XGBoost-Based Anomaly Detection Framework for SOME/IP in In-Vehicle Networks

SOME/IP is a core AUTOSAR middleware for Automotive Ethernet, enabling scalable service-oriented communication among distributed embedded devices; however, its lack of built-in authentication, encryption, and integrity protection exposes vehicles to threats such as eavesdropping, denial-of-service, fuzzing, and man-in-the-middle attacks. To study these risks, we empirically reproduce representative attack behaviors in a realistic SOME/IP simulation and propose an anomaly detection framework tailored to SOME/IP traffic. The framework parses raw Ethernet frames into layered SOME/IP and SOME/IP Service Discovery representations and extracts behavior-centric features, including time-interval variation, payload likelihood and entropy, and payload and length change rates. Based on these features, it performs real-time classification using an XGBoost-based model. Experimental evaluation on a large-scale dataset demonstrates that the proposed approach achieves 0.93 PR-AUC, 0.99 ROC-AUC, and a 0.97 F1-score on a real-world-reflective, imbalanced dataset, while also delivering an end-to-end efficiency of 0.556 ms per packet, covering both feature generation and XGBoost inference.