model without sharing their own data. Attention mechanisms are used to dynamically calculate feature importance [69], [70]. These mechanisms automatically learn which features the model should focus on. The basic model architectures and classifications used in network attack detection are explained below:

• Sparse Autoencoder: It is a deep learning-based unsupervised architecture. Learns feature representations compressed by sparsity constraint. It compresses the input data into the bottleneck layer with the encoder and reconstructs it with the decoder. By learning normal traffic patterns, it detects anomalies from reconstruction errors. It is particularly effective in detecting zero-day attacks.

• LSTM: It is a DL-based recurrent neural network (RNN) architecture. It is designed to model long-term temporal dependencies in ordinal data. It includes three gate mechanisms: forget gate, input gate and output gate. It is used to detect temporal patterns and attack sequences in network traffic.

• CNN-LSTM Hybrid: A hybrid approach method which combines the strengths of two deep learning architectures. The CNN component extracts spatial features from used network traffic data. The LSTM component models temporal dependencies in these properties. This combination enhances detection performance by capturing both local patterns and sequential relationships.

• DNN + Feature Selection: It is a combination of Deep Neural Network (DNN) and machine learning-based feature selection methods. Dimension reduction is implemented through methods such as Chi-square, Mutual Information, or Recursive Feature Elimination. Then, classification is done with multi-layer fully connected DNN. This approach allows for a focus on meaningful features while reducing computational cost [71].

• Two-Level Stacking: It is a hierarchical method based on ensemble learning. It is not deep learning, but a meta-learning approach. At the first level, more than one base learner is trained. At the second level, the meta-learner makes the final decision by taking the predictions of the basic learners as input. It reduces variance and improves generalization performance.

• Ensemble Learning: It is a Machine Learning (ML) paradigm that combines the predictions of multiple models. It does not involve deep learning, it uses classical ML models (Random Forest, Gradient Boosting, Support Vector Machine (SVM)). It includes three basic strategies: Bagging (bootstrap aggregating), Boosting (sequential learning), and Stacking (meta-learning). It compensates for the weaknesses of singular models in practice.

• HCABS-NID (This Study): Hierarchical Cross-Attention Based Stacking for Network Intrusion Detection. It is a hybrid community architecture. It uses LightGBM, XGBoost, CatBoost (gradient boosting), and TabNet (attention-based DL) as core learners. It implements two levels of meta-learning: probability calibration with Logistic Regression at Level-1, ultimate incorporation with Gradient Boosting at Level-2. It provides explainability integration with TreeSHAP.

Ensemble learning is a paradigm which combines the predictions of different models to overcome the limitations of singular models. The success of community approaches is based on the diversity and complementarity of individual models [18]. When various models exhibit different error patterns, combining the predictions reduces the overall error. Bagging (Bootstrap Aggregating) combines the predictions of parallel trained models with majority voting or averaging; prevents overfitting by reducing variance [19]. Random Forests provides strong generalization by applying the bagging principle to decision trees and is widely used in network attack detection [25]. Boosting trains models in a sequential manner; Each model focuses on the errors of the previous model. AdaBoost [20] provides iterative improvement by assigning higher weight to misclassified samples. This approach transforms weak learners into a strong community model.

