The Internet of Vehicles (IoV) is highly vulnerable to attacks due to its open communication environment, with new types of attacks continuously emerging. However, existing Network Intrusion Detection Systems (NIDS) often fall short in accuracy, recall rates, false positive rates, and they frequently prove ineffective in detecting new attacks. In this paper, we propose a NIDS for IoV based on Enhanced Dual Gaussian Mixture Variational Autoencoders (EDGMVAE) to detect various attack behaviors, including new attacks. We employ two separate Gaussian Mixture Variational Autoencoders (GMVAE) to conduct unsupervised reconstruction training on normal traffic and known attack traffic. During detection, we obtain the tested traffic’s reconstruction probabilities using these GMVAEs and determine whether an attack has occurred through logical fusion operation. We use two datasets for evaluation, i.e.,the Car Hacking Dataset (CHD) for in-vehicle communication and the UNSW-NB15 Dataset (UBD) for external network communication. The results demonstrate that our method achieves remarkable performance in detecting known attacks, with an accuracy rate of 98.54% on the CHD and 98.59% on the UBD. Moreover, it outperforms other state-of-the-art methods in detecting new attacks. Specifically, on the CHD, the accuracy of the method is 6.66% to 12.83% higher than other methods, while on the UBD, the accuracy is 5.13% to 21.91% higher than other methods.

The increasing frequency of cyber attacks targeting IoT highlights the crucial need for accurate and real-time intrusion detection methods. Deep learning, renowned for its remarkable pattern recognition and adaptive learning capabilities, emerges as a promising solution. The current deep learning-based intrusion detection methods face two main issues: dependence on cloud computing architecture, making it challenging to meet the real-time requirements of IoT, and a limited focus on the detection of unknown attacks. In this article, we build our deep learning-based intrusion detection models within fog computing architecture to meet the real-time needs of IoT. Initially, we collect traffic data and conduct feature selection in the fog layer. Subsequently, the Bi-LSTM models integrated with Multi-Head Self-Attention mechanism are trained using the feature-selected data in the cloud. To assess our models’ ability to detect unknown attacks, we utilize some known attacks data for model training, and then assess the models’ performance in detecting other attacks. Ultimately, we deploy the models within fog layer to detect intrusions. Our method is evaluated on the Bot-Iot dataset that contains massive IoT traffic. Experimental results reveal that our models exhibit an average accuracy of 99.85% and perform well in detecting unknown attacks.