Explainable and Deployment-Aware Zero-Day Intrusion Detection for Cloud-Level Backend and Management Ecosystems in EV/V2X Cyber–Physical Systems

Abstract

With the escalating frequency of sophisticated zero-day attacks, overcoming the critical limitations of signature-based Intrusion Detection Systems (IDSs) has become paramount. This study proposes a hybrid multi-layered intrusion detection framework combining traditional machine learning, Deep Neural Architectures (DenseNN), and ensemble methods to evaluate zero-day resilience within cloud-level backend connectivity interfacing EV and V2X management ecosystems. Using the comprehensive CSE-CIC-IDS2018 benchmark as a surrogate environment, a code-executed Leave-One-Attack-Out (LOAO) cross-validation protocol across 13 distinct attack families was implemented to assess unseen-attack-family generalization within the benchmark to unseen threats. Furthermore, Explainable Artificial Intelligence (XAI) auditing, utilizing SHapley Additive exPlanations (SHAP) and Integrated Gradients, was integrated to inspect decision boundaries and resolve feature-attribution failure modes. Critically, the audit identified an artifact-driven data leakage caused by the Timestamp and identifier features, demonstrating that models learned temporal schedules rather than behavioral network signatures. Re-executing all experiments post-leakage removal quantified performance drops across all classifiers (e.g., Gaussian NB dropping by up to 20.88 percentage points in accuracy (at the 60% training ratio; 18.30 points at the 80% ratio)). Under standard binary classification metrics, tree ensembles (Random Forest and Extra Trees) achieved high in-distribution detection (F1 > 0.95) with rapid inference latency (≈0.05–−0.07 ms/sample). However, the rigorous LOAO evaluation revealed a substantial generalization penalty on truly unseen zero-day families (e.g., SQL Injection and Infiltration), where simpler linear models demonstrated broader generalization robustness (mean LOAO F1 = 0.397) compared with complex tree-ensemble models. By rectifying dataset leakage and benchmarking deployment trade-offs (training runtime, throughput, and memory footprint), this study delivers actionable, transparent guidelines for deployment-oriented IDS evaluation in dynamic network infrastructures.