# Toward Generative AI-Based Intrusion Detection Systems for the Internet of Vehicles (IoV)
## 2 Background
### Possible Attacks in IoV
threat is the GPS Deception attack, where the attacker captures and manipulates GPS signals or sends fake signals to mislead a vehicle into thinking it is at a different location than intended. This poses a significant threat to both vehicle and user security [12]. In the False Information Flow attack, authenticated users can be tricked by incorrect or tampered with information, creating a false perception of the IoV environment, leading to wrong decisions that jeopardize the system's security and efficiency. Another attack is the Message Injection attack, where the attacker inserts deceptive data into the IoV network in order to breach the vehicle's security, targeting its electronic control unit or infotainment and telematics systems for unauthorized access. A Malware attack involves introducing malicious software, such as viruses or worms, into the network to disrupt its functionality. These attacks are difficult to counter due to the decentralized structure of the IoV. A Session Linking attack occurs when an attacker connects two random sessions of a vehicle with other entities in the network, potentially exposing all credentials after minimal calculation [14]. In an Eavesdropping attack, the attacker intercepts and monitors data transmissions, compromising the privacy and confidentiality of the information, while a Message Holding attack occurs when an attacker delays or withholds parts of the message, disrupting the flow of critical information. Physical Vehicle Damage refers to attacks that involve direct harm to a vehicle's components, such as tampering with hardware, damaging sensors, or destroying critical systems, to compromise its functionality or security [15]. The Fuzzy attack occurs when the attacker observes a vehicle's behavior over time to manipulate its patterns and then sends deceptive messages with random or repetitive data to confuse identifiers, disrupting the system's functionality. In Guessing attacks, attackers attempt to gain unauthorized access by guessing a vehicle's identity, passwords, or other authentication credentials, often by intercepting and analyzing transmitted data to extract useful information [13]. In a Replay attack, an attacker repeatedly transmits valid or altered information to a target vehicle, disrupting its real-time functionality and increasing the risk of system malfunction or failure. A Black-hole attack involves an attacker intercepting and absorbing packets of information exchanged between legitimate users, causing the loss of critical data and disrupting real-time communication [16]. The Man-in-the-Middle attack occurs when a malicious vehicle intercepts communication between vehicles (V2V) or between a vehicle and infrastructure (V2I). The attacker may eavesdrop passively to gather sensitive information or actively alter, delay, or delete messages to manipulate outcomes. Another attack is the Forgery attack, where an attacker pretends to be a legitimate user device or onboard unit (OBU), sending fraudulent commands to manipulate or control the network [17]. Another common attack is the Masquerading attack, where the attacker's vehicle falsely uses another vehicle's ID to gain unauthorized access to restricted information. The key difference between this attack and a Sybil attack is that it does not involve creating multiple identities. Lastly, the Wormhole attack occurs when two or more malicious nodes create a false representation of the network by concealing the actual distances between them, forcing legitimate nodes to route data through them, allowing attackers to intercept information and disrupt the network [18].