Network Intrusion Detection System Based on Enhanced Dual Gaussian Mixture Variational Autoencoders for Internet of Vehicles

The Internet of Vehicles (IoV) is highly vulnerable to attacks due to its open communication environment, with new types of attacks continuously emerging. However, existing Network Intrusion Detection Systems (NIDS) often fall short in accuracy, recall rates, false positive rates, and they frequently prove ineffective in detecting new attacks. In this paper, we propose a NIDS for IoV based on Enhanced Dual Gaussian Mixture Variational Autoencoders (EDGMVAE) to detect various attack behaviors, including new attacks. We employ two separate Gaussian Mixture Variational Autoencoders (GMVAE) to conduct unsupervised reconstruction training on normal traffic and known attack traffic. During detection, we obtain the tested traffic’s reconstruction probabilities using these GMVAEs and determine whether an attack has occurred through logical fusion operation. We use two datasets for evaluation, i.e.,the Car Hacking Dataset (CHD) for in-vehicle communication and the UNSW-NB15 Dataset (UBD) for external network communication. The results demonstrate that our method achieves remarkable performance in detecting known attacks, with an accuracy rate of 98.54% on the CHD and 98.59% on the UBD. Moreover, it outperforms other state-of-the-art methods in detecting new attacks. Specifically, on the CHD, the accuracy of the method is 6.66% to 12.83% higher than other methods, while on the UBD, the accuracy is 5.13% to 21.91% higher than other methods.