DALS-IDS: Drift-Aware Lightweight Stacking Intrusion Detection for Smart Transport Systems

Connected and intelligent transport systems depend on communication between electronic control units (ECUs), invehicle networks, roadside units (RSUs), gateways, and cloud services. Intrusion detection systems (IDSs) can help identify abnormal or malicious traffic, including denial-of-service, fuzzing, and message-spoofing activity. The supplied literature includes work on cloud-based ITS intrusion detection [1] and the wider connected smart-transport environment [2]. The planned evaluation will also consider vehicular CAN-bus and network intrusion datasets identified in the project proposal; their availability, labels, and feature compatibility will be verified before experiments are reported. A practical detector for smart transport must address more than classification accuracy. Attack prevalence may be highly imbalanced, traffic patterns can change with time, and edge deployment places constraints on inference latency and memory. A model evaluated using a random split may also appear more generalizable than it is if records from closely related time periods occur in both training and testing data. Preprocessing operations such as scaling, encoding, and synthetic oversampling can introduce information leakage if they are fitted before the validation split. This paper proposes DALS-IDS, a drift-aware lightweight stacking framework for smart transport intrusion detection. Three tree-based learners—LightGBM, ExtraTrees, and Random Forest—are used as base models. Feature subspacing encourages diversity, and a Logistic Regression meta-learner is trained on out-of-fold (OOF) predictions. A sliding window estimates recent model performance; ADWIN detects changes in a monitored error stream and triggers weight recalculation or meta-learner retraining. SHAP explanations are intended to identify the features that contributed most to an individual alert. The work is a system-design proposal. Its contribution is a reproducible evaluation plan that combines leakage control, drift-aware ensemble adaptation, cross-dataset tests, interpretable alerts, and CPU-only efficiency measurements. No experimental improvement is claimed before implementation and testing.

Many IDS models are trained and assessed under a fixed data distribution. In smart transport, however, normal CAN traffic, network services, attack methods, and operating conditions may vary over time or between vehicles. A detector that performs well on a source dataset may degrade when deployed on a different vehicle, a later time period, or a different network environment. The research problem is to design a computationally practical IDS that combines diverse lightweight classifiers, adapts its ensemble decision process when monitored performance changes, and can be evaluated without preprocessing leakage. The framework must also make its alerts interpretable and measure whether its performance is suitable for CPU-only edge deployment. The central research question is: Can drift-aware weighting and lightweight stacking improve the stability and crossdataset usefulness of intrusion detection in smart transport, while maintaining acceptable inference cost and interpretable alerts? This remains an empirical question and will be answered only after the proposed experiments are completed.

The objectives of DALS-IDS are: 1) To design a stacking IDS using LightGBM, ExtraTrees, and Random Forest base learners. 2) To increase model diversity through separate feature subsets for the base learners. 3) To prevent data leakage by fitting preprocessing and SMOTE only within training folds. 4) To use out-of-fold predictions to train a Logistic Regression meta-learner. 5) To monitor recent performance with a sliding window and use ADWIN to detect potential concept drift. 6) To recalculate ensemble weights or retrain the meta-learner when drift is detected. 7) To evaluate per-class recall, macro-F1, PR-AUC, Matthews correlation coefficient (MCC), and false-positive rate. 8) To measure CPU-only latency, throughput, model size, and peak memory use. 9) To generate feature-level explanations for alerts using SHAP. 10) To examine temporal and cross-dataset generalization on network and vehicular datasets.

