[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-85264-en":3,"doc-seo-85264-105":29,"detail-sidebar-cat-0-en-105":90},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},85264,1374391974585,"Genevieve","https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c",8,"Research & Report","SoK Federated Learning for Intrusion Detection in Vehicular Networks","Modern vehicular networks expand their attack surface across internal Electronic Control Units (ECUs) and external Vehicle-to-Everything (V2X) communication. Federated Learning (FL) enables decentralized Intrusion Detection Systems (IDS) while protecting traffic privacy, yet the FL-IDS literature is fragmented and often built on unrealistic experiments. This Systematization of Knowledge (SoK) unifies vehicular attack-surface taxonomy, evaluates FL topologies, and maps poisoning and inference threats, auditing 60+ publications. Recurring pitfalls include IID splits, weak adversarial testing, and omission of real-time CAN constraints, followed by a benchmarking agenda.","SoK: Federated Learning for Intrusion Detection in  \nVehicular Networks  \nYahya Shahsavari∗ , Reza Nourmohammadi∗ , Sara Rouhani+∗, Kaiwen Zhang∗  \n∗Department of Software and IT Engineering, ´Ecole de technologie suprieure (´ETS)  \nMontral, Qubec, Canada  \n+Department of Computer Science, University of Calgary  \nCalgary, Alberta, Canada  \n[yahya.shahsavari@etsmtl.ca](yahya.shahsavari@etsmtl.ca), [reza.nourmohammadi.1@ens.etsmtl.ca](reza.nourmohammadi.1@ens.etsmtl.ca), sara.rouhani@ucalgary.ca,  \n[kaiwen.zhang@etsmtl.ca](kaiwen.zhang@etsmtl.ca)  \narXiv :2607 . 109 14v 1 [ cs .CR] 12 Jul 2026  \nAbstract—Modern vehicular networks face an expanding attack surface across internal Electronic Control Units (ECUs) and external Vehicle-to-Everything (V2X) communication. Federated Learning (FL) has emerged as a decentralized paradigm to deploy Intrusion Detection Systems (IDS) without compromising data privacy. However, the vehicular FL-IDS literature suffers from fragmented methodologies and unrealistic experimental setups. This paper presents a Systematization of Knowledge (SoK) that unifies the taxonomy of vehicular attack surfaces, evaluates FL topologies, and maps adversarial threats such as poisoning and inference attacks. By auditing over 60 publications, we identify recurring pitfalls: artificial IID data splits, reliance on trivial benchmarks, weak adversarial evaluation, and omission of real-time CAN constraints. Finally, we define a forwardlooking research agenda and outline minimum benchmarking requirements necessary to transition vehicular FL-IDS from optimistic simulations to secure, real-world deployment.  \nIndex Terms—Federated Learning, Intrusion Detection Systems, Vehicular Networks, Controller Area Network Bus, Vehicleto-Everything (V2X), Internet of Vehicles, Adversarial Machine Learning, Automotive Security.  \nI. INTRODUCTION  \nMODERN vehicles are no longer isolated mechanical  \nsystems; they are deeply networked cyber-physical platforms. A contemporary automobile contains upward of 100 Electronic Control Units (ECUs) interconnected via the Controller Area Network (CAN) bus, FlexRay, Local Interconnect Network (LIN), and increasingly Automotive Ethernet [1] . Beyond the vehicle boundary, Vehicle-to-Everything (V2X) communication standards (i.e., Dedicated Short-Range Communications (DSRC) and Cellular V2X (C-V2X)) enable interaction with roadside infrastructure, other vehicles, pedestrians, and network services. These connectivity layers expand the attack surface dramatically: remote compromise of invehicle systems can alter braking, steering, or acceleration; misbehaving V2X messages can corrupt shared situational awareness and trigger accidents [2] .  \nTraditional Intrusion Detection Systems for vehicular networks face a structural tension: effective anomaly detection is data-hungry and benefits from cross-fleet knowledge [3], yet vehicle traffic data is operationally sensitive, legally constrained by data-protection regulations, such as GDPR and UN Regulation (No. 155 - Cyber security and cyber security  \nmanagement system), and practically difficult to centralize due to bandwidth and latency constraints [4] . Federated Learning (FL) [5] resolves this tension in principle: vehicles train local models on-board and exchange only model updates (gradients or parameters) with an aggregation server, without exposing raw traffic.  \nFL-based vehicular IDS research has grown rapidly since 2020, but the literature remains fragmented across protected layers, FL topologies, model choices, datasets, adversarial assumptions, and evaluation metrics. This SoK examines which findings are well supported, which may result from unrealistic assumptions, and which challenges remain open. This SoK paper makes the following contributions:  \n• A unified taxonomy of vehicular network architectures, attack surfaces, and threat actors, serving as a common reference frame (IV) .  \n• A systematic classification of FL-IDS architectures applie","cbCaiaAdNOGq7rH9","https://ap.wps.com/l/cbCaiaAdNOGq7rH9","pdf",586313,1,10,"English","en",105,"# Introduction\n## Problem Context and Motivation\n# Survey Methodology\n## Literature Identification and Coding Protocol","[{\"question\":\"Why is Federated Learning used for vehicular intrusion detection?\",\"answer\":\"Federated Learning trains local models on vehicles and shares only model updates, reducing exposure of raw traffic data that is sensitive and constrained by regulations and practical latency/bandwidth limits.\"},{\"question\":\"What main issues does the SoK paper find in existing FL-IDS research?\",\"answer\":\"The audit of 60+ publications identifies recurring pitfalls such as artificial IID data splits, reliance on trivial benchmarks, weak adversarial evaluation, and neglect of real-time CAN bus constraints.\"},{\"question\":\"Which adversarial threats are analyzed for federated vehicular IDS?\",\"answer\":\"The paper maps threats including poisoning attacks (e.g., data/model poisoning and Byzantine-style behaviors) and inference attacks, and it critiques existing defenses in those settings.\"}]",1784202150,25,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":85,"head_meta":87,"extra_data":89,"updated_unix":27},"sok-federated-learning-for-intrusion-detection-in-vehicular-networks","",{"@graph":35,"@context":84},[36,53,67],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/sok-federated-learning-for-intrusion-detection-in-vehicular-networks/85264/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":61,"encodingFormat":60,"isAccessibleForFree":62,"interactionStatistic":63},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-16",true,{"@type":64,"interactionType":65,"userInteractionCount":4},"InteractionCounter",{"@type":66},"ViewAction",{"@type":68,"mainEntity":69},"FAQPage",[70,76,80],{"name":71,"@type":72,"acceptedAnswer":73},"Why is Federated Learning used for vehicular intrusion detection?","Question",{"text":74,"@type":75},"Federated Learning trains local models on vehicles and shares only model updates, reducing exposure of raw traffic data that is sensitive and constrained by regulations and practical latency/bandwidth limits.","Answer",{"name":77,"@type":72,"acceptedAnswer":78},"What main issues does the SoK paper find in existing FL-IDS research?",{"text":79,"@type":75},"The audit of 60+ publications identifies recurring pitfalls such as artificial IID data splits, reliance on trivial benchmarks, weak adversarial evaluation, and neglect of real-time CAN bus constraints.",{"name":81,"@type":72,"acceptedAnswer":82},"Which adversarial threats are analyzed for federated vehicular IDS?",{"text":83,"@type":75},"The paper maps threats including poisoning attacks (e.g., data/model poisoning and Byzantine-style behaviors) and inference attacks, and it critiques existing defenses in those settings.","https://schema.org",{"og:url":51,"og:type":86,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":88,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":91},[92,96,100,104,109,114,119,122,127,130,133],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":93,"show_sort_weight":94,"slug":95},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":97,"show_sort_weight":98,"slug":99},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":101,"show_sort_weight":102,"slug":103},"Exam",70,"exam",{"id":105,"doc_module":4,"doc_module_name":45,"category_name":106,"show_sort_weight":107,"slug":108},5,"Comic",60,"comic",{"id":110,"doc_module":4,"doc_module_name":45,"category_name":111,"show_sort_weight":112,"slug":113},6,"Technology",50,"technology",{"id":115,"doc_module":4,"doc_module_name":45,"category_name":116,"show_sort_weight":117,"slug":118},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":21,"doc_module":4,"doc_module_name":45,"category_name":131,"show_sort_weight":21,"slug":132},"Lifestyle","lifestyle",{"id":134,"doc_module":4,"doc_module_name":45,"category_name":135,"show_sort_weight":105,"slug":136},19,"General","general"]