## 6 Conclusions and Future Work  
This research addressed the challenge of optimizing machine learning models for imbalanced, multi-class intrusion detection in the Internet of Vehicles. The results show that ensemble models such as Random Forest, Extra Trees, and XGBoost, when paired with targeted hyperparameter tuning using Optuna [18], consistently deliver high performance. These models not only handled the imbalance in the dataset but also successfully identified minority attacks, such as Gas Spoofing and RPM Spoofing, which are critical for real-world deployment. Deep Neural Networks also proved effective, although they required additional steps, such as early stopping to prevent overfitting. Simpler models, such as Logistic Regression and AdaBoost, were less effective in this context, as they struggled with minority class detection and were not as adaptable to the imbalanced data structure. These results highlight the importance of using realistic datasets such as CICIoV2024 [8]. By preserving the natural traffic distribution, we were able to test how well the models perform under real-world conditions, where benign traffic vastly outweighs malicious attacks. This approach avoids the risks of creating artificial scenarios that do not replicate real-world IoV environments. The study also underscores the need for IDS to evolve with the increasing complexity of connected vehicular systems to effectively address emerging threats. Despite these promising results, there are several limitations that need to be addressed. One concern is the potential for overfitting as the results for RF, ET, XGBoost, and DNN achieved perfect scores. This could be the result of very distinct attack signatures. Nonetheless, further research is needed with different approaches to mitigate the risk for overfit, particularly with more complex models such as DNN, which may not generalize well to unseen data despite performing well on the training sets. This is particularly relevant in IoV environments, where new and unforeseen attack patterns may emerge. Overfitting could limit the model's ability to adapt when facing new threats, making it critical to implement regularization techniques or explore methods such as cross-validation across different datasets to improve model efficiency. Additionally, while this study focused on a specific set of models, the need for diverse model exploration remains critical. By increasing the range of models considered, we could potentially improve detection performance for different types of attacks. Different models bring different strengths to the table, and exploring how combinations of models or even hybrid approaches could improve results could prove invaluable, as seen in previous studies [3; 10; 20; 22]. Diversifying the model pool would also help to mitigate issues of model-specific limitations and provide greater flexibility in detecting complex or evolving threats in IoV systems. Going forward, several opportunities for further research remain. Real-time detection methods that adapt to changing attack patterns could make these systems more practical for deployment. Incorporating domain-specific features of the CAN protocol could also improve accuracy and efficiency. In addition, the evaluation of these models in different IoV environments and with different datasets will be critical to confirm their broad applicability and identify areas for improvement. Ultimately, these advances underscore the importance of using realistic datasets and continuously refining IDS strategies to improve the security and reliability of vehicular networks in practical settings. This work provides a foundation for future efforts to develop more adaptable and scalable solutions for securing connected vehicles. Conceptualization, methodology, data curation: A.P., M.A. and A.A.; visualization, investigation, software, writing--original draft preparation: A.P. ; formal analysis, validation, writing--review and editing: A.P., M.A., A.A. and J.B.; project administration, supervision: A.A., M.A.