# Toward Generative AI-Based Intrusion Detection Systems for the Internet of Vehicles (IoV)
## 2 Background
### Possible Attacks in IoV  
The Internet of Vehicles system is vulnerable to various attacks that can compromise its stability, security robustness, real-time performance, and privacy. These vulnerabilities not only diminish its ability to provide effective services but may also result in severe accidents. This section provides an overview of these attacks in IoV. Table 3 presents a concise summary of the attacks targeting the IoV system, highlighting the attack type, along with the specific security components that are vulnerable, including authentication, availability, and confidentiality. Figure 3: The seven-layer IoV architecture proposed. One of the most common attacks in IoV systems is the Sybil attack, in which an attacker creates multiple fake vehicle identities to deceive the network into believing that numerous vehicles are present. This can disrupt the IoV system by causing false traffic information to be reported, leading to incorrect traffic decisions, virtual congestion, and inefficient route planning. Another common attack, the Channel Interference attack, involves degrading the availability of IoV networks by introducing noise or distortions into the communication channels. These attacks are often categorized as jamming attacks [12]. In Cookie Theft attack, the attacker saves cookies and reuses them to gain unauthorized access to network resources whenever needed, posing a serious security risk to IoV systems. Meanwhile, in a Message Manipulation attack, the attacker modifies the content of the messages, resulting in incorrect decisions by the receiving system, which can incapacitate the entire network. In the Channel Hindrance attack, the attacker attempts to disrupt communication channels, slowing or restricting information exchange and impacting real-time applications within the IoV environment [13]. The Denial of Service (DoS) attack overwhelms a resource provider with excessive requests, rendering it unable to handle legitimate requests and severely interrupting vehicular traffic and system operations. In an advanced variant, the Distributed Denial of Service attack, the attacker sends a large volume of traffic from multiple systems to a specific target, causing it to become unavailable and disrupting its normal operations. Another serious \begin{table}
\begin{tabular}{c c c} \hline
**Attack** & **Attack Type** & **Affected Security Component** \\ \hline Sybil attack & Active & Authentication, Availability \\ \hline Masquerading attack & Active & Authentication, Confidentiality \\ \hline Man-in-the-Middle attack & Active, Passive & Availability, Confidentiality \\ \hline Replay attack & Passive & Availability \\ \hline Cookie Theft attack & Active & Authentication, Confidentiality \\ \hline Message Injection attack & Active & Availability \\ \hline Message Manipulation attack & Active & Availability \\ \hline Channel Interference attack & Active, Passive & Availability \\ \hline Denial of Service (DoS) attack & Active & Availability \\ \hline Distributed DoS attack & Active & Availability \\ \hline Eavesdropping attack & Passive & Confidentiality \\ \hline Message Holding attack & Active & Availability \\ \hline False Information Flow attack & Active & Availability \\ \hline Channel Hindrance attack & Active & Availability \\ \hline Malware attack & Active & Availability \\ \hline Physical Vehicle damage & Active & Availability \\ \hline Fuzzy attack & Active & Availability \\ \hline Guessing attacks & Active & Authentication \\ \hline Session Linking attack & Active & Authentication, Confidentiality \\ \hline Black-hole attack & Active & Availability \\ \hline Forgery attack & Active & Authentication \\ \hline Wormhole attack & Active & Availability \\ \hline GPS Deception attack & Active & Confidentiality, Availability \\ \hline \end{tabular}
\end{table} 
Table 3: Summary of IoV attacks and their affected security components.