# Toward Generative AI-Based Intrusion Detection Systems for the Internet of Vehicles (IoV)
## 4 Generative AI-Based IDS for IoV
### Comparative Analysis: Generative AI's Role in Addressing Traditional ML/DL Limitations  
While ML- and DL-based intrusion detection systems have played a foundational role in enhancing vehicular cybersecurity, their effectiveness remains constrained by several critical limitations, including high false positive rates, poor generalization to unseen threats, reliance on extensive labeled datasets, and inadequate adaptability in dynamic environments. Generative AI-based IDS, as demonstrated across recent works, provide compelling solutions to these challenges by leveraging advanced architectures capable of modeling complex data distributions, generating synthetic training data, and learning contextual patterns more effectively. One of the most prominent shortcomings of conventional ML/DL methods is their inability to reliably detect zero-day attacks or generalize to unfamiliar inputs. Most models are trained on predefined, labeled datasets and often fail when confronted with novel attack patterns. In contrast, generative models such as the GAN-based IDS proposed by [PERSON] et al. [72] detect unknown CAN bus attacks by being trained solely on normal traffic, achieving approximately 98% detection accuracy for unseen threats. Likewise, transformer-based models like CAN-Former [78] and IoV-BERT-IDS [85] rely on self-supervised or masked training schemes to learn long-range dependencies and temporal structures within CAN or V2X sequences, which significantly boosts their capacity to recognize anomalous behavior beyond the scope of their training data. Furthermore, the LLM-empowered IDS [81], by using Mistral-7B, outperformed other LLMs in misbehavior detection and achieved 98% accuracy using real V2X data. Generative models also address the common issue of class imbalance in cybersecurity datasets by generating realistic synthetic attack samples. This has been exemplified in models such as BiGAN [67], ACGAN [75], and the traffic-imbalanced GAN detector in Ref. [70], where synthetic augmentation helped mitigate data sparsity and improved detection robustness. These approaches allow the IDS to train effectively even when the available malicious data is limited or imbalanced, a condition under which most traditional classifiers tend to underperform or overfit. In addition, generative models exhibit superior performance in minimizing false positives and false negatives by more accurately capturing the underlying structure of normal system behavior. The GAN model proposed in Ref. [73], which utilized dual discriminators and ID encoding for CAN-FD traffic, achieved 99.93% accuracy with low latency, showcasing its capacity for fine-grained anomaly detection. Similarly, the A-VAE model from [88] and attention-enhanced denoising Autoencoders in Ref. [93] succeeded in distinguishing irregular behavior from benign anomalies, which are often misclassified in ML-based IDS due to rigid decision boundaries or handcrafted feature dependencies. Sequential data modeling is another domain where generative approaches outperform conventional DL architectures. Transformer-based IDS models such as FSFormer [79], CANBERT [83], and SecureBERT [82] use attention mechanisms and contextual embedding to model message semantics and relationships across time, allowing for precise anomaly localization. Unlike CNNs or MLPs, which primarily extract spatial or static features, these generative Transformers are adept at processing long-term dependencies and extracting higher-order semantics necessary for recognizing subtle or evolving attack behaviors. Moreover, the deployment feasibility of generative IDS has improved significantly. Federated transformer architectures like the one proposed in Ref. [79] enable edge-level detection with privacy preservation by avoiding central data collection. Similarly, lightweight GAN and Autoencoder models such as those in Refs. [75; 93] are increasingly optimized for real-time inference under the computational constraints typical of vehicular onboard units.