A. Vehicular CAN-Bus and Network Intrusion Datasets The base paper FUSE-Net studies intrusion detection for cloudbased intelligent transport systems and discusses network datasets used to evaluate ensemble learning [1]. The proposed DALS-IDS extends the evaluation scope to include vehicular CAN-bus data as well as network intrusion datasets. The planned vehicular datasets are Car-Hacking and CICIoV2024; the planned network datasets are CICIDS2017, CSE-CICIDS2018, and UNSW-NB15. These dataset names define the intended evaluation plan, not a claim that the datasets have already been downloaded, harmonized, or experimentally evaluated. The datasets may differ in capture conditions, feature definitions, class labels, and attack distributions. Therefore, cross-dataset evaluation will not assume that matching column names establish semantic equivalence. Before testing, the study will document dataset versions, feature mappings, label mappings, preprocessing decisions, and excluded features. If a defensible common feature space cannot be established, the corresponding transfer experiment will be reported as infeasible rather than forcing an invalid mapping. B. Ensemble Learning and Feature Subspacing FUSE-Net is the principal technical reference for DALS-IDS because it combines feature subspacing, classifier weighting, and meta-learning for intrusion detection in cloud-based intelligent transport systems [1]. DALS-IDS retains this general ensemble motivation but proposes LightGBM, ExtraTrees, and Random Forest as base learners, with Logistic Regression trained on out-of-fold predictions. Feature subspacing will provide each base learner with a different feature view. Whether this improves diversity and generalization will be assessed experimentally rather than assumed. C. Drift Awareness and Explainability DALS-IDS proposes a sliding window to estimate recent predictive performance and ADWIN to detect changes in a monitored stream. When a drift alarm occurs, the system will recalculate model weights and, where enough recent labeled data are available, consider retraining the meta-learner. This is a proposed extension to the ensemble approach discussed in FUSE-Net [1]; the behavior and value of drift-triggered updates remain to be validated. A SHAP-based explanation layer is planned to report influential features for each alert. Explanations will be treated as model-attribution evidence, not proof of causation or a guarantee that an alert is correct. The explanation layer and its runtime overhead will be measured as part of the planned evaluation. D. Base Research: FUSE-Net The primary reference for this proposal is FUSE-Net, a hybrid ensemble framework for intrusion detection in cloud-based intelligent transport systems. It combines feature subspacing, classifier weighting, and meta-learning, using Random Forest, XGBoost, Gradient Boosting, and Support Vector Machines. Its reported evaluation uses network intrusion datasets [1]. DALSIDS adopts the broad motivation of combining diverse learners for transport-related cybersecurity, but proposes LightGBM, ExtraTrees, and Random Forest as base learners and makes drift response, fold-local preprocessing, cross-dataset protocol design, and CPU-only efficiency explicit research targets. Unlike the reported FUSE-Net results, DALS-IDS is a proposal and does not claim measured performance. E. Smart Transport and Intelligent Infrastructure Context Ahmad et al. describe Industry 4.0 foundations for smart transport, including cyber-physical systems, Industrial IoT sensing, edge–cloud analytics, and secure interoperability [2]. These themes motivate a distributed DALS-IDS design in which time-sensitive inference may run at a vehicle gateway or roadside unit while model management and retraining can be handled in the cloud. Shaaban and Adalbib discuss integrated and sustainable transport in Qatar, including the role of Intelligent Transport Systems in coordinating transport infrastructure and operations [3]. Alqahtani’s GlassSkyDeliver study examines an automated last-mile transport concept relying on real-time routing, tracking, and digital verification [4]. Although these works do not propose the DALS-IDS intrusion-detection method, they illustrate connected, datadependent transport environments in which availability, trustworthy communication, and timely anomaly detection matter. Gao investigates forecast-driven coordination of renewablerich energy hubs and transport-based storage under economic and social-welfare constraints [5]. This work broadens the smart-mobility context to include connected energy and transport infrastructure. DALS-IDS does not optimize energy dispatch; rather, it addresses the cybersecurity monitoring layer that may support the reliability of interconnected transport and supporting digital services. These contextual papers motivate the deployment setting, while the technical IDS design is primarily grounded in FUSE-Net [1].