Gradient Boosting [21] produces more powerful models by optimizing the gradient of the loss function. XGBoost improves gradient boosting with regularization terms and parallel computing. The terms L1 and L2 regularization prevent overfitting by controlling model complexity. LightGBM [26] provides computational efficiency with its histogram-based approach and leaf-based growth strategy. The histogram approach reduces memory usage and computational time by dividing continuous values into discrete boxes. CatBoost [27] uses special processing and sequential boosting for categorical features. Sequential boosting improves generalization performance by preventing target leakage. Stacking provides hierarchical aggregation with a meta-learner using the predictions of different models as input [22]. This approach offers the potential to combine the strengths of different learning paradigms. Hierarchical stacking architectures make it possible to learn more complex patterns with multi-layered model fusion. Tama and Rhee [24] achieved 96.2\% accuracy on the UNSW-NB15 with two levels of stacking. Gao et al. [23] addressed the problem of class imbalance with the heterogeneous community model. Lazzarini et al. [72] propose stacking-ensemble deep learning for IoT intrusion detection. Class imbalance is a critical issue in network intrusion detection. Normal traffic is much higher than attack traffic; rare types of attacks are even less represented [17]. This limitation has also been discussed in the literature [73]. This imbalance causes standard machine learning algorithms to gravitate towards the majority class; resulting in low sensitivity for minority classes. SMOTE (Synthetic Minority Over-sampling Technique) reduces this imbalance by producing synthetic samples for minority class samples [74]. SMOTE creates new examples by interpolating between existing minority samples. SMOTENC is the SMOTE variant that provides special handling for categorical attributes; For categorical values, the mode value of the nearest neighbors is used. ADASYN [75] performs adaptive sampling by focusing on hard-to-learn samples. Cost-sensitive learning deals with misclassification costs in an asymmetrical way [76] (Table 2).

The data preprocessing pipeline was implemented with the following steps: (1) Categorical attributes (protocol_type, service, state) were converted to numeric values by label encoding and categorical indexes were recorded. (2) The dataset was divided into stratified at the rate of 70% training and 30% testing. (3) SMOTENC was applied only to the training set, categorical indices were passed as parameters. (4) The required features after sampling were expanded with one-hot encoding and scaled with RobustScaler. No sampling or conversion was applied to the test set; only the parameters learned from the training set were used. The relevant approach prevents data leakage [17]. The effectiveness of this strategy is also supported in prior studies [74] (Table 3).

XAI is a set of methods that ensure human interpretability of model decisions [29], [30]. As the complexity of machine learning models increases, it becomes more difficult to understand and assess the reliability of decisions. Deep learning models, in particular, can contain millions of parameters, and decision processes remain opaque in many practical settings. XAI addresses this black box issue to enhance model transparency; It ensures that stakeholders have confidence in the model. Model-agnostic methods can be applied to any ML model. Local Interpretable Model-agnostic Explanations (LIME) explains individual predictions with locally interpretable models [77]. LIME trains a simple model (usually linear regression) by creating perturbation samples around the prediction point. Permutation significance analysis measures the change in model performance by random shuffling of features [54]. Complementary feature-importance analyses are also discussed in [78].

SHAP calculates feature contributions using Shapley values from game theory [31]. Shapley values fairly distribute the marginal contribution of each player in coalition games; This mathematical basis guarantees the consistency of the explanations. This approach is the only method that provides local accuracy, consistency, and missingness. Local accuracy means that the sum of the explanation is equal to the actual estimate; consistency refers to the logical change in feature importance in model changes; Deficiency guarantees that missing attributes receive zero contributions. TreeSHAP offers optimized SHAP computation for tree-based models, ensuring precise values in polynomial time [32]. While traditional SHAP computation has exponential complexity, TreeSHAP leverages tree structure to perform efficient computation. KernelSHAP uses a sampling-based approach for model-agnostic computation. DeepSHAP provides gradient-based SHAP computation for deep learning models. In security applications requiring regulatory compliance, explainability, alarm triage, and threat hunting are crucial. Analysts in SOC centers face thousands of alarms daily and explainable models are key to prioritizing these alarms. Model explanations enhance security teams by minimizing the false positive rate. This is allowing analysts to concentrate on real-time events. And to this point, the EU GDPR upholds the right to explanation in autonomous decision-making systems [36]. Article 22 of the regulation requires that individuals have the right not to be subject to decisions based solely on automated processing. This has made algorithm transparency a legal obligation. Transparency of models has now become a legal requirement in healthcare, financial services, and critical infrastructure sectors.

