## 2 Related Work  
Instrusion detection systems are indispensable for securing IoV networks, which are increasingly vulnerable to sophisticated cyberattacks due to their highly interconnected and dynamic nature. Recent advances in machine learning, deep learning, federated learning, and optimization techniques have contributed significantly to addressing the unique challenges of IoV intrusion detection. This section reviews the existing literature with a focus on IoV security, highlighting key methodologies and open challenges, particularly in the context of CAN bus vulnerabilities and class imbalance in intrusion detection datasets. The CICIoV2024 dataset, created and published by [PERSON] et al. [8], is a public and realistic benchmark for evaluating IDS in IoV environments, incorporating imbalanced traffic distributions and diverse attack scenarios. However, its adoption by the research community remains limited. [PERSON] et al. [8] presented the CICIoV2024 dataset and evaluated various machine learning models, including Random Forest, AdaBoost, Logistic Regression, and Deep Neural Networks. The authors emphasized the multi-representation of the dataset (binary, decimal, and hexadecimal) and highlighted its suitability for spoofing and DoS attack detection. However, their work focused primarily on baseline model evaluations without integrating advanced optimization techniques, and the performance of the models dropped significantly when presented with multi-class analysis, leaving room for performance improvement. Following the lead of [PERSON] et al. [8], [PERSON] and [PERSON] [17] used the CICIoV2024 dataset with Genetic Algorithm (GA)-based hyperparameter optimization to improve model performance. Their study showed significant accuracy improvements for Random Forest (99.64%) and Deep Neural Networks, demonstrating the potential of GA for fine-tuning IDS models. Despite its success, the computational complexity of GA may limit its scalability in real-time IoV environments. Neither study applied data balancing techniques. Beyond the CICIoV2024 dataset, other studies have focused on specific methods for improving intrusion detection in CAN environments. [PERSON] et al. [19] also took advantage of the GA optimization for feature selection, combined with a balanced dataset and LightGBM, resulting in a perfect accuracy and F1-score in two different CAN datasets. [PERSON] et al. [10] proposed an ensemble machine learning model that includes Random Forest(RF), XGBoost, LightGBM, and Extra Trees (ET) on a CAN dataset. The results of the ensemble model show an accuracy and F1-score of 98% and 96.9%, respectively, and for the single ML models, these values were as follows: 97.7% and 94.9% with Decision Trees; 98.2% and 93.2% with RF; 95.5 and 91.1 with XGBoost. Although the results seem promising, the dataset was also balanced, which means that these models are trained on datasets that do not accurately reflect the imbalanced nature of real-world scenarios. [PERSON] et al. [20] presented SELIDS, a stacking-enabled ensemble learning-based IDS for IoV. Their approach integrates RF, LightGBM, XGBoost, and CatBoost to improve intrusion detection performance, achieving near-perfect accuracy and F1-scores. [PERSON] et al. [21] presented CLUSTER, a clustering-based open-set recognition framework tailored for CAN bus traffic. Their approach uses intra-class compactness and inter-class separation to improve the recognition of unknown types of attacks. This is particularly relevant for CAN, where attacks often exhibit subtle variations that are difficult to detect. In addition to traditional learning models, researchers have increasingly explored DL techniques for intrusion detection in IoV systems. DL models are known for their ability to easily learn complex feature representations, and have shown significant promise, particularly in detecting subtle and previously unseen attack patterns [13]. For example, [PERSON] et al.