The reviewed resources support vehicle-focused and general network IDS evaluation, tree-based learning, stacking, drift detection, resampling, and explainability. However, a single evaluation design must still address several connected issues: dynamic adaptation must be operational rather than merely described as dynamic; training-time preprocessing must be leakage-free; cross-dataset testing must account for schema differences; and performance must include both class-sensitive detection metrics and edge-resource costs. DALS-IDS proposes to combine these elements in one framework. Its intended contribution is not a claim that any individual algorithm is new, but a reproducible design for studying their integration under temporal drift, dataset shift, and edge-deployment constraints.

A. High-Level Workflow The proposed workflow is shown in Fig. 1 and consists of the following steps: 1) Inspect source data, remove only verified duplicate records, document missing values, and define the target labels. 2) Split data into training and testing partitions before fitting any preprocessing. Use chronological splitting for timeordered vehicular data where timestamps are available. 3) Build fold-local preprocessing pipelines for imputation, encoding, scaling where needed, and optional SMOTE. 4) Create separate feature subsets for LightGBM, ExtraTrees, and Random Forest. 5) Generate out-of-fold predictions from each base learner and use them to train the Logistic Regression meta-learner. 6) Monitor a sliding window of labeled outcomes and use ADWIN to detect changes in the monitored signal. 7) On a drift event, recalculate model weights from recent performance and, where sufficient labeled data exist, retrain the meta-learner on a recent window. 8) Produce predictions and SHAP-based feature explanations for alerts. 9) Evaluate detection quality, cross-dataset transfer, and CPUonly resource use.

Fig. 1. Proposed DALS-IDS workflow. The diagram represents a design proposal, not a validated implementation. B. Data Preparation and Leakage Control Duplicate handling will distinguish accidental duplicated rows from repeated CAN messages that are genuine observations. Since repeated CAN frames can be part of normal vehicle operation, rows will not be removed solely because their payloads match. Duplicate removal will be based on documented record identity or an explicitly justified deduplication rule. Missing values will be analyzed by feature and class. Numerical fields may be imputed using training-fold statistics, while categorical fields may use a training-fold mode or an explicit unknown category. Encoding, scaling, feature selection, and resampling will be fitted within each training fold using an imbalanced-learn-compatible pipeline. SMOTE will be used only when appropriate for the feature type and training partition. Because CAN payloads and IDs may be discrete or structured, synthetic interpolation may produce invalid records; therefore, SMOTE will be compared with class weighting or no resampling, and will not be assumed suitable for all CAN features. For time-based experiments, older observations will be used for training and newer observations for testing. Any validation folds will preserve temporal order where feasible. A separate stratified five-fold cross-validation experiment will be conducted for non-temporal within-dataset comparisons. These protocols answer different questions and will be reported separately. C. Feature Subspacing and Base Learners DALS-IDS uses three base learners: LightGBM, ExtraTrees, and Random Forest. Each learner will receive a defined feature subset to encourage diversity. Subsets may be created using domain-based groups, training-only feature ranking, or reproducible seeded selection. The subset-generation procedure will be recorded and fitted without access to the held-out test labels. K-Nearest Neighbors and Support Vector Machines are excluded from the proposed primary ensemble to keep the design focused on tree-based learners and to simplify CPU-only inference analysis. XGBoost will be included as a comparison baseline rather than a required DALS-IDS base learner. D. Stacking Layer For each training fold, base learners will be fitted on the fold’s training partition and will predict the held-out partition. Concatenated out-of-fold predictions form the meta-feature matrix used to train Logistic Regression. For binary classification, the meta-features may include attack probabilities or decision scores; for multiclass classification, the representation will be defined consistently across learners. After model selection, base learners are refitted on the complete training partition. The meta-learner is trained from OOF predictions generated only within that training partition. Test data are not used to fit the base learners, feature subsets, preprocessing transformations, weights, or meta-learner. E. Drift-Aware Dynamic Weighting Let m index the base models and t denote the current evaluation window. Let s(m,t) be a recent performance score calculated using labeled outcomes in that window. A non-negative normalized weight can be defined as (1) where τ controls how strongly recent performance affects the weights. The score may combine macro-F1 and a penalty for false positives, with the exact definition fixed before testing. The weighted base-model score can be combined with the Logistic Regression meta-learner, or the dynamic weights can be used as a separate comparison path. The final implementation will specify one primary decision rule to avoid ambiguity. ADWIN will monitor a predefined labeled error stream or another explicitly justified bounded statistic. If ADWIN signals a change, the system will recalculate weights using the most recent labeled window. If enough recent labeled examples are available, the meta-learner may also be retrained using recentwindow OOF predictions. The evaluation will report detection delay, number of drift alarms, and performance before and after alarms where the simulation supports these measurements. F. Explainability Layer For a detected or suspected intrusion, the explanation module will return the predicted class, prediction score, and the top SHAP features contributing to the prediction. TreeExplainer will be used for supported tree models. For the stacked output, explanations will be presented carefully: base-model feature attributions and the meta-learner’s influence on the combined prediction are distinct quantities. The interface will not imply that a base model’s SHAP values alone fully explain the complete stacked prediction. G. Deployment Concept The proposed deployment places preprocessing and inference on a vehicle gateway or roadside unit when compute and memory budgets permit. A cloud service may handle model training, model registry, and scheduled or drift-triggered retraining. Only necessary telemetry and approved feedback should be transmitted, with attention to privacy, bandwidth, and secure model updates. This architecture is a deployment concept and has not yet been tested on a real vehicle or RSU.