V2X communication systems are exposed to numerous different security threats [79], [80]. These threats can be addressed in terms of confidentiality, integrity, and availability. This triad forms the fundamental principles of information security. In autonomous driving contexts, the SAE J3016 taxonomy also assists in defining operational scenarios and risk boundaries [81]. Authentication attacks (Sybil attacks) threaten network security by creating fake vehicle identities [82], By creating multiple fake identities, an attacker can spread misleading information about traffic volume, which may cause drivers to make incorrect route choices and vehicles to malfunction. Denial-of-service (DoS) attacks overload communication channels, causing service interruptions [3]. In V2X services, DoS attacks can prevent the transmission of security messages, causing vehicles to crash. Message forgery and tampering attacks can manipulate critical security messages, creating dangerous situations. An example of this is fake brake warning messages, which can cause sudden braking and chain collisions.

Vehicle tracking data and data traffic as a way of privacy attack violate drivers’ privacy [83]. V2X messages contain information such as vehicle location, speed, and direction, and combining these data may reveal individuals’ movement patterns. Transmission attacks experienced in data transfer cause communication to be repeated, creating a false sense of security. Physical network layer attacks directly target wireless signals with jamming or spoofing. They can manipulate vehicle location (GPS) information to mislead navigation systems. In-vehicle network security is an important aspect of V2X security. GAN-based intrusion detection approaches have also been investigated for in-vehicle networks [84]. The CAN protocol was designed in the 1980s and was not developed with security in mind; it lacks authentication and encryption mechanisms [5], [6]. The corresponding situation allows any ECU to send fraudulent messages over the network. In-car entertainment systems (infotainment) create a remote attack surface [6]. These systems communicate with the outside world via internet connection, Bluetooth and USB interfaces; vulnerabilities can provide access to critical vehicle systems. Diagnostic port (OBD-II) access offers a physical attack vector; direct access to vehicle ECUs is possible through this port. Wireless switch systems are vulnerable to relay attacks [85]. By relaying the key signal, attackers can remotely unlock and steal vehicles. Autonomous driving systems may be vulnerable to manipulative sensor spoofing attacks [86]. LiDAR, radar, and camera sensors may be blinded by hostile attacks. This could cause autonomous vehicles to make incorrect movements and decisions.

With the structure provided by the HCABS-NID framework, the design of the framework is organized as follows. The research method is outlined with four interdependent phase processes that form an overall experimental pipeline as follows: (i) dataset selection and preprocessing, encompassing class imbalance mitigation through SMOTENC-based adaptive resampling; (ii) hierarchical ensemble architecture design, integrating four heterogeneous base learners within a two-level meta-learning framework; (iii) training strategy, employing stratified k-fold cross-validation with out-of-fold prediction generation to prevent data leakage; and (iv) evaluation criteria, utilizing a multi-metric assessment protocol that combines threshold-dependent, threshold-independent, and chance-corrected measures. The process for each step has been explained adequately for full replication of the experimental pipeline, and the design aspects are justified with reference to the established methodological principles and the specific characteristics of real-time V2X intrusion detection. The overarching goal is to strike a balance between the best predictive performance, computational feasibility, and model interpretability—three needs often only discussed in isolation in the existing literature and at the same time to be addressed in the proposed framework.

The UNSW-NB15 dataset is used to build this study's evaluation framework [46]. This dataset is created by the Australian Cyber Security Centre (ACCS) via the IXIA PerfectStorm tool. It has normal traffic and nine types of attacks (Fuzzers, Analysis, Backdoor, DoS, Exploits, Generic, Reconnaissance, Shellcode, Worms). All in all 2,540,044 records and 49 attributes. There are flow attributes, basic attributes, content attributes, temporal attributes, and additional attributes. Abnormal IoT activity data set creation schemes provide complementary guidance for producing realistic evaluation data [87]. The training set contains 175,341 records and the test set contains 82,332 records [88]. This separation ensures the reliability of model evaluation.

