# Toward Generative AI-Based Intrusion Detection Systems for the Internet of Vehicles (IoV)
## 3 Generative AI for Threat Detection
### AutoRegressive Models (ARMs)  
AutoRegressive Models are a class of statistical models used to analyze and predict time series data by regressing current values on their own previous values (lags). According to the paper [66], ARMs are extended to account for potential regime shifts through Markov Switching, resulting in models where the autoregressive parameters vary depending on an unobserved state or \"regime\" that follows a Markov process. These models capture both time dependency and structural changes in data, which are common in economic and financial systems. The general formulation presented includes the possibility of an infinite number of past observations influencing the current value, forming what is known as a General AutoRegressive Model with Markov Switching (GARMS) [66].  
In ARMs, the current value \(\mathrm{Yt}\) depends on past values and a random shock. In a Markov-switching setting, the model becomes:  
\[\mathrm{Yt}=\mu(\mathrm{Xt})+\sum\beta\mathrm{i}(\mathrm{Xt})\mathrm{Yt}- \mathrm{i}+\sigma(\mathrm{Xt})\mathrm{nt}\]  
where \(\mathrm{Xt}\) is the hidden regime at time \(\mathrm{t}\), and the coefficients \(\mu\), \(\beta\mathrm{i}\), \(\sigma\) vary with \(\mathrm{Xt}\). The regime follows a Markov chain, and estimation is conducted via maximum likelihood, often using matrix operations to manage the hidden states. This setup allows the model to adapt to changes in behavior across time. This means the model can switch between different patterns depending on the current regime, making it flexible for real-world time series that experience shifts over time [66].  
To clarify their function, AutoRegressive Models (ARMs) can be understood as models that predict the present based on the past. They accomplish this by linking current values in a time series to previous values--capturing how past behavior influences future outcomes. When extended with Markov Switching, the model adapts to changes in patterns over time by assuming that the system operates under different hidden \"regimes\" or states. Each  
Figure 8: The architecture of the GDM.  
regime follows its own rules, and the model switches between them based on a probabilistic process. This allows ARMs to handle shifts in behavior, making them well suited for analyzing complex, time-dependent data that may change across different conditions.  
AutoRegressive Models can be used in cybersecurity to detect attacks by modeling normal system behavior over time, such as network traffic or login patterns. By predicting future values based on past data, ARMs can flag anomalies when actual behavior deviates from expected trends. These deviations may indicate attacks like intrusions or DDoS events. Using Markov-switching, ARMs enhances detection by allowing the model to adapt to different normal states, improving accuracy and reducing false alarms. This makes ARMs a powerful tool for early threat detection in dynamic environments.  
Table 6 presents a comparative summary of the discussed generative models, outlining their core mechanisms and main technical strengths.