Abstract In recent years, the rapid development of the intelligent connected vehicle industry has highlighted the critical importance of in-vehicle network security. The Controller Area Network(CAN) protocol is widely used as the core communication framework within in-vehicle systems. However, the CAN protocol lacks encryption and authentication mechanisms, making the network vulnerable to various security threats. Additionally, the rapid advancement of Vehicle-to-Everything communication has increased the frequency of interactions between vehicles and external environments, further exacerbating the security risks of the Internet of Vehicles (IoV) and highlighting the necessity of effective intrusion detection methods. Existing detection methods often face challenges like slow detection speeds and low accuracy. To overcome these limitations, this paper proposes a novel lightweight neural network model that integrates the Mamba architecture with Convolutional Neural Networks (CNNs) for IoV intrusion detection. In the in-vehicle scenario, a two-stage detection method combines single-message detection with message sequence detection. Single-message detection processes each message individually, enabling fine-grained intrusion detection. In contrast, message sequence detection leverages the periodic characteristics of CAN bus messages to detect anomalies in consecutive message sequences. In a complex external network environment, we employ a stacking ensemble approach and knowledge distillation to enhance and compress the model, resulting in a compact, high-performance, lightweight solution. Experimental results on four publicly available datasets show that our method has good detection performance and provides an effective solution to the security challenges in the IoV.

As an extension of cloud computing, fog computing (FG) deploys storage resources to the edge of the network to reduce latency and improve real-time processing capabilities. However, the distributed architecture and complex network environment of FG make it vulnerable to abnormal behaviors. Therefore, it is necessary to design practical anomaly detection methods to protect the security of fog nodes. Previous research mainly focuses on static anomaly detection methods, which use offline training to protect fog nodes. However, these static methods make it difficult to cope with concept drift scenarios in fog environments where both threat situations and normal behaviors are constantly changing. Furthermore, existing dynamic methods do not consider the storage space of fog servers and the labeling limitations of experts. To address the above challenges, we propose an online adaptive anomaly detection framework (OAADF), which consists of three key modules: a statistics-based dynamic feature selection module for removing redundant features, a drift detection module based on block similarity changes for identifying concept drift, and a score-based update module for model adaptation. Experimental validation using the CICIDS2017 and 5G-NIDD datasets in the NS-3 simulation environment demonstrates the superior performance and practicality of OAADF, surpassing the state-of-the-art (SOTA) solutions.