Under the development of intelligent transportation systems, In-Vehicle Networks (IVNs) serve as a critical channel for both internal and external communications. However, the inherent complexity and diversity of data traffic present significant challenges for the detection of IVN anomalous flows. Meanwhile, the introduction of various novel technologies has introduced new security vulnerabilities to IVNs. These vulnerabilities significantly impact the security of IVNs and the accuracy of in-vehicle Intrusion Detection Systems (IDS). To address these issues, this paper proposes a lightweight and efficient anomaly detection method based on knowledge distillation technology, termed Knowledge Distillation from BERT to CNN-BiLSTM (KDBC). Specifically, the KDBC distills the deep semantic knowledge from the BERT model into a more lightweight CNN-BiLSTM architecture, significantly reducing computational overhead and storage requirements without substantially compromising detection performance. Experimental results demonstrate that the KDBC model enhances both security and versatility, achieving superior detection accuracy in identifying abnormal attacks across diverse IVN data, including automotive Ethernet and CAN networks. Moreover, the KDBC model has been validated for its effectiveness and robustness in actual in-vehicle gateway environments, achieving an accuracy of over 0.98 and an F1 score greater than 0.98.

With the increasing intelligence and convenience of modern vehicles, Internet-of-Vehicle (IoV) technology plays a pivotal role in driving these advancements. While IoV enhances user services, it also introduces security threats, particularly intrusions into the In-Vehicle Network (IVN). Attackers can exploit onboard external network interfaces, posing risks to vehicle safety and operation. Besides, deploying an Intrusion Detection System (IDS) on vehicles with limited computational resources exacerbates the computational burden. To address these challenges, this paper proposes a Cloud Collaborative-based Intrusion Detection and Prevention System (CC-IDPS). Firstly, this study analyzes existing in-vehicle intrusion detection datasets and, combined with real in-vehicle/simulation data, constructs the In-vehicle Attack Dataset (IVAD). Secondly, the CC-IDPS employs a sliding window approach for feature extraction from multiple Controller Area Network (CAN) IDs, and leverages Bidirectional Encoder Representation from Transformers (BERT) models for in-vehicle traffic classification. Based on classification results, the CC-IDPS applies treatments to in-vehicle traffic. Subsequently, the proposed Encode2ID algorithm encodes and stores malicious traffic in the database of cloud, facilitating subsequent model training. Experimental results demonstrate that, when applied to the IVAD dataset, the model exhibits lower detection accuracy and F1-score compared to other datasets. Notably, the CC-IDPS outperforms other machine learning and deep learning models in detecting performance on the IVAD dataset.

In recent years, the EV has become popular because of its environmental protection, low noise and economy. Meanwhile, as an important supporting facility, the EV charging infrastructure (charging pile) is also widely distributed. However, security issues of EV charging infrastructure have become increasingly prominent. Among them, DoS attacks and Botnet attacks are difficult to prevent because of their large-scale attack and concealment. Therefore, this paper proposes a Hybrid DoS Attacks Intrusion Detection System (HDA-IDS). The HDA-IDS combines signature-based detection with anomaly-based detection to effectively detect known and unknown DoS/Botnet attacks. In addition, this paper proposes a new anomaly-based detection network -- CL-GAN, which combines CNN-LSTM with GAN. It establishes a normal behavior pattern to detect and distinguish malicious traffic. Experiment results show that the HDA-IDS efficiently detects DoS or Botnet attacks on NSL-KDD, CICIDS2018 and Bot-IoT datasets. The HDA-IDS can reach about 99% in accuracy, precision, recall and F1-Score.

The Controller Area Network (CAN), the de facto in-vehicle communication backbone, lacks fundamental authentication and encryption mechanisms, exposing vehicles to severe security threats as the Internet of Vehicles (IoV) rapidly evolves. Deploying intrusion detection on resource-constrained in-vehicle Electronic Control Units (ECUs) presents a dual challenge: achieving high detection accuracy while operating within tight computational, memory, and latency budgets. This paper proposes TGB‑IDS, a novel teacher-student framework that leverages knowledge distillation to transfer the sequence‑modeling capabilities of a Transformer‑based TimeSeriesGPT to a lightweight Bidirectional Long Short‑Term Memory (BiLSTM) encoder. Departing from conventional hard‑label supervision, TGB‑IDS employs a probability‑distribution‑based distillation strategy that enables the student model to learn the teacher’s full inter‑class relational knowledge, capturing subtle deviations that discrete labels often obscure. Evaluated on four datasets (three public benchmarks and one real‑vehicle dataset), TGB‑IDS achieves over 99.7\% accuracy in both binary and multi‑class intrusion detection tasks. The distilled student model contains only 0.68M parameters (1.65\% of the teacher’s size) and processes a 64‑frame window in 0.971 ms, outperforming classic models such as Convolutional Neural Networks (CNN) and Residual Networks (ResNet). Complexity analysis confirms the model’s feasibility for real‑time deployment on resource‑constrained ECUs, offering a practical and efficient solution for CAN bus intrusion detection.