# Toward Generative AI-Based Intrusion Detection Systems for the Internet of Vehicles (IoV)
## 2 Background
### Review of Existing ML and DL Security Approaches in IoV
#### 2.5.1 Machine Learning-Based IDS  
In the Internet of Vehicles, ML-based methods and techniques provided clear advantages in handling large and complex datasets, which led to increased interest from researchers, as highlighted in Table 4, which provides a comparative summary of some ML-based IDSs for the IoV. Several ML-based IDS have been proposed to strengthen security in the Internet of Vehicles, each offering distinct capabilities and facing specific challenges. [PERSON] et al. [28] applied K-Nearest Neighbor (KNN) and Support Vector Machine (SVM) for clustering and classification of intrusion events. Their method demonstrated effectiveness for structured and labeled data, offering fast and interpretable results. However, its performance may decline when faced with more complex or evolving attack patterns. Building on this, [PERSON] et al. [29] proposed more sophisticated ML-based IDS combining traditional classifiers like KNN and SVM with a stacked model of tree-based algorithms, including Random Forest (RF), Decision Tree (DT), Extra Trees (ET), and Extreme Gradient Boosting (XGBoost). To enhance accuracy and mitigate class imbalance, the authors introduced the SMOTE technique. Their system achieved over 99% accuracy, showing strong detection capabilities across multiple attack types, but still struggled to achieve both high accuracy and low latency simultaneously. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Reference** & **ML Model** & **Detection Target** & **Strengths and Limitations** \\ \hline
[28] & KNN, SVM & Classification of intrusion & \(\check{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{ \mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{    }}}}}}}}}}}}}\)Fast, effective for structured data \\  & & events & \(\check{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{ \mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{ \mathsf{   }}}}}}}}}}}}}}}\)Limited by static datasets \\ \hline
[29] & RF, DT, ET, XGBoost & Multiple attack types & \(\check{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{ \mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{ \mathsf{ }}}}}}}}}}}}}}}}\)High accuracy \\  & & \(\check{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{ \mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{ \mathsf{ \mathsf{ }}}}}}}}}}}}}}}}}\)High computational time \\ \hline
[30] & Decision Tree & Network attack detection for vehicles & \(\check{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{ \mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{ \mathsf{ }}}}}}}}}}}}}}}}}\)Integration of network and physical features \\  & & vehicles & \(\check{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{ \mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{ \mathsf{ \mathsf{ \mathsf{ \mathsf{ \mathsfmathsf{       \mathsf{ }}}}}}}}}}}}}}}}}\)Scalability and flexibility limitations \\ \hline
[31] & DT, RF, KNN & DDoS attacks (UDP-Lag, SYN Flood) & \(\check{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{ \mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{\mathsf{ \mathsf{ \mathsf{  \mathsf{     \mathsf{     \mathsf{       \mathsf{      \mathsf{     \mathsf{     \mathsf{   \mathsf{     \mathsf{    \mathsf{   \mathsf{[PERSON] et al. [30] addressed some of these limitations by proposing a decision tree-based IDS that incorporates both network and physical features, acknowledging the unique constraints of vehicular environments, such as mobility and energy consumption. While this integration improves detection in realistic IoV settings, the use of decision trees may restrict scalability and flexibility when dealing with highly complex or large-scale attacks.