# Toward Generative AI-Based Intrusion Detection Systems for the Internet of Vehicles (IoV)
## 4 Generative AI-Based IDS for IoV
This system stands out by employing fully self-supervised training, eliminating the need for handcrafted features and demonstrating its capabilities using a survival analysis dataset collected from three vehicles. Moving forward, Ref. [79] introduces a federated learning-based edge computing (FL-EC) architecture to enhance the privacy and security of V2X communications. This study also presents FSFormer, which integrates a feature attention mechanism to dynamically select critical features for IDS tasks. Experiments using the UNSW-NB15 and CSE-CIC-IDS2018 datasets reveal that FSFormer achieves superior accuracy and F1 scores, outperforming several baseline deep learning models. In addition to these, Ref. [80] applies Transformers for misbehavior detection in V2X communications. By fine-tuning an encoder-based transformer on normal Basic Safety Message (BSM) sequences, the method detects misbehavior by comparing transformed sequences against predefined thresholds. While the results are promising, processing long BSM sequences (length 200) may present computational challenges. Another notable contribution is [81], which proposes a Large Language Model (LLM)-empowered Misbehavior Detection System (MDS) using the Mistral-7B model, fine-tuned at the edge for real-time detection and paired with a larger cloud-based LLM for in-depth analysis. The experiments, conducted on the extended VeReMi dataset, show that Mistral-7B outperforms other LLMs, achieving 98% accuracy in misbehavior detection. The system processes vehicular data into time windows, transforming them into textual prompts for LLM inference. The main advantage of the system is its high detection accuracy and efficient use of resources, especially with Mistral-7B's performance outperforming other LLMs like LLAMA2-7B and RoBERTa. However, challenges include resource constraints in real-time detection and concerns about data privacy when transferring data to the cloud. Additionally, Ref. [82] explores the application of well-known LLMs, including SecureBERT, BERT, and LLAMA-2, for CAN intrusion detection. Their study confirms the effectiveness of these models, highlighting the superior performance of larger models like LLAMA-2 in capturing complex message distributions. In addition to the aforementioned works, BERT-based models have gained significant attention in IDS due to their ability to model semantic structures and relationships in data. For instance, the research in [83] introduces CANBERT, a language-based intrusion detection model for the CAN bus, leveraging transformer models to detect malicious attacks. It provides a comprehensive analysis using a CAN dataset derived from a realistic driving scenario, including normal and malicious data from various attack types, such as Denial of Service (DoS), fuzzy, and impersonation attacks. The approach achieves high precision and accuracy in detecting all attacks. However, it has high computational requirements and processing time for pretraining, making real-time training on resource-constrained in-vehicle networks challenging. Similarly, another approach [84] adapts a BERT-based model with self-attention (BERT-SA) for enhancing cybersecurity in vehicular networks. This model is designed to detect phishing, violent, and extremist text content, achieving high accuracy (up to 96.65%) when tested with sentiment analysis datasets. While effective, the model faces limitations, such as focusing solely on text data, relying on labeled datasets, and requiring high computational resources. Furthermore, Ref. [85] introduces IoV-BERT-IDS, a hybrid Network IDS (NIDS) for both in-vehicle and extra-vehicle networks. Using a semantic extractor to preprocess network traffic for BERT, this model benefits from BERT's bidirectional contextual feature extraction, significantly improving detection accuracy in IoV scenarios. Meanwhile,Ref. [86] employs a sliding window of CAN-IDs fed into BERT, using a masked language model to predict candidate CAN IDs. Abnormalities are detected when actual IDs fall outside the predicted set.