## 2 Background and Review of Related Works
### IoV/ICV Vulnerabilities and Attacks  
Security is a critical concern in ITS due to the sensitivity and safety implications of compromised ICVs/IoV. An ICV is constantly exposed and vulnerable due to protocol limitations and limited study mitigation approach, and real-time monitoring [28; 51; 52; 53].  
Figure 1: Three-Layer Structure of the IoV and the Associated Functionalities Enabling the Emergence of Connected Vehicles.  
These attacks occur at the different layers of the IoV architecture and the open systems interconnection (OSI) layers [51; 52]. The most common ICV/IoV attacks [54] are as follows:  
1. Man-in-the-middle (MiM): This attack occurs when the intruder intercepts network traffic information by gaining access between communication units. It is carried out by monitoring the network, injecting anomalies in the transmission, and forwarding the same to the recipient. A successful attempt assumes the session maintains the connection while the spoofing keeps the attacker unrecognized. This attack can be with SSLstrip, Evilgrade, and Ettercap [28; 55; 56].
2. Denial of service and distributed denial of service (DoS/DDoS): In this attack scenario, an authorized user is denied access to resources by attacking the availability requirement of network resources [57]. A compromised RTU sends arbitrary packets to the MTU, thereby depleting the network bandwidth and constraining resource availability to users. It disrupts the communication link between the RTU and MTU, making control and process monitoring difficult. It can be with attack tools known as Low Orbit Ion Cannon (LOIC), Slowloris, and GoldenEye [28; 58; 59].
3. Eavesdrop: This attack comes in two ways, namely, active and passive eavesdropping. An eavesdropping device assesses the wired or wireless network with the aid of tcpdump, dsniff, or Wireshark [28; 55; 56].
4. Reconnaissance: These attacks seek information about a network and its equipment features. As a result, it is critical to safeguard the sensor measurements from the physical process. Response injection attacks inject misleading inputs into a control system, causing control algorithms to make wrong choices. Fake control commands enter the control system in a command injection attack. It can occur as a consequence of human interference, which results in incorrect control action, or as a result of the injection of false commands, which results in the overwriting of RTU software and field device register values [60].  
These IoV vulnerabilities can be grouped into the following five (5) domains: ICV security, intelligent device security, service platform security, V2X communication security, and data security. The ICV intrusion can also be classified based on attacks on the network, software, and hardware connections [52] as follows:  
1. Network connection attack: Intrusion on the IoV communication transverse transport, network, and application layers. It targets the exploitation of the OSI model and violates the security goals such as availability, authentication, integrity, and confidentiality.
2. Hardware attack: In this case, the intruder gains unauthorized entry to the IoV system units and violates their operations. Access control is the most difficult aspect of securing hardware.
3. Software attack: The ICV/IoV system uses a range of software to improve its efficiency by satisfying operational demands. Nevertheless, it is prone to trojan horse, SQL injection, and buffer overflow attacks due to inadequate implementation. Since the mobile application is gradually becoming an essential part of the IoV, it has become a hot spot of attack for attackers [61].  
Consequently, the need for IDSs, lightweight firewall, hardware encryption, and trusted execution environment have been canvased by stakeholders, as shown in Figure 2[61].