CoChat
Sign Up
Cited by 32Network Security and Intrusion DetectionArtificial Immune Systems ApplicationsNetwork Packet Processing and Optimization

Aero: Automotive ethernet real-time observer for anomaly detection in in-vehicle networks

Jeong, Seonghoon, Kim, Huy Kang, Han, Mee Lan, Kwak, Byung Il·2024·IEEE Transactions on Industrial Informatics
DOI 10.1109/tii.2023.3324949
Open this paper in CoChat — free account

Abstract

Automotive Ethernet enables high-bandwidth in-vehicle networking, facilitating the transmission of sensor data among electronic control units. However, the increasing connectivity and potential vulnerability inheritance in connected and autonomous vehicles expose them to security risks. To address this challenge, an intrusion detection system (IDS) capable of analyzing automotive Ethernet traffic and detecting anomalies is essential. In thisarticle, we propose automotive Ethernet real-time observer (AERO), an unsupervised network IDS designed to protect in-vehicle networks. AERO consists of three components: a feature extractor that constructs three multimodal features, a neural network for processing the extracted features, and an online anomaly detector that calculates outlier scores in real time. We evaluate the performance of AERO using the TOW-IDS automotive Ethernet intrusion dataset. The experimental results demonstrate that AERO achieves high detection performance across five different attack types and is highly applicable to automotive-grade devices for real-time anomaly detection.

Integrity signals

Registry

Crossref · 10.1109/tii.2023.3324949

Cites

21 of 21 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Jeong et al. [42] proposed AERO, an unsupervised anomaly detection framework for in-vehicle Automotive Ethernet traffic that simultaneously captures protocol order, payload, and timing intervals, using the TOW-IDS automotive Ethernet intrusion dataset.

    “Using the TOW-IDS automotive Ethernet intrusion dataset, Jeong et al. [42] proposed AERO, an unsupervised anomaly detection framework for in-vehicle Automotive Ethernet traffic that simultaneously captures protocol order, payload, and timing intervals.”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [42]

  • AERO successfully detected AVTP frame injection, PTP desynchronization, and CAN DoS/Replay attacks while enabling near-real-time operation on embedded Jetson-class devices.

    “With thresholding derived solely from normal segments, AERO successfully detected AVTP frame injection, PTP desynchronization, and CAN DoS/Replay attackscapturing subtle distortions in protocol, content, and timing patterns-while enabling near-real-time operation on embedded Jetson-class devices.”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [42]

  • The dataset distribution for time-series dependency-based techniques reveals a concentration on a limited set of benchmarks, with CIC-IDS2017, UNSW-NB15, IoT-23, LITNET-2020, NetML-2020, CIC-DDoS2019, and N-BaIoT widely used, especially for botnet, DDoS, and generic network intrusions, while only a subset of studies leverage ICS/CPS-specific traces such as Alstom TCMS traffic, multi-domain ICS-CPS

    “Fourth, the dataset distribution again reveals a concentration on a limited set of benchmarks. CIC-IDS2017, UNSW-NB15, IoT-23, LITNET-2020, NetML-2020, CIC-DDoS2019, and N-BaIoT are widely used to evaluate time-series dependency-based techniques, especially for botnet, DDoS, and generic network intrusions [35,38,40,43]. Only a subset of studies leverage ICS/CPS-specific traces such as Alstom TCMS”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [42]

  • Deep sequence models (LSTM, BLSTM-GRU, CNN + Bi-GRU) and generative architectures (FID-GAN, VAE-based digital twins) are able to exploit complex temporal patterns and achieve strong detection or classification performance on benchmark datasets.

    “Third, in terms of model behavior and failure modes, the surveyed work shows that deep sequence models (LSTM, BLSTM-GRU, CNN + Bi-GRU) and generative architectures (FID-GAN, VAE-based digital twins) are able to exploit complex temporal patterns and achieve strong detection or classification performance on benchmark datasets [35,38-40,42,44,45].”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [42]

  • Unsupervised and generative approaches such as FID-GAN and autoencoder-based frameworks target zero-day or previously unseen attacks by learning normal temporal patterns and flagging deviations via reconstruction- or residual-based scores.

    “Unsupervised and generative approaches such as FID-GAN and autoencoder-based frameworks target zero-day or previously unseen attacks by learning normal temporal patterns and flagging deviations via reconstruction- or residual-based scores [38,42,44].”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [42]

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Related

Authors
Jeong, S., Kim, H. K., Han, M. L., & Kwak, B. I.
Affiliations
  • Institute of Cybersecurity and Privacy, Korea University, Seoul, Republic of Korea
  • Korea University (KR)
  • Hallym University (KR)
ORCID
Venue
IEEE Transactions on Industrial Informatics
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2024-03
Volume
20
Issue
3
Pages
4651-4662
ISSN
  • 1551-3203 (ISSN-L)
  • 1941-0050
DOI
10.1109/tii.2023.3324949
OpenAlex
W4388430742
Cited by
31
References
21
Citations by year
2026: 10 · 2025: 14 · 2024: 7
FWCI
3.45
Type
journal article
Language
en
Open access
closed
Licence
Locations
IEEE Transactions on Industrial Informatics (publishedVersion)
Funders
  • Korea Agency for Infrastructure Technology Advancement (RS-2021-KA162334)
  • Ministry of Land, Infrastructure and Transport
  • National Research Foundation of Korea
  • Ministry of Science and ICT, South Korea (2022R1A4A1033600)
  • Ministry of Science and ICT, Korea (IITP-2023-RS-2022-00164800)
  • Institute for Information and Communications Technology Planning and Evaluation
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
  • Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
Keywords
automotive Ethernet, in-vehicle networks, intrusion detection, anomaly detection, unsupervised learning, multimodal feature extraction, outlier detection, connected and autonomous vehicles, network security

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review