A. Experimental Protocol The evaluation will use two complementary protocols. First, within-dataset performance will be estimated using stratified five-fold cross-validation where samples can reasonably be treated as independent. Mean and standard deviation will be reported across folds. Second, temporal and cross-dataset experiments will use separate source and target partitions, with no target-test labels used for tuning, resampling, feature selection, or threshold selection. Time-based splits will place older records in training and newer records in testing. The primary comparison will include DALS-IDS, plain stacking without drift adaptation, a static F1-weighted softvoting baseline, standalone Random Forest, standalone LightGBM, and XGBoost. ExtraTrees will also be evaluated as a standalone learner. A CNN or LSTM may be added as an optional comparison if its data requirements and computational cost can be supported. All comparisons will use consistent data partitions and documented tuning budgets.

B. Detection Metrics The planned detection metrics are:

• Macro-F1: gives equal weight to each class and highlights minority-class performance.
• Per-class recall: measures the proportion of each class correctly detected.
• PR-AUC: summarizes precision-recall behavior, especially where positive classes are rare; the positive-class definition will be stated for each experiment.
• MCC: provides a balanced summary of binary classification quality and will be computed using an appropriate multiclass extension when required.
• False-positive rate: measures the proportion of benign examples incorrectly flagged as attacks. C. Efficiency Metrics Efficiency will be measured on a documented CPU-only machine with hardware, operating system, software versions, thread settings, and batch size reported. The planned measures are single-sample and 1,000-sample inference latency, throughput in samples per second, serialized model size, and peak RAM usage in megabytes. Warm-up, preprocessing time, and model-only inference time will be reported separately where practical. No latency or memory values are claimed in this proposal. D. Statistical Analysis For cross-validation experiments, results will be reported as mean ± standard deviation. Where paired test-fold or repeatedrun results are appropriate, the Wilcoxon signed-rank test will be used to compare DALS-IDS with selected baselines. The comparison unit, number of paired observations, significance threshold, and any correction for multiple comparisons will be stated before analysis. Statistical significance will not be interpreted as practical importance without considering effect size and resource cost. E. Drift Simulation Drift will be evaluated using time-ordered data and controlled changes in the evaluated stream where justified. ADWIN will monitor a preselected error signal when labels are available. The study will report detection delay, false drift alarms, the number of updates, and macro-F1 or error rate before and after drift events. Artificial drift injection will be clearly distinguished from naturally occurring temporal changes in a dataset. F. Ablation Study The following ablations are planned: 1) remove the drift-aware module and retain plain stacking; 2) remove SHAP explanations to measure their computational overhead, not their effect on predictive accuracy unless the explanation layer influences the pipeline; 3) remove feature subspacing and provide the full feature set to each base learner; 4) compare SMOTE with class weighting and no resampling; 5) compare dynamic weighting alone with dynamic weighting plus recent-window meta-learner retraining.