In the data preprocessing phase, a systematic approach was followed. The missing values are filled with median substitution for each attribute; This method provides resilience against outliers and has minimal impact on data distribution. Categorical attributes (proto, service, state) have been transformed by one-hot coding; This transformation allows categorical information to be processed by numerical models. Numeric attributes are scaled using RobustScaler; this method uses median and interquartile range (IQR) to reduce the impact of outliers and produce more reliable results compared to standard scaling. Recursive Feature Elimination with Cross-Validation (RFECV) has been applied for attribute selection; 42 features were determined as optimal. Correlation analysis was performed to detect the problem of multiple linear dependencies; One of the feature pairs with a correlation of over 0.95 has been removed (Figure 2).

The problem of class imbalance has been addressed with the Synthetic Minority Over-sampling Technique for Nominal and Continuous (SMOTENC) algorithm [74]. SMOTENC is the SMOTE variant that provides special handling for categorical attributes; For categorical values, the mode value of the nearest neighbors is used. When producing synthetic samples for minority classes, the nearest neighbor parameter k = 5 was used. Synthetic samples are created by interpolating between existing minority samples. The majority class was balanced by sub-sampling; random sub-sampling strategy was applied. The sampling strategy aimed for rare attack types (Worms: 174, Shellcode: 1,511, Backdoor: 2,329) to reach at least 5,000 instances. After balancing, the total training cluster size reached 250,000 samples (Table 4).

Hierarchical Classifier-Agnostic Boosted Stacking for Network Intrusion Detection (HCABS-NID) is a hierarchical ensemble architecture that includes four basic learners and two levels of meta-learners. Core learners represent different learning paradigms: LightGBM [26], XGBoost, CatBoost [27], and TabNet [28]. This diversity increases the generalization capacity of the community model; enables the capture of different data patterns [18]. Each core learner has unique strengths and generates complementary predictions. This heterogeneity ensures that ensemble performance exceeds individual model performances. The first-level meta-learner produces combined predictions by taking the soft predictions of the basic learners as input. Each basic learner deduces probability vectors for 10 classes; A total of 40 dimensional feature vectors are formed. Logistic regression was chosen as the first-level meta-learner; This choice offers advantages in preventing overfitting and interpretability. Model complexity is controlled by applying L2 regularization ($C$ = 1.0). The second-level meta-learner performs final predictions using the first-level outputs and a subset of the original features (the 20 most important features). Gradient boosting was used as a second-level meta-learner; This choice offers the capacity to capture non-linear relationships (Figure 3).

LightGBM is a histogram-based gradient boosting algorithm with leaf-wise growth approach [26]. This method converges faster and uses less memory than level-wise growth. It uses a histogram approach to partition continuous inputs into discrete boxes and increases computational efficiency, which is quite advantageous in large datasets. Hyperparameters: num\_leaves = 63, max_depth = 10, learning_rate = 0.05, n_estimators = 500, min_child_samples = 20, feature_fraction = 0.8, bagging_fraction = 0.8. XGBoost uses gradient boosting with L1 and L2 regularization. Regularization terms help avoid overfitting by penalizing models with more complexity. Hyperparameters: max_depth = 8, learning_rate = 0.05, n_estimators = 500, reg_alpha = 0.1, reg_lambda = 1.0, colsample_bytree = 0.8. CatBoost uses special processing and ordered boosting for categorical attributes [27]. Sequential boosting improves generalization performance by preventing target leakage. Instead of target encoding for categorical attributes, statistics based on sampling order are calculated; This approach reduces overfit. Hyperparameters: depth = 8, learning_rate = 0.05, iterations = 500, l2_leaf_reg = 3, random_strength = 1. TabNet is an interpretable deep learning architecture that performs feature selection by sequential attention mechanism [28]. The sparse attention mechanism selects different subsets of features at each step; This feature provides interpretability. Hyperparameters: n_d = 64, n_a = 64, n_steps = 5, gamma = 1.5, lambda_sparse = 0.001, momentum = 0.02.

