💻 computer science

A Comparative Analysis of Machine Learning Models for Intrusion Detection in Intelligent Transport Systems

This contribution proposes a trust-aware, federated hybrid intrusion-detection framework that combines Random Forest, decision tree, and linear SVM models at edge nodes with server-side aggregation to enhance security and reduce latency in intelligent transportation systems.

Original authors: Zawad Yalmie Sazid, Robert Abbas, Sasa Maric

Published 2026-05-04

📖 5 min read🧠 Deep dive

CC0 1.0

Original authors: Zawad Yalmie Sazid, Robert Abbas, Sasa Maric

Original paper dedicated to the public domain under CC0 1.0 (http://creativecommons.org/publicdomain/zero/1.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a bustling city where thousands of cars, traffic lights, and street sensors communicate instantly with one another. This is the world of Intelligent Transportation Systems (ITS). To keep traffic flowing smoothly and safely, these devices must make decisions in milliseconds. Yet this constant conversation carries enormous security risks: hackers could impersonate a traffic light or a car to create chaos.

This article is like a security audit for this digital city. It asks: "How do we build a guardian system that is fast enough to stop hackers in milliseconds, intelligent enough to learn new tricks, yet lightweight enough to run on the small computers inside our cars and traffic lights?"

Here is a breakdown of their findings using simple analogies:

1. The Problem: The "Cloud" is too far away

Traditionally, security guardians (Intrusion Detection Systems) operated like a central police station. Every car would send a video feed of the road to a massive cloud server located miles away. The server would analyze it and tell the car what to do.

The Problem: This takes too long (latency). In an accident scenario, waiting for a signal from the cloud is like waiting for a letter before deciding to brake.
The Solution: The article proposes Edge Computing. Instead of sending data to the cloud, the "guardian" lives directly inside the car or at the traffic light (at the "edge"). It makes decisions locally, instantly.

2. The Challenge: The "Edge" is fragile

Placing guardians on every street corner is great for speed but difficult to manage.

Privacy: You do not want every car sending its private driving logs to a central server.
Resources: Computers at traffic lights are small and have limited battery and storage. They cannot run heavy, complex software programs.
Trust: What if a hacker tricks a traffic light into giving bad advice to others?

3. The Proposed System: A "Team of Local Detectives"

The authors propose a system called Federated Learning.

The Analogy: Imagine a neighborhood watch. Instead of everyone sending their private diaries to a central office, each neighbor (Edge Node) keeps their own diary. They train their own "detective" on their local data.
The Collaboration: Once a week, they do not share the diaries (raw data); they share only the learned lessons (model updates) with a coordinator. The coordinator mixes these lessons to create a smarter "Global Detective" and sends it back.
Trust-Aware: The system is "trust-aware." If a neighbor acts suspiciously or has bad data, the coordinator weighs their advice less, preventing a malicious actor from ruining the group's intelligence.

4. The Experiment: Choosing the Right Detective

The researchers had to select the best type of "detective" (Machine Learning model) capable of running on these small, local computers. They tested three candidates using a massive dataset of traffic data (CICIDS2017), containing millions of examples of normal driving and various cyberattacks (such as DDoS, which is like a traffic jam caused by bots).

The three candidates were:

Linear SVM: A very strict, rule-based detective. It is fast but sometimes misses complex, insidious tricks.
Decision Tree: A detective that asks a series of "Yes/No" questions. It is fast and easy to understand but can be confused by too many variables (Overfitting).
Random Forest: A team of many decision trees working together. They vote on the answer.

5. The Results: The "Random Forest" Wins

The article ran a competition to see which detective could best identify the villains without making mistakes.

The Winner: Random Forest was the clear champion.
- Accuracy: It was correct in 99.99% of cases.
- The "False Alarm" Test: In security, it is bad to cry "Wolf!" when there is no wolf (False Positive).
  - Linear SVM cried "Wolf!" 19 times when there was no wolf.
  - Decision Tree cried "Wolf!" 7 times.
  - Random Forest cried "Wolf!" only 2 times out of 45,000 tests.
- The "Missed Wolf" Test: It also missed almost no real attacks (only 3 missed detections).

Why it matters:
The article concludes that Random Forest offers the perfect balance. It is intelligent enough to catch complex hackers but simple enough to run on the small computers inside our cars and traffic lights. It makes very few errors, meaning traffic does not get stuck because the system panics over false alarms, and real attacks do not slip through the cracks.

Summary

The article argues that to keep our future Smart Cities safe, we must shift security from the "Cloud" to the "Edge" (the devices themselves). After testing various methods, they found that a Random Forest algorithm working within a Federated Learning team (where devices learn together without sharing private data) is the most reliable, fastest, and most accurate way to stop cyberattacks on our roads.

1. Problem Statement

The paper addresses the critical security challenges faced by Intelligent Transport Systems (ITS) as they transition to Edge-Computing and 5G/6G-V2X (Vehicle-to-Everything) architectures.

