# Toward Generative AI-Based Intrusion Detection Systems for the Internet of Vehicles (IoV)
## 2 Background
### Review of Existing ML and DL Security Approaches in IoV
#### 2.5.2 Deep Learning-Based IDS
[48] applied a Deep Belief Network model--a notable extension of DNNs--to intrusion detection within Vehicular Ad Hoc Networks, demonstrating the effectiveness of DBN for both binary and multiclass classification tasks. However, DBNs are more often used as tools for understanding the principles and capabilities of DL rather than for direct application in intrusion detection systems. In the field of Convolutional Neural Networks, which are particularly effective for spatial data processing, researchers have explored their potential for IoV intrusion detection. [PERSON] et al. [49] designed lightweight CNN-based IDS for vehicle terminals, where they represented network traffic as images to differentiate between normal and abnormal traffic patterns in real time. This approach highlights the ability of CNNs to handle spatial data, which is valuable in dynamic and complex IoV environments. [PERSON] et al. [50] introduced a CNN-based IDS for CAN bus systems, tested on real car data. While achieving reliable detection both online and offline, it relied on external CAN devices, increasing system costs and limiting vehicle compatibility, as well as requiring full retraining when the data distribution changes. An extension of CNN, called Deep Convolutional Neural Networks, introduces additional layers and parameters to better handle large-scale datasets. [PERSON] et al. [51] applied DCNN to design a data-driven IDS for detecting abnormal traffic caused by intrusion events, achieving better performance in terms of accuracy, although it did not fully address the latency concerns inherent in such deep architectures. Recurrent Neural Networks, especially Long Short-Term Memory networks, are highly effective for sequential data, such as time series data in IoV networks. [PERSON] et al. [52] designed an LSTM-based autoencoding algorithm to detect multiple intrusion types in IoV networks. Another approach by [PERSON] et al. [53] proposed a DL-based IDS, using LSTM models combined with thresholding and error reconstruction, for CAN bus intrusion detection, achieving high accuracy but at the cost of large computational overhead and a 128 ms latency while neglecting other important performance metrics. In a hybrid approach, [PERSON] et al. [54] used a combination of a bloom filter and DNN-based bidirectional LSTM architecture to detect both internal and external attacks in IoVs. The system demonstrated a short training period and very low detection latency, making it highly efficient. However, it lacked comprehensive metrics such as False Positive Rate (FPR) and False Negative Rate (FNR). Furthermore, [PERSON] et al. [55] combined LSTM and CNN models to create a hybrid IDS capable of detecting intrusion events passing through On-Board Units (OBUs). Their system achieved higher detection performance while requiring fewer resources. This research emphasizes the potential of RNN-based techniques for IoV, where large volumes of continuous data are generated, underscoring the need for efficient time series modeling in intrusion detection. Moreover, [PERSON] et al. [56] introduced a MEC-based IDS for IoV using four DL models: LSTM, CNN-LSTM, MLP, and CNN. The CNN-based sequence-image classifier outperformed others in accuracy and latency, making it ideal for real-time detection on edge devices like Raspberry Pi. However, it struggled slightly with similar attack types like disruptive and replay attacks. [PERSON] et al. [57] introduced a distributed intrusion detection system based on Hierarchical Temporal Memory (HTM) to detect modification and replay attacks on the CAN bus. HTM models are capable of real-time prediction by learning the temporal patterns of data sequences. This system operates in an online learning mode, continuously updating its memory as new data flows in, allowing it to adapt to changes without requiring prior knowledge of the CAN protocol structure. By monitoring ongoing data streams, the IDS can effectively detect both known and previously unseen attacks on the vehicle network. [PERSON] et al.