Model training was carried out using Stratified K-Fold Cross-Validation. Stratified sampling ensures that the class distribution remains close to the original distribution on each floor; This feature is critical for imbalanced datasets. Basic learners generate out-of-fold predictions during cross-validation; These predictions are used for meta-learner training. This approach provides reliable performance estimation by preventing data leakage [22], [24]. The test set was not used in the model selection process; reserved for final consideration only. This distinction avoids the optimistic bias of performance estimates. Early stopping was implemented to prevent overfitting [89]. If the validation loss does not improve for 50 iterations, the training is terminated. This strategy automatically determines the optimal number of iterations; It avoids unnecessary computational costs and reduces the risk of overfitting. Learning rate scheduling provides rapid convergence by using a high learning rate at the beginning; It decreases the learning rate as education progresses. The cosine annealing strategy allows to avoid local minibuses by periodically decreasing and increasing the learning rate. Gradient clipping is applied to prevent gradient explosion; The maximum gradient norm is set at 1.0.

TreeSHAP provides optimized SHAP value calculation for tree-based models [32]. Although conventional SHAP calculation has a complexity of $\mathrm{O}\left(\mathrm{TL} \cdot 2^{\wedge} \mathrm{M}\right)$, TreeSHAP achieves accurate values in polynomial time, with complexity expressed as $\mathrm{O}\left(\mathrm{TLD}^2\right)$, where $T$ represents the number of trees, $L$ denotes the number of leaves, $M$ stands for the number of attributes, and $D$ indicates the maximum depth. This makes it feasible for practical computation on large-scale datasets as well as ensemble models. By leveraging the tree structure, it effectively identifies every feature coalition, allowing for real-time annotation formation.

TreeSHAP in the HCABS-NID architecture provides multiple levels of explainability. Global feature significance is computed according to average absolute SHAP values across the entire dataset, revealing the best features in general and guiding feature engineering research. Local descriptions describe what features contributed to individual estimates; for each prediction, it identifies which attributes drive the chosen decision, helping facilitate alarm triage for security analysts. Class-level analyses distinguish features for each attack type, with patterns specific to the attack type used to aid in threat hunting activities. The visual descriptions are represented by force plots, waterfall plots, and summary plots.

The performance of the proposed HCABS-NID architecture was evaluated by utilizing a well-organised and methodologically robust set of classification metrics selected to solve the specific evaluation task posed by multi-class network intrusion detection with class imbalance. In the following notation, True Positives (TP), True Negatives (TN), False Positives (FP), and False Negatives (FN) stand for true positives, true negatives, false positives, and false negatives. Accuracy was the main global performance measure; however, in an imbalanced attack detection environment, where normal traffic is the majority class, accuracy alone may overestimate model effectiveness by masking poor detection of minority attack classes. Precision and recall provided a subtler picture of detection capability, where precision and recall could be used as complementary metrics. Precision quantifies the fraction of attacks that are correctly detected versus positive predictions, closely tracking the ability of the model to reduce false alarms—an imperative for Security Operations Centers, where the overreliance on false positives can create alert fatigue and hamper analyst agility. On the other hand, recall quantifies the proportion of actual attacks detected correctly, and the effectiveness of the model to minimize missed intrusions, an error threshold with potential threats to security in V2X environments. To balance these competing goals under conditions of class imbalance, the F1-score used here was defined as the harmonic mean of precision and recall, and thus it was adopted as the primary balanced metric.

