# Toward Generative AI-Based Intrusion Detection Systems for the Internet of Vehicles (IoV)
## 2 Background
### Review of Existing ML and DL Security Approaches in IoV
#### 2.5.1 Machine Learning-Based IDS
Focusing specifically on DDoS threats, [PERSON] and [PERSON] [31] developed a detection model using DT, RF, and KNN to identify UDP-Lag and SYN Flood attacks. Their model demonstrated high accuracy and the benefits of effective feature selection. However, it was limited to only two attack types and lacked scalability and real-world deployment testing. Similarly, [PERSON] et al. [32] proposed a hybrid IDS combining SVM, KNN, and the C4.5 classifier. This integration leveraged the strengths of each individual algorithm but suffered from high computational time, echoing the same challenge faced by the stacked model proposed in Ref. [29]. Meanwhile, [PERSON] et al. [33] utilized the CICDDoS dataset to train binary and multiclass classifiers to detect DDoS attacks. Their study examined eight ML classifiers, including RF, KNN, LightGBM, XGBoost, AdaBoost, SVM, and Linear Discriminant Analysis (LDA). The binary classification scenario achieved an impressive accuracy of approximately 0.99, reflecting the strong potential of ML-based IDS when trained on balanced and comprehensive datasets. Moreover, [PERSON] et al. [34] proposed a multi-layered ML-based IDS for CAN bus networks, consisting of threat detection and alerting layers. They evaluated different ML algorithms using a real car hacking dataset with various injection attacks. Although their system achieved good detection accuracy and a low false alarm rate, it lacked details on the false negative rate--a crucial metric. Additionally, placing the IDS externally on the OBD II port could increase costs, which may not be acceptable to vehicle owners or manufacturers. The evaluation of execution time was also insufficient, as it did not reflect the system's true computational performance. Furthermore, [PERSON] et al. [35] introduced an Intelligent Hierarchical IDS, dividing the network into four levels with clusters at each, using various ML detection methods. This hierarchical structure allows for flexibility in applying different techniques at each layer. However, although tested on a simulated dataset, the feasibility of this system remains uncertain, as many important evaluation metrics were omitted. [PERSON] et al. [36] proposed a cross-layer IDS targeting spoofing and jamming attacks in connected vehicle platoons. Their system employs RF, KNN, and One-Class Support Vector Machine (OCSVM), alongside cross-layer data fusion methods. It offers probabilistic outcomes for both known and unknown attacks. Tested in a simulated platoon environment using the Veins simulator, the IDS showed precise detection for both attacks. Nonetheless, its scope was attack-specific, and critical metrics like the false positive rate (FPR), false negative rate (FNR), and detection latency were not addressed. In addition, in the context of 5G-enabled vehicular networks, [PERSON] et al. [37] presented an IDS model based on DT and RF classifiers to detect Flooding attacks using ns-3-generated data. The Decision Tree classifier performed particularly well, achieving a perfect F1 Score of 1. In a different approach, [PERSON] and [PERSON] [38] proposed an IDS targeting position falsification attacks using a two-consecutive-BSM (2 BSM) feature approach, processed at RSUs instead of vehicle OBUs. Evaluated on the VeReMi dataset using KNN, RF, DT, and Naive Bayes, their system achieved higher accuracy and lower false alarm rates, particularly for difficult position-based attacks. However, it depends on dense RSU coverage, which may limit its practicality in sparse areas. [PERSON] et al. [39] proposed a lightweight IDS based on analyzing time intervals between CAN messages to detect injection attacks. The method leverages the fact that, under normal conditions, Electronic Control Units (ECUs) transmit messages at consistent and predictable intervals. An injection attack disrupts this regularity, typically causing a significant increase in message frequency--often 20 to 100 times higher than normal. By monitoring these deviations, the system can effectively identify abnormal behavior.