The expected contributions of DALS-IDS are:

• a leakage-controlled and reproducible training and evaluation pipeline;
• a practical design for updating ensemble weights in response to ADWIN drift alarms;
• a lightweight tree-based stacking configuration intended for CPU-only edge inference;
• a cross-dataset evaluation plan covering vehicular CAN traffic and network flows;
• per-class and class-imbalance-sensitive reporting instead of accuracy alone;
• SHAP-based feature explanations to support inspection of individual alerts;
• explicit measurement of latency, throughput, model size, and peak memory. These are expected design contributions, not experimentally established outcomes. The proposed framework may fail to outperform simpler baselines, particularly when the datasets are small, feature alignment is weak, or drift labels arrive too late for useful adaptation.

First, this paper presents a proposal and contains no experimental validation. The effectiveness of dynamic weighting, stacking, and feature subspacing remains to be tested. Second, ADWIN requires a monitored signal and meaningful feedback. Delayed labels or inaccurate proxy labels may postpone or misdirect adaptation. Third, publicly available CAN datasets can reflect laboratory or controlled capture conditions that differ from live traffic. Fourth, SMOTE may generate unrealistic examples for discrete or structured CAN data; alternatives such as class weighting must therefore be tested. Fifth, cross-dataset evaluation depends on semantically compatible feature definitions and labels. A shared column name does not establish that two features measure the same quantity. Sixth, the proposal does not currently cover adversarial evasion, zero-day detection, or attacks outside the selected label space. Seventh, SHAP explanations may be costly and should be profiled on edge hardware. Finally, performance on a CPU test machine does not by itself establish real-time safety or suitability for a production vehicle. Real deployment would require security, privacy, reliability, and operational testing.

Future work will implement a small prototype and report measured results for detection, drift response, explainability, and resource consumption. Additional directions include online learning, federated learning that avoids transferring raw vehicle data, and unsupervised or semi-supervised anomaly detection for previously unseen attacks. Adversarial robustness testing will be added to examine whether carefully modified traffic can evade the detector. A further step is deployment on a vehicle gateway or RSU testbed under controlled conditions. Data collection that reflects a wider range of traffic environments, including African traffic and road conditions, could help investigate geographic and operational variation. Model compression methods such as quantization and pruning may also be studied to reduce the resource requirements of smaller edge devices. These directions will be pursued only after the core evaluation pipeline is reproducible.

This paper proposed DALS-IDS, a Drift-Aware Lightweight Stacking IDS for Smart Transport Systems. The framework combines LightGBM, ExtraTrees, and Random Forest base learners, feature subspacing, an OOF-trained Logistic Regression meta-learner, sliding-window performance monitoring, ADWIN-triggered updates, and SHAP-based alert explanations. Its evaluation plan emphasizes leakage-free preprocessing, time-based testing, cross-dataset transfer, perclass detection metrics, and CPU-only efficiency measurements. The proposed study will examine vehicular CAN-bus datasets alongside network intrusion datasets, while explicitly accounting for differences in schema and label definitions. The design also recognizes practical constraints, including delayed feedback for drift detection, the uncertain suitability of SMOTE for structured CAN traffic, and the gap between public datasets and live deployment. DALS-IDS is therefore a research proposal rather than a validated IDS. Its effectiveness and edge suitability can be established only through implementation and controlled evaluation.