As the Internet of Vehicles (IoV) rapidly gains popularity, the Controller Area Network (CAN) faces increasingly severe security threats. Most of the existing research on protecting the CAN bus has been based on artificial intelligence models, which require complex feature extraction and training processes and are too resource-intensive for deployment in resource-constrained CAN environments. To address these challenges, we propose a lightweight intrusion detection system based on locality-sensitive hashing that achieves efficient security protection without relying on complex machine learning and deep learning frameworks. We employ the Nilsimsa algorithm to compute hash digests of the data, using the similarity scores of these digests as anomaly scores to identify abnormal traffic. Evaluations show that our method achieves an accuracy of 98%, and tests of the system’s overhead confirm its suitability for deployment in resource-limited CAN scenarios.

Out-of-distribution (OOD) detection is critical for securing Internet of Things (IoT) systems, particularly in applications such as intrusion detection and device identification. However, conventional classification-based approaches struggle in IoT environments due to challenges like large class numbers and data imbalance. To address these limitations, we propose a novel framework that combines class mean clustering and a group-level feature distance loss to optimize both intra-group compactness and inter-group separability. Our framework utilizes Mahalanobis distance for robust OOD scoring and Kernel density estimation (KDE) for adaptive threshold selection, enabling precise boundary estimation under varying data distributions. Experimental results on real-world IoT datasets show that our framework outperforms baseline techniques, achieving at least a 10% improvement in AUROC and a 33% reduction in FPR95, demonstrating its scalability and effectiveness in complex, imbalanced IoT scenarios.

Traffic fingerprint was considered an effective security protection mechanism in IoT scenarios because it can be used to automatically identify accessed devices. However, the results of replication experiments show that the classic traffic fingerprints based on simple network traffic attribute features have a significantly lower ability to identify accessed devices in real 5G IoT scenarios compared to what was stated in traditional IoT scenarios. The growing homogenization of IoT traffic caused by the application of 5G is believed to be the reason for the poor ability of traditional traffic fingerprints to identify 5G IoT terminals. Studying an enhanced traffic fingerprint is necessary to accommodate the homogeneous Internet of Things traffic. In addition, during the reproducing experiments, we noticed that the solution of overlap is a key factor that restricts the recognition ability of one-vs-all multi-classifiers, and the efficiency of existing methods still has some room for optimization. Based on targeted improvements to these two issues, we proposed an enhanced IoT terminal traffic fingerprint based on packet payload transition patterns to improve the device recognition ability in homogeneous IoT traffic. Additionally, we designed an improved solution for overlap based on density centers to expedite decision making. According to the experimental results, when compared with the existing traffic fingerprint, the proposed traffic fingerprint in this study demonstrated a Macro-Average Precision of close to 90% for network traffic from real 5G IoT terminals. The proposed overlap solution based on the density centers reduced the decision-making time from hundreds of seconds to tens of seconds while ensuring decision-making accuracy.