{"id":"https://openalex.org/W7128589379","doi":"https://doi.org/10.3390/systems14020196","title":"XGBoost-Based Anomaly Detection Framework for SOME/IP in In-Vehicle Networks","display_name":"XGBoost-Based Anomaly Detection Framework for SOME/IP in In-Vehicle Networks","publication_year":2026,"publication_date":"2026-02-11","ids":{"openalex":"https://openalex.org/W7128589379","doi":"https://doi.org/10.3390/systems14020196"},"language":"en","primary_location":{"id":"doi:10.3390/systems14020196","is_oa":true,"landing_page_url":"https://doi.org/10.3390/systems14020196","pdf_url":"https://www.mdpi.com/2079-8954/14/2/196/pdf?version=1770822716","source":{"id":"https://openalex.org/S4210219410","display_name":"Systems","issn_l":"2079-8954","issn":["2079-8954"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Systems","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2079-8954/14/2/196/pdf?version=1770822716","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5014822409","display_name":"Taeguen Kim","orcid":"https://orcid.org/0000-0002-6586-2037"},"institutions":[{"id":"https://openalex.org/I4210110812","display_name":"Sejong Cyber University","ror":"https://ror.org/020b78451","country_code":"KR","type":"education","lineage":["https://openalex.org/I4210110812"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"TaeGuen Kim","raw_affiliation_strings":["Department of Cyber Security, Korea University Sejong, Sejong 30019, Republic of Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Cyber Security, Korea University Sejong, Sejong 30019, Republic of Korea","institution_ids":["https://openalex.org/I4210110812"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Hyeon Park","orcid":"https://orcid.org/0009-0000-1673-8032"},"institutions":[{"id":"https://openalex.org/I4210110812","display_name":"Sejong Cyber University","ror":"https://ror.org/020b78451","country_code":"KR","type":"education","lineage":["https://openalex.org/I4210110812"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Hyeon Park","raw_affiliation_strings":["Department of Cyber Security, Korea University Sejong, Sejong 30019, Republic of Korea"],"raw_orcid":"https://orcid.org/0009-0000-1673-8032","affiliations":[{"raw_affiliation_string":"Department of Cyber Security, Korea University Sejong, Sejong 30019, Republic of Korea","institution_ids":["https://openalex.org/I4210110812"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5114303937","display_name":"Ilsun You","orcid":null},"institutions":[{"id":"https://openalex.org/I110273157","display_name":"Kookmin University","ror":"https://ror.org/0049erg63","country_code":"KR","type":"education","lineage":["https://openalex.org/I110273157"]}],"countries":["KR"],"is_corresponding":true,"raw_author_name":"Ilsun You","raw_affiliation_strings":["Department of Financial Information Security, Kookmin University, Seoul 02707, Republic of Korea"],"raw_orcid":"https://orcid.org/0000-0002-0604-3445","affiliations":[{"raw_affiliation_string":"Department of Financial Information Security, Kookmin University, Seoul 02707, Republic of Korea","institution_ids":["https://openalex.org/I110273157"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5063105336","display_name":"Byung Il Kwak","orcid":null},"institutions":[{"id":"https://openalex.org/I4210110812","display_name":"Sejong Cyber University","ror":"https://ror.org/020b78451","country_code":"KR","type":"education","lineage":["https://openalex.org/I4210110812"]}],"countries":["KR"],"is_corresponding":true,"raw_author_name":"Byung Il Kwak","raw_affiliation_strings":["Department of Cyber Security, Korea University Sejong, Sejong 30019, Republic of Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Cyber Security, Korea University Sejong, Sejong 30019, Republic of Korea","institution_ids":["https://openalex.org/I4210110812"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5063105336","https://openalex.org/A5114303937"],"corresponding_institution_ids":["https://openalex.org/I110273157","https://openalex.org/I4210110812"],"apc_list":{"value":1600,"currency":"CHF","value_usd":1732},"apc_paid":{"value":1600,"currency":"CHF","value_usd":1732},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.20735092,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"14","issue":"2","first_page":"196","last_page":"196"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10761","display_name":"Vehicular Ad Hoc Networks (VANETs)","score":0.4352000057697296,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10761","display_name":"Vehicular Ad Hoc Networks (VANETs)","score":0.4352000057697296,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12216","display_name":"Network Time Synchronization Technologies","score":0.13750000298023224,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10933","display_name":"Real-Time