As the UNSW-NB15 dataset has nine classes of attacks and normal traffic, macro-averaged and microaveraged versions of all metrics were reported to provide clear evaluation visibility into the system performance. Macro-averaging places equal weight on all the classes, independent of their respective frequency, thus making the detection of underrepresented attack types, such as Worms and Shellcode, a priority given that these classes are often penalized via frequency-weighted schemes. In contrast, micro-averaging aggregates the impact of each instance, prior to determining the metric, to achieve naturally weighted class prevalence results - overall systemlevel performance, essentially. Threshold-independent evaluation was performed based on the Area Under the Receiver Operating Characteristic Curve (ROC-AUC) through a One-vs-Rest (OvR) approach that yields a separate ROC curve for each class. Although ROC-AUC provides a reliable estimate of discriminative potential over all decision levels, it can produce optimistically distorted values when class imbalances are severe because true negatives dominate in the false positive rate denominator. To alleviate this limitation, the Precision-Recall AUC (PR-AUC) was also indicated, since PR-AUC is more sensitive to minority class detection performance and offers a conservative evaluation of the model under imbalanced conditions. Lastly, two chance-correction measures complement the threshold-based and threshold-independent measures stated above. Cohen's Kappa ( $\kappa$ ) measures observed agreement ($p\_o$) by the level of agreement expected by chance ($p\_e$), and allows us to quantify classification performance greater than what the random assignment would produce. Thus the Matthews Correlation Coefficient (MCC) combines the four elements of the confusion matrix to yield a balanced score from $-$1 (complete misclassification) to 0 (random prediction) to $+$1 (perfect classification). Unlike accuracy, MCC is still informative even under extreme class distribution skew and is therefore a highly dependable single-score summary measure when evaluating intrusion detection mechanisms having an attack frequency that varies several orders of magnitude apart.

In this section, we present the experimental results gained from the optimization of the proposed HCABS-NID architecture in the held-out set of UNSW-NB15 test, which was excluded from training and model selection in order to achieve an unbiased assessment. The evaluation is undertaken in six separate and complementary subsections as a multi-faceted analytical framework. Section 4.1 reports the overall performance metrics—accuracy, macro-averaged F1-score, ROC-AUC, Cohen’s Kappa, and MCC—together with a cross‐validation stability analysis that provides the overall generalization ability. Section 4.2 class-level disaggregation of these findings analyzes detection performance in all nine attack classes but focuses on the rare attack types with the most difficulty from class imbalance. Section 4.3 compares HCABS-NID with single-model and ensemble based approaches obtained from literature, showing evidence by statistical significance tests (McNemar, Wilcoxon signed-rank) and effect size analysis, which prove that the observed enhancement is not due to random variability. Section 4.4 assesses the computational efficiency (in terms of inference latency, throughput, and memory footprint) of this method and then situates that metrics within the real-time, safety-sensitive conditions of V2X applications. Section 4.5 uses TreeSHAP explainability analysis to interpret the model reasoning: the method of decision-making by the model on a global, local, and class-level to extract the discriminative network traffic features in attack detection. Finally, Section 4.6 compares adversarial resilience in gradient perturbation through Fast Gradient Sign Method (FGSM) and PGD attacks. The results are accompanied by 95% confidence intervals and cross-validation variance estimates on all analyses.

The HCABS-NID model achieved 98.20% accuracy, 97.10% F1-score (macro-mean), ROC-AUC of 0.989, and Cohen’s Kappa values of 0.976 on the UNSW-NB15 test set. The results obtained exceed the best performances in the existing literature and confirm the effectiveness of the hierarchical community approach. The 5-fold cross-validation shows that the model exhibits consistent performance; standard deviation values remain below 0.3%. This low variance confirms that the model produces reliable results across different subsets of data and is resilient to overfitting. MCC is calculated as 0.971; This value confirms the balanced classification performance and shows that the effect of class imbalance is under control. 95% confidence intervals confirm that the results are statistically significant (Table 5) (Figure 4}).

Class-wise analysis reveals the model's performance for different types of attacks. The normal traffic class performs the most, with 99.1% accuracy and 99.3% sensitivity; This result shows that the model correctly recognizes legitimate traffic and provides a low false positive rate. Generic and Exploits attacks achieve F1-score values of 98.5% and 97.8%, respectively; High performance is expected because these attack types have sufficient representation in the dataset. Although performance degradation is observed in rare attack types, the values remain at acceptable levels: Worms 91.2%, Shellcode 93.5%, Backdoor 94.1% F1-score. The results show that SMOTENC sampling provides benefits for rare classes and significantly alleviates the problem of class imbalance, as demonstrated in Table 6, Figure 5. The normalized complexity matrix with class metrics is shown in Figure 6: diagonal elements represent correct classification ratios (recall/sensitivity), while non-diagonal elements show incorrect classification patterns. On the right panel, Precision (P), Recall (R), and F1-Score values are reported for each class.

