Mind the Shift: A Study on Transfer Learning and Domain Adaptation in Vehicular Intrusion Detection

This paper addresses the need for adaptable intrusion detection systems (IDS) in intra-vehicle networks. We evaluated two scalable IDS strategies—combined training and transfer learning—on novel traffic data to balance predictive accuracy and computational efficiency under distributional shifts. Previous IDS models for intra-vehicle attacks achieved high accuracy but relied heavily on the simple CarHacking dataset. To address this limitation, we integrate the newer CIC-IoV-2024 dataset, which reflects realistic vehicular traffic. In Strategy 1, we retrain models from scratch on a combined dataset. These models achieve strong classification across all classes, with accuracies ranging from 90.57\% to 100\% and F1 scores of 88.91\% to 100\%. However, training takes longer (61–184 minutes) and inference per packet is slower (30–80 ms). In Strategy 2, we apply transfer learning by fine-tuning pre-trained models while freezing earlier layers. This approach reduces training time (4–16 minutes) and improves latency (21.29–126.76 ms), but predictive performance declines. The models primarily distinguish between benign and malicious traffic, with F1 scores ranging from 82.99\% to 89.32\%, and exhibit high uncertainty in classifying diverse attack types. Our findings highlight a trade-off between predictive power and computational efficiency. These insights can guide the deployment of IDS frameworks in real-time vehicular environments.<br>