## 1 Introduction  
The Internet of Vehicles (IoV) is a cornerstone of modern intelligent transportation systems, merging vehicular communication technologies with cloud-based infrastructures to improve safety, efficiency, and real-time decision-making on the road. By enabling vehicle-to-everything (V2X) communication, IoV supports applications ranging from autonomous driving to real-time traffic management [1, 2]. At the heart of vehicle communication is the Controller Area Network (CAN), a critical component of modern automotive systems. It was originally designed for use in vehicles, but also has applications in other industries such as aerospace, medical devices, and commercial machinery [3]. The CAN protocol is a lightweight and robust communication standard designed for real-time data exchange between Electronic Control Units (ECU) in vehicles [3, 4, 5]. Introduced in the 1980s, the CAN bus enables efficient message transmission without the need for a centralized control mechanism. Its ability to prioritize messages using an arbitration-based system ensures reliability even under high traffic loads [1, 5, 6]. The CAN protocol was originally created for conventional isolated vehicles, without incorporating any security features [3; 7]. As a result, it lacks essential security features such as encryption and authentication, making it vulnerable to various cyberattacks and expanding the attack surface of vehicular systems [1; 8]. Attackers can exploit these weaknesses to inject spoofed messages, disrupt communication, or cause malfunctioning in safety-critical components, demonstrating that the ability to identify intrusions in the CAN bus is a critical component of IoV security [1; 4]. To address these critical security challenges, instrusion detection systems (IDS) have emerged as a critical defense mechanism in IoV environments [9; 10; 11; 12]. These systems rely on Traditional Machine Learning (TML), Deep Learning (DL) and Deep Transfer Learning (DTL) techniques to detect anomalous patterns in network traffic that indicate potential ongoing cyberattacks [8; 13]. Despite the significant transition from traditional signature-based IDS to anomaly-based systems [14], several challenges remain. One of the primary issues is the inherent imbalance in IoV datasets, where benign traffic far outweighs malicious instances, potentially leading to a biased machine learning (ML) model that fails to effectively detect minority attack classes. Another obstacle is the lack of realistic and recent IoV datasets, which poses a significant challenge to the advancement of IDS technology for IoV and hinders the ability to train and evaluate the effectiveness of these systems in realistic scenarios. Furthermore, the multi-class nature of IoV traffic requires IDS to distinguish between several types of attacks, often with overlapping characteristics [8]. Existing IDS approaches often fall short of providing robust performance in real-world IoV scenarios, that is, the ability of intrusion detection models to generalize to real-world traffic conditions, maintain high accuracy and consistency across metrics, and detect minority attack classes without bias toward dominant benign traffic. The CICIoV2024 dataset [8] provides a benchmark for addressing these challenges. Collected from a fully equipped vehicular testbed, including the CAN bus, this dataset contains realistic vehicular traffic data, incorporating various attack scenarios such as Denial-of-Service (DoS), Gas Spoofing, Speed Spoofing, Steering Wheel Spoofing, and Revolutions Per Minute (RPM) Spoofing within an imbalanced distribution that mirrors real-world scenarios, making it an ideal dataset for evaluating IDS models under these conditions [8]. Although existing studies have applied traditional ML algorithms, such as Random Forest [5] and XGBoost [15], as well as DL architectures such as Convolutional Neural Network (CNN) [16], many have relied on artificially balanced datasets that do not capture the challenges of real-world deployments.