TSN LDoS Intrusion Detection System (TSN-LDoS-IDS)

This Python-based project performs intrusion detection using machine learning on pre-implemented Low-Rate Denial-of-Service (LDoS) attack scenarios in a TSN-based in-vehicle communication network simulation. The approach utilizes various machine learning algorithms (e.g., SVM, KNN, Decision Tree, Random Forest, XGBoost, LightGBM) to classify network traffic as normal or malicious, and evaluates performance using common metrics (accuracy, precision, recall, F1-score).

Project Overview

TSN-LDoS-IDS is designed to detect LDoS attacks in a TSN-based in-vehicle network. The system processes raw CSV data generated by OMNeT++ simulations, extracts relevant features, and applies different machine learning models to determine the effectiveness of intrusion detection.

Repository Contents

This project is executed through the main script (main.py). The workflow is as follows:

1. main.py (Main Execution Script)

• Loads raw datasets (normal and attack scenarios).
• Processes data, extracts features, and saves the ML-ready dataset.
• Executes all scenarios using all ML models.
• Stores results in output/results.txt.
• To run only selected models, comment out the unwanted models in the ml_methods list inside classification.py.

2. data_handling.py (Data Processing & Feature Extraction)

• Converts MAC addresses and string-based IDs into numeric format.
• Applies feature extraction by computing timestamp differences and tracking previous stream IDs.
• Stores the processed dataset for training and evaluation.

3. classification.py (Machine Learning Models & Training/Testing)

• Supported ML algorithms: KNN, Decision Tree, Random Forest, XGBoost, LightGBM, SVM
• For performance evaluation, 5-Fold Cross-Validation is applied, and the model's performance is assessed using accuracy, precision, recall, and F1-score metrics.

Project Structure

TSN-LDoS-IDS/
│
├── output/
│   └── results.txt           # Performance results (created/updated by main.py)
│
├── src/
│   ├── main.py               # Main orchestrator script
│   ├── classification.py     # ML model definitions & training/testing routine
│   └── data_handling.py      # Data loading, parsing, feature extraction 
│
├── tsn_dataset/
│   ├── ml_dataset/           # Processed datasets for ML
│   │   ├── as1.csv
│   │   ├── as2.csv
│   │   ├── ...
│   │   └── ns.csv
│   │
│   └── raw_dataset/          # Original data from OMNeT++
│       ├── normal_scenario/
│       │   └── <ns.csv>
│       └── attack_scenarios/
│           ├── <as1.csv>
│           ├── <as2.csv>
│           └── ...
│
└── README.md                 # Project documentation (this file)

Installation and Usage

1. Make sure you have Python 3.7+ installed. Then install the required packages:

pip install -r requirements.txt

Alternatively, install them individually:

pip install numpy scikit-learn imbalanced-learn xgboost lightgbm

2. Clone or download this repository.

3. Check raw scenario data (both normal and attacks) in the correct folders:

• Normal: tsn_dataset/raw_dataset/normal_scenario/
• Attack: tsn_dataset/raw_dataset/attack_scenarios/

4. Navigate to the src/ folder

cd TSN-IDS/src

5. Run the main script:

python main.py

Dataset Explanation

1. raw_dataset: Each line in the CSV format (in raw_dataset) typically contains 7 feature and label:

• f1: timestamp,
• f2: stream_id,
• f3: source_id,
• f4: destination_id,
• f5: source_mac,
• f6: destination_mac,
• f7: packet_length,
• label (0: benign, 1: malicious)

2. ml_dataset: After processing and feature extraction, each row (starting from index 3) contains 11 feature and label:

• f1: timestamp,
• f2: last_remote_timestamp,
• f3: stream_id,
• f4: prev_stream_id,
• f5: prev_prev_stream_id,
• f6: prev_prev_prev_stream_id,
• f7: source_id,
• f8: destination_id,
• f9: packet_source_mac,
• f10: packet_dest_mac,
• f11: packet_length
• label (0: benign, 1: malicious)