HCABS-NID has been compared with methods in the existing literature. The comparison includes both single-model approaches [58], [59], [60] and community methods [24] and [72]. All methods were evaluated on the same dataset (UNSW-NB15); Results are from original publications. HCABS-NID outperforms all benchmarking methods. The accuracy increase reaches 1.75% points compared to the nearest competitor [72] (96.45%). F1-score improvement is more pronounced in rare attack types; An increase of 8.3% was observed in the Worms class. The ROC-AUC value exhibits the highest performance with 0.989; This result confirms that the model performs reliably at different thresholds (Table 7).

Statistical significance tests confirm that performance differences are not due to random variability. The McNemar test shows that the difference between HCABS-NID and the closest competitor is statistically significant at the level of p < 0.001. The Wilcoxon signed-rank test confirms consistent superiority over cross-validation folds. Cohen's d effect size was calculated as 0.82; This value corresponds to the large effect size. The results obtained show that the performance advantage of HCABS-NID is of practical importance.

The computational efficiency of HCABS-NID is critical for V2X security applications. The mean inference time was measured as 3.40 ms; this value is below the threshold of approximately 10-100 ms required by V2X safety standards [3]. The DSRC and C-V2X standards require security messages to be processed within the range of approximately 10–100 ms [3]; HCABS-NID meets this requirement. Real-time sensor anomaly detection studies in automated vehicles also emphasize low-latency decision loops [90]. Training time was recorded as 4 hours and 23 minutes on NVIDIA RTX 3090 GPU. The model size is 847 MB, including four basic learners and two meta-learners. Memory usage measured at 2.1 GB at inference; This value is acceptable for modern in-car computers. Throughput achieves a processing capacity of 294 samples per second; This capacity provides sufficient performance in heavy network traffic scenarios (Table 8).

When the individual inference times of the basic learners were examined, LightGBM was measured as 0.8 ms, XGBoost as 1.1 ms, CatBoost as 0.9 ms, and TabNet as 0.6 ms. Meta-learners add an additional 0.4 ms total time. With parallel inference optimization, the total time can be further reduced; however, the current performance meets V2X requirements. When model compression techniques (pruning, quantization) are applied, it has been observed that inference time can be reduced to around 1.8 ms with an estimated performance trade-off.

The TreeSHAP analysis explains the decision-making mechanisms of the model. In the global attribute importance ranking, sbytes (source bytes), dbytes (destination bytes), sttl (source TTL), and ct_state_ttl (connection state TTL) have the highest SHAP values. These attributes reflect the basic characteristics of network traffic. The sbytes attribute represents the amount of data sent; It plays a critical role in detecting DoS and data exfiltration attacks. The STTL attribute indicates the package lifetime; This value may reflect the default configurations of attack tools. Protocol and service type attributes play a critical role in attack type differentiation; shows that certain attacks are associated with specific protocols (Figure 7).

Explainable features in class-level analysis show distinct characteristics of each of the attack types. DoS attacks include a high sbytes and a low dbytes; These patterns represent the traffic being primarily one-way and indicative of the target being overloaded. Reconnaissance attacks are characterized by low packet size and high number of connections; This is representative of the characteristic behaviour of discovery traffic with port scanning and network mapping. Backdoor attacks show abnormal service port usage and low TTL values, which are similar to latent communication channels. Security analysts use these insights to help them with their threat hunting. They speed up the alarm triage process and reduce the false positive rate.