The Core Conflict: While Edge-Computing reduces latency and bandwidth usage through local data processing, it expands the attack surface for cyberattacks. Edge nodes (e.g., Roadside Units, vehicle sensors) are distributed, heterogeneous, and resource-constrained, making them vulnerable to sophisticated attacks such as DDoS and botnets.
Limitations of Existing Solutions:
- Traditional signature-based IDS: Fail against encrypted traffic and evolving attack patterns.
- Centralized Cloud Models: Violate privacy by requiring the transmission of raw data and lead to unacceptable latency.
- Deep Learning: Often too computationally intensive for resource-constrained Edge hardware.
- Limitations of Classical ML: Single decision trees suffer from overfitting and high variance; linear SVMs struggle with non-linear, high-dimensional traffic patterns, leading to higher rates of false-positive alerts.
The Research Gap: There is a need for a privacy-preserving, low-latency, and highly accurate framework for intrusion detection that operates within the strict computational limits of Edge nodes without centralizing raw data.

2. Methodology

The authors propose a Trust-Aware Federated Hybrid Intrusion Detection Framework. The methodology includes a comparative analysis of classical Machine Learning models to establish a robust baseline before implementing the full distributed system.

Dataset: The study utilizes the CICIDS2017 dataset, a large-scale, labeled network traffic dataset containing over 2.8 million entries, encompassing 14 attack categories (including DoS, DDoS, Brute Force, and Web attacks) as well as benign traffic.
Experimental Setup:
- Compared Models: Random Forest (RF), Decision Tree (DT), and Linear Support Vector Machine (SVM).
- Workflow: Data preprocessing (cleaning, encoding, scaling) $\rightarrow$ 80/20 train/test split $\rightarrow$ model training $\rightarrow$ inference and evaluation.
- Proposed Framework Architecture:
  1. Local Sites: Capture traffic, preprocess it, and train local hybrid detectors (using RF, DT, SVM) without sharing raw data.
  2. Server: Aggregates model updates using a trust-aware mechanism that weights updates based on both data volume and client reliability, rather than simple sample-size weighting.
  3. Goal: Achieve global model convergence while maintaining privacy guarantees and mitigating the impact of unreliable or malicious client updates.

3. Main Contributions

Comparative Baseline Analysis: The paper provides a rigorous empirical comparison of three classical ML algorithms (RF, DT, Linear SVM) specifically for Edge-based ITS intrusion detection, demonstrating that ensemble methods outperform single estimators and linear models in this context.
Trust-Aware Distributed Framework: A novel architecture is proposed where Edge sites collaborate via Federated Learning (FL) to protect privacy, utilizing a trust mechanism to filter low-quality or malicious model updates.
Profiling Operational Errors: Beyond standard accuracy metrics, the study emphasizes false-positive (FP) and false-negative (FN) alert rates. It argues that in safety-critical ITS environments, minimizing FNs (missed attacks) and FPs (alert fatigue) is more important than raw accuracy.
Validation of Feature Separability: The study confirms that the constructed feature space in CICIDS2017 allows for near-perfect separation of benign and malicious traffic using lightweight models, validating the feasibility of transitioning to complex distributed setups.

4. Results and Evaluation

The study evaluated the models on a binary classification task (Benign vs. DDoS/Attack) using 45,143 test instances.

Summary of Performance Metrics:

Model	Accuracy	Precision	Recall	F1-Score	ROC-AUC
Random Forest	99.9889%	99.9922%	99.9883%	99.9902%	1.0000
Decision Tree	99.9756%	99.9727%	99.9844%	99.9785%	0.999833
Linear SVM	99.9092%	99.9258%	99.9141%	99.9199%	0.999882

Key Findings:

Superiority of Random Forest: RF achieved the highest performance across all metrics. Crucially, it produced the cleanest error profile with only 2 false positives and 3 false negatives out of over 45,000 instances.
Decision Tree: Performed well but generated more false positives (7) and false negatives (4), indicating a higher risk of alert fatigue compared to RF.
Linear SVM: Although accurate, it had the highest error count (19 FP, 22 FN), making it less suitable for high-risk environments where missed detections are critical.
Feature Space: The results suggest that the selected features are highly discriminative, enabling even simpler models to achieve near-perfect separation, thereby justifying the use of lightweight models at the Edge.

5. Significance

Safety-Critical Application: In ITS, a cyberattack is not merely a data leak but a physical safety hazard (e.g., traffic gridlock, vehicle collisions). The study shows that Random Forest offers the necessary balance of high detection rates (low FN) and low false alarms (low FP) to ensure passenger safety without overwhelming network operators with false alerts.
Feasibility of Edge-AI: The results prove that high-performance intrusion detection does not require heavy Deep Learning models; lightweight ensemble methods can operate effectively within the computational constraints of Edge devices.
Foundation for Federated Learning: By establishing a strong local baseline, the research validates that the next step—implementing trust-aware Federated Learning—can maintain high detection quality while solving privacy and bandwidth issues. It sets a benchmark for future hybrid models to ensure they do not sacrifice performance for privacy.
Zero-Touch Security: The proposed framework aligns with the vision of "Zero-Touch" cybersecurity, enabling autonomous, self-sufficient threat neutralization in milliseconds at the Edge.

Conclusion:
The paper concludes that Random Forest is the optimal classical Machine Learning algorithm for Edge-based intrusion detection in Intelligent Transport Systems. It provides a robust, low-latency, and highly accurate foundation for the proposed trust-aware distributed framework, ensuring that future ITS deployments can be both secure and privacy-compliant.