3. ID conversion table from text to numerical form

• 1: Cam1
• 2: Cam2
• 3: Cam3
• 4: DA-Cam
• 5: HU
• 6: RSE
• 7: Telematics
• 8: CU
• 9: CD-Audio DVD
• 10: Cam4
• 11: Switch1
• 12: Switch2

4. MAC adresses table

Stream	Source	Source MAC	Destination	Destination MAC
S1	DA-Cam	0A-AA-00-00-00-0D	HU	AB-AA-00-00-00-01
S2	DA-Cam	0A-AA-00-00-00-0D	HU	AB-AA-00-00-00-02
S3	DA-Cam	0A-AA-00-00-00-0D	CU	AB-AA-00-00-00-03
S4	DA-Cam	0A-AA-00-00-00-0D	CU	AB-AA-00-00-00-04
S5	HU	0A-AA-00-00-00-0E	CU	AB-AA-00-00-00-06
S6	HU	0A-AA-00-00-00-0E	CU	AB-AA-00-00-00-07
S7	HU	0A-AA-00-00-00-0E	CU	AB-AA-00-00-00-08
S8	HU	0A-AA-00-00-00-0E	CU	AB-AA-00-00-00-09
S9	HU	0A-AA-00-00-00-0E	CU	AB-AA-00-00-00-0A
S10	HU	0A-AA-00-00-00-0E	CU	AB-AA-00-00-00-0B
S11	HU	0A-AA-00-00-00-0E	CU	AB-AA-00-00-00-0C
S12	HU	0A-AA-00-00-00-0E	CU	AB-AA-00-00-00-0D
S13	HU	0A-AA-00-00-00-0E	DA-Cam	AB-AA-00-00-00-0E
S14	HU	0A-AA-00-00-00-0E	DA-Cam	AB-AA-00-00-00-0F
S15	HU	0A-AA-00-00-00-0E	DA-Cam	AB-AA-00-00-00-10
S16	CU	0A-AA-00-00-00-16	HU	AB-AA-00-00-00-19
S17	CU	0A-AA-00-00-00-16	HU	AB-AA-00-00-00-1A
S18	CU	0A-AA-00-00-00-16	HU	AB-AA-00-00-00-1B
S19	CU	0A-AA-00-00-00-16	HU	AB-AA-00-00-00-1C
S20	CU	0A-AA-00-00-00-16	HU	AB-AA-00-00-00-1D
S21	CU	0A-AA-00-00-00-16	DA-Cam	AB-AA-00-00-00-1E
S22	CU	0A-AA-00-00-00-16	DA-Cam	AB-AA-00-00-00-1F
S23	Cam 1	0A-AA-00-00-00-0F	DA-Cam	AB-AA-00-00-00-11
S24	Cam 2	0A-AA-00-00-00-10	DA-Cam	AB-AA-00-00-00-12
S25	Cam 3	0A-AA-00-00-00-11	DA-Cam	AB-AA-00-00-00-13
S26	Cam 4	0A-AA-00-00-00-12	DA-Cam	AB-AA-00-00-00-14
S27	DA-Cam	0A-AA-00-00-00-0D	HU	AB-AA-00-00-00-05
S28	Telematics	0A-AA-00-00-00-14	RSE	AB-AA-00-00-00-15
S29	Telematics	0A-AA-00-00-00-14	HU	AB-AA-00-00-00-16
S30	CD/DVD	0A-AA-00-00-00-15	RSE	AB-AA-00-00-00-17
S31	CD/DVD	0A-AA-00-00-00-15	RSE	AB-AA-00-00-00-18

Citation

If you use this repository or the accompanying dataset in academic work, please cite:

@article{topsakal2025machine,
  author    = {Topsakal, Mustafa and Cevher, Sel{\c{c}}uk and Ergen{\c{c}}, Do{\u{g}}analp},
  title     = {{A Machine Learning-based Intrusion Detection Framework with Labeled Dataset Generation for IEEE 802.1 Time-Sensitive Networking}},
  journal   = {Journal of Systems Architecture},
  volume    = {164},
  pages     = {103408},
  year      = {2025},
  month     = jul,
  publisher = {Elsevier},
  doi       = {10.1016/j.sysarc.2025.103408}
}

License

This project is licensed under the MIT License — see LICENSE for details.