Systems Scheduling","score":0.10289999842643738,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.7680000066757202},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6399999856948853},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.6380000114440918},{"id":"https://openalex.org/keywords/middleware","display_name":"Middleware (distributed applications)","score":0.5873000025749207},{"id":"https://openalex.org/keywords/automotive-industry","display_name":"Automotive industry","score":0.5059999823570251},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.4853000044822693},{"id":"https://openalex.org/keywords/ethernet","display_name":"Ethernet","score":0.4810999929904938},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.44780001044273376}],"concepts":[{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.7680000066757202},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6632000207901001},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6399999856948853},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.6380000114440918},{"id":"https://openalex.org/C169468491","wikidata":"https://www.wikidata.org/wiki/Q146923","display_name":"Middleware (distributed applications)","level":2,"score":0.5873000025749207},{"id":"https://openalex.org/C526921623","wikidata":"https://www.wikidata.org/wiki/Q190117","display_name":"Automotive industry","level":2,"score":0.5059999823570251},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.4853000044822693},{"id":"https://openalex.org/C172173386","wikidata":"https://www.wikidata.org/wiki/Q79984","display_name":"Ethernet","level":2,"score":0.4810999929904938},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.45010000467300415},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.44780001044273376},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.4456999897956848},{"id":"https://openalex.org/C2778602020","wikidata":"https://www.wikidata.org/wiki/Q300113","display_name":"AUTOSAR","level":3,"score":0.4433000087738037},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.41819998621940613},{"id":"https://openalex.org/C2164484","wikidata":"https://www.wikidata.org/wiki/Q5170150","display_name":"Core (optical fiber)","level":2,"score":0.37470000982284546},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.3612000048160553},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3528999984264374},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.33329999446868896},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.32659998536109924},{"id":"https://openalex.org/C2778755073","wikidata":"https://www.wikidata.org/wiki/Q10858537","display_name":"Scale (ratio)","level":2,"score":0.32580000162124634},{"id":"https://openalex.org/C2779696439","wikidata":"https://www.wikidata.org/wiki/Q7512811","display_name":"Signature (topology)","level":2,"score":0.32030001282691956},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.32010000944137573},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.3073999881744385},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.30469998717308044},{"id":"https://openalex.org/C45374587","wikidata":"https://www.wikidata.org/wiki/Q12525525","display_name":"Computation","level":2,"score":0.3037000000476837},{"id":"https://openalex.org/C57041688","wikidata":"https://www.wikidata.org/wiki/Q220644","display_name":"Service-oriented architecture","level":3,"score":0.2924000024795532},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2784000039100647},{"id":"https://openalex.org/C2776151529","wikidata":"https://www.wikidata.org/wiki/Q3045304","display_name":"Object detection","level":3,"score":0.2614000141620636}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/systems14020196","is_oa":true,"landing_page_url":"https://doi.org/10.3390/systems14020196","pdf_url":"https://www.mdpi.com/2079-8954/14/2/196/pdf?version=1770822716","source":{"id":"https://openalex.org/S4210219410","display_name":"Systems","issn_l":"2079-8954","issn":["2079-8954"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Systems","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:0cf4cac5b58e418e9ece28d1b135187b","is_oa":false,"landing_page_url":"https://doaj.org/article/0cf4cac5b58e418e9ece28d1b135187b","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Systems, Vol 14, Iss 2, p 196 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/systems14020196","is_oa":true,"landing_page_url":"https://doi.org/10.3390/systems14020196","pdf_url":"https://www.mdpi.com/2079-8954/14/2/196/pdf?version=1770822716","source":{"id":"https://openalex.org/S4210219410","display_name":"Systems","issn_l":"2079-8954","issn":["2079-8954"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Systems","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G4700831490","display_name":null,"funder_award_id":"2022-","funder_id":"https://openalex.org/F4320335489","funder_display_name":"Institute