For adversarial robustness, we investigated the model in the FGSM and Projected Gradient Descent (PGD) attacks, which are two popular gradient-based perturbation strategies applied to produce misclassification through imperceptibly small perturbations in the input feature space. The performance was high, it returned 97.8% of classification accuracy, which means the model is generally resistant to low-intensity noise. Further perturbation increased to 5% had a slight reduced accuracy of 96.8%, indicating some performance degradation but it is still acceptable in practice. On the other hand, at 10% accuracy was still 94.2% indicating a much more extreme sensitivity to this large size feature distortion, confirming the practical limits of the adversary tolerance we propose at the moment. These results collectively provide evidence showing that HCABS-NID has reasonable adversarial durability under conditions of a wide range of perturbation (e.g., high energy and fine noise), but also an observable vulnerability at severe distortion, still worth further attention. Therefore, adversarial training and input sanitisation as candidate defence mechanisms of the framework with the ability to resist higher-order attack regimes should be explored in future works.

But one fundamental methodological limitation needs to be explicitly acknowledged. Gradient-based adversarial evaluation was limited to the TabNet part, as gradient boosting models — LightGBM, XGBoost and CatBoost — are non-differentiable and hence cannot be directly attacked by FGSM or PGD. Such architectural variation implies that the adversarial resilience presented here is a partial white-box scenario and not a full-system assessment. To get a comprehensive view of ensemble-level vulnerability, future studies can extend the evaluation to gradient-free attack methods, such as Zeroth-Order Optimisation (ZOO) [91] and Simultaneous Perturbation Stochastic Approximation (SPSA) [92], which operate without access to model gradients and are thus applicable to the boosting components.

HCABS-NID (Hierarchical Classifier-Agnostic Boosted Stacking for Network Intrusion Detection) deals with network-based attack and anomaly detection issues in the context of connected vehicle ecosystems. It combines LightGBM, XGBoost, CatBoost, and TabNet into a hierarchical stacking framework built without sacrificing interpretability for predictive power. The integration of TreeSHAP allows explainability at the global and local scale — security teams now know what makes certain alerts trigger, so they can be triaged more efficiently. The results from experiments on UNSW-NB15 are instructive: 98.20\% accuracy, 97.10\% F1-score, and 0.989 ROC-AUC. These numbers exceed most other benchmarks reported in the literature. The two-tier meta-learner design is responsible for their achievement. To mitigate overfitting there is logistic regression at the first level which combines base learner outputs in a single linear manner. Second stage, gradient boosting detects non-linear interactions that the simplest models simply fail to capture. Real world deployments also appear feasible, with average inference latency being just 3.40 ms—within V2X security requirements.

However, as it was developed in the UNSW-NB15 laboratory environment, limitations can impact generalizability. It may not fully reflect real-world V2X traffic dynamics. The lack of connected vehicle specific datasets is a key limitation. Rare attack types show long-term consequences of class imbalance with an immediate observed performance drop. While SMOTENC algorithms mitigate this problem, attacks simulated with synthetic samples cannot fully capture the diversity of attacks encountered in the real world. Additionally, robustness has been assessed in limited perturbation scenarios conducted by cyber adversaries. The model size (847 MB) may prevent its use in vehicle-based environments with limited resources due to hardware limitations and dataset constraints.

Going forward, there are a number of lines of communication worth paying attention to. Better V2X datasets will still be needed—combining Combining Simulation of Urban MObility (SUMO) and Vehicles in Network Simulation (VEINS) simulations with empirical data from test tracks or live deployments would allow us to capture real-world complexity much more faithfully. simulations with empirical data from test tracks or live deployments would allow us to capture real-world complexity much more faithfully. There are also needs for rare-class detection, such as cost-sensitive learning, focal loss [93], and few-shot methods that generalize from small samples. Privacy-preserving decentralized training via federated learning [68] could alleviate some data sharing concerns but will necessitate aggressive model compression via pruning, quantization, and knowledge distillation for practical deployment. This is where strong defenses to inference attacks matter as well. Automotive cybersecurity becomes increasingly important as technology continues to evolve as V2X networks spread and HCABS-NID offers both researchers and practitioners a workable foundation for securing next-generation transportation systems.