An Overview of Various Frame Works on Learning Based Adaptive Cyber Security on Software Defined Embedded Systems

Abstract

Embedded communication networks sit at the centre of modern intelligent systems, from passenger vehicles and unmanned aerial vehicles to industrial controllers. The Controller Area Network (CAN) family, now in its third generation with CAN XL, carries most of this traffic, yet the protocol was designed for reliability rather than security and offers no native authentication or encryption. Remote exploits demonstrated on production vehicles have shown that this gap has direct safety consequences. This survey reviews the research that combines machine learning (ML) with software-defined networking concepts to protect these networks. We first summarise the evolution of embedded communication protocols and the properties of CAN XL that matter for security, then organise the known attacks into a taxonomy spanning the physical, protocol, and application layers. We examine why cryptographic schemes, rule-based intrusion detection, and physical fingerprinting fall short on their own, and then review learning-based intrusion detection in depth: classical classifiers, deep spatial-temporal models, graph neural networks, generative approaches, and federated learning. We also cover software-defined security architectures that turn detection results into dynamic policy enforcement, and the hardware questions that decide whether any of this can run on a real electronic control unit: FPGA integration, model compression, physical unclonable functions, and compliance with ISO 26262 and ISO/SAE 21434. The survey closes with open problems, including zero-day generalisation, adversarial robustness, benchmark standardisation, and explainability, and argues that the most promising direction is the tight integration of hardware-rooted authentication, lightweight ML detection, and software-defined response in a single closed loop.