for Information and Communications Technology Promotion"}],"funders":[{"id":"https://openalex.org/F4320320671","display_name":"National Research Foundation","ror":"https://ror.org/05s0g1g46"},{"id":"https://openalex.org/F4320321373","display_name":"Korea University","ror":"https://ror.org/047dqcg40"},{"id":"https://openalex.org/F4320322120","display_name":"National Research Foundation of Korea","ror":"https://ror.org/013aysd81"},{"id":"https://openalex.org/F4320324891","display_name":"Iran Telecommunication Research Center","ror":"https://ror.org/01a3g2z22"},{"id":"https://openalex.org/F4320328359","display_name":"Ministry of Science and ICT, South Korea","ror":"https://ror.org/01wpjm123"},{"id":"https://openalex.org/F4320335489","display_name":"Institute for Information and Communications Technology Promotion","ror":"https://ror.org/01g0hqq23"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7128589379.pdf","grobid_xml":"https://content.openalex.org/works/W7128589379.grobid-xml"},"referenced_works_count":43,"referenced_works":["https://openalex.org/W1987971958","https://openalex.org/W2001619934","https://openalex.org/W2051224630","https://openalex.org/W2296701710","https://openalex.org/W2471211154","https://openalex.org/W2891214000","https://openalex.org/W2913975235","https://openalex.org/W2945012921","https://openalex.org/W2959120033","https://openalex.org/W3013377505","https://openalex.org/W3021055729","https://openalex.org/W3092567164","https://openalex.org/W3092575991","https://openalex.org/W3134635753","https://openalex.org/W3158938497","https://openalex.org/W3164321464","https://openalex.org/W3215951331","https://openalex.org/W4205669200","https://openalex.org/W4220842203","https://openalex.org/W4229643499","https://openalex.org/W4234698323","https://openalex.org/W4285153801","https://openalex.org/W4285174670","https://openalex.org/W4292387502","https://openalex.org/W4293057679","https://openalex.org/W4293731341","https://openalex.org/W4296118526","https://openalex.org/W4308605894","https://openalex.org/W4315629628","https://openalex.org/W4317642530","https://openalex.org/W4361297517","https://openalex.org/W4366978899","https://openalex.org/W4367312488","https://openalex.org/W4378373601","https://openalex.org/W4384067459","https://openalex.org/W4385624397","https://openalex.org/W4385624421","https://openalex.org/W4385656664","https://openalex.org/W4386450116","https://openalex.org/W4388430742","https://openalex.org/W4390238465","https://openalex.org/W4396712729","https://openalex.org/W4399369018"],"related_works":[],"abstract_inverted_index":{"SOME/IP":[0,52,62,72,74],"is":[1],"a":[2,50,110,124,128],"core":[3],"AUTOSAR":[4],"middleware":[5],"for":[6],"Automotive":[7],"Ethernet,":[8],"enabling":[9],"scalable":[10],"service-oriented":[11],"communication":[12],"among":[13],"distributed":[14],"embedded":[15],"devices;":[16],"however,":[17],"its":[18],"lack":[19],"of":[20,138],"built-in":[21],"authentication,":[22],"encryption,":[23],"and":[24,36,54,73,78,87,89,91,123,147],"integrity":[25],"protection":[26],"exposes":[27],"vehicles":[28],"to":[29,61],"threats":[30],"such":[31],"as":[32],"eavesdropping,":[33],"denial-of-service,":[34],"fuzzing,":[35],"man-in-the-middle":[37],"attacks.":[38],"To":[39],"study":[40],"these":[41,97],"risks,":[42],"we":[43],"empirically":[44],"reproduce":[45],"representative":[46],"attack":[47],"behaviors":[48],"in":[49],"realistic":[51],"simulation":[53],"propose":[55],"an":[56,104,135],"anomaly":[57],"detection":[58],"framework":[59,65],"tailored":[60],"traffic.":[63],"The":[64],"parses":[66],"raw":[67],"Ethernet":[68],"frames":[69],"into":[70],"layered":[71],"Service":[75],"Discovery":[76],"representations":[77],"extracts":[79],"behavior-centric":[80],"features,":[81,98],"including":[82],"time-interval":[83],"variation,":[84],"payload":[85,90],"likelihood":[86],"entropy,":[88],"length":[92],"change":[93],"rates.":[94],"Based":[95],"on":[96,109,127],"it":[99],"performs":[100],"real-time":[101],"classification":[102],"using":[103],"XGBoost-based":[105],"model.":[106],"Experimental":[107],"evaluation":[108],"large-scale":[111],"dataset":[112],"demonstrates":[113],"that":[114],"the":[115],"proposed":[116],"approach":[117],"achieves":[118],"0.93":[119],"PR-AUC,":[120],"0.99":[121],"ROC-AUC,":[122],"0.97":[125],"F1-score":[126],"real-world-reflective,":[129],"imbalanced":[130],"dataset,":[131],"while":[132],"also":[133],"delivering":[134],"end-to-end":[136],"efficiency":[137],"0.556":[139],"ms":[140],"per":[141],"packet,":[142],"covering":[143],"both":[144],"feature":[145],"generation":[146],"XGBoost":[148],"inference.":[149]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2026-02-11T00:00:00"}