Enhancing Cybersecurity in Internet of Vehicles: A Machine Learning Approach with Explainable AI for Real-Time Threat Detection

Abstract

The proliferation of IoV technologies has revolutionized the use of transport systems to a great level of improvement in safety and efficiency, and convenience to users. On the other hand, increased connectivity has also brought new vulnerabilities, making IoV networks susceptible to a wide range of cyber-attacks. The contribution of this paper is the in-depth study of the development and evaluation of advanced machine learning (ML) models that detect and classify network anomalies in IoV ecosystems. Several classification models have been studied in our research to achieve high accuracy for discriminating between benign and malicious traffic. This work further harnesses Explainable AI (XAI) methodologies through the LIME framework for enhanced interpretability of models' decision-making processes. Experimental results strongly advocate the strength of Random Forest and XGBoost, proving to be better on the binary and multi-class classification tasks, respectively. Due to resilience, preciseness, and scalability these models are a practical choice in real-world IoV security frameworks. Explainability integrated not only strengthens model reliability but also closes the gap between performance and interoperability in vehicular networks.

Overview of the Work

The emerging paradigm of technology, the Internet of Vehicles (IoV), enables two-way communication between vehicles, infrastructure, and external networks, driving advancements in safety, efficiency, and user convenience in transportation. Increased interconnectivity stemming from IoV induces several cybersecurity problems in its systems — principally vulnerability to DoS, spoofing, and intrusion attacks. Such threats would degrade the integrity of vehicle operations and safety for the passengers, and hence, security must become an integral part of IoV development. In this dynamic environment where traditional security mechanisms face a challenge in scaling up real-time adaptability for IoV to recognize and neutralize these threats, this scenario needs IoT-based, edge-controlled, real-time security.

The innovation of machine learning (ML) models happens to be one of the most powerful methods of identifying and classifying potential cyber threats within an IoV system processing a huge volume of real-time data. At the same time, a model must be able to explain why it has arrived at a certain decision. This need further strengthens the importance of Explainable Artificial Intelligence (XAI), providing insights into complex models' processes of decision-making and improving trustworthiness. XAI contributes to the improvement of interpretability of ML models and can be leveraged in IoV applications for real-time detection of threats, forming a major step toward establishing trust in automated systems. XAI-based systems are particularly essential for real-time prediction and threat mitigation in the IoV context.

This paper proposes the development and testing of ML models against binary and multi-class classifications to solve the aforementioned cybersecurity challenges arising within IoV systems. Understanding not only how but also why a model reaches a conclusion is important for building trust and ensuring system safety in IoV. The key contributions of this work are:

• This study compares different ML models, such as the Support Vector Classifier, Decision Tree, and Logistic Regression against Random Forest and XGBoost, while establishing the latter to be better in IoV security contexts.
• The models Random Forest and XGBoost show very high accuracies of up to 99% in binary as well as multi-class classifications for benign and malicious traffic.
• The LIME method gives complete insight into what affects the made predictions, and as a result, the system becomes more interpretable and can be trusted.

Critical developments in IoV cybersecurity on the application of ML and XAI in real-time threat detection are discussed in the literature review. The section on the applied methodologies covers how data collection was done, pre-processing techniques, and finally, the ML models used for network traffic classification, including applied explainability techniques like LIME. Finally, the Results section discusses in detail the models for performance evaluation of binary and multi-class classifications, in which the respective accuracy, precision, recall, and the principal F1 score are compared. In conclusion, the paper emphasizes the importance of the proposed method and outlines directions for further research, including how federated learning with blockchain technologies can work together to enhance IoV security.

Methodology

The great strides in IoV-related technologies have significantly enhanced transportation safety, operational efficiency, and user convenience. Advanced sensors are linked via complex networks, and today's vehicles pride themselves on an unparalleled level of interconnectivity. However, this also opens the door for new vulnerabilities, making IoV systems prone to cyber-attacks that could compromise operational safety and system integrity.

To address these threats, this study develops and evaluates machine learning (ML) models for traffic classification in IoV. The goal is not only to detect harmful activities with high accuracy but also to understand which features most influence classification results. This understanding is crucial for interpreting and trusting decisions in critical security applications.

The study applies both binary and multi-class classification approaches to detect various types of cyberattacks such as DoS and spoofing (Gas, RPM, Speed, Steering Wheel). Vehicles are instrumented with sensors to record parameters such as speed, gas level, and RPM. This data is sent to a central system, preprocessed, and then used to train various ML models including Random Forest, XGBoost, and Support Vector Classifier. The best-performing models are further analyzed using LIME to improve their interpretability.

Data Collection & Preprocessing

Data Collection from IoV Systems

The IoV system collects real-time sensor data including:

• Vehicle Speed: Fluctuations may indicate control system failures.
• RPM: Monitors operational behavior.
• Gas Level: Sudden changes may suggest spoofing attempts.
• Steering Wheel Position: Tracks unauthorized use or changes in direction.

All sensors transmit data to a master node which aggregates it into a large dataset describing the vehicle’s current operational state. This raw data is then cleaned and prepared for ML model training.

Data Preprocessing

• Data Cleaning: Missing values are filled using median imputation to preserve integrity.
• Feature Encoding: One-hot encoding is used for categorical data like sensor status and attack labels.
• Normalization: All features (e.g., speed, RPM) are scaled to [0, 1] using min-max scaling:
  x_norm = (x - x_min) / (x_max - x_min)
• Class Imbalance: SMOTE is applied to oversample minority classes for improved learning.
• Dimensionality Reduction: PCA is used to reduce feature space and remove redundancy.

ML Models

The following ML models were trained and evaluated:

Random Forest

An ensemble model that combines multiple decision trees to improve accuracy and reduce variance. Each tree is trained on a random subset of data. Predictions are combined using weighted voting.

Decision Trees

A transparent model that splits data using feature thresholds based on metrics like Gini index or Information Gain. Simple but interpretable.

Support Vector Classifier (SVC)

Finds the hyperplane that maximizes class separation. Suitable for handling non-linear separable data. Solves the optimization problem: min (1/2) ||w||² subject to yᵢ(w·xᵢ + b) ≥ 1

Extreme Gradient Boosting (XGBoost)

Boosting method that builds trees sequentially to correct previous errors. The objective function balances classification loss and model complexity: L(θ) = Σ l(yᵢ, ŷᵢ) + Σ Ω(fₖ)

Logistic Regression (Baseline)

A classic model for binary classification, using the sigmoid function to estimate class probabilities. Used here for benchmarking more advanced models.

Generating Explainability from LIME

LIME (Local Interpretable Model-Agnostic Explanations) is applied to the best-performing model to explain individual predictions. It perturbs input features and fits a local, interpretable model (e.g., linear regression) to approximate the original black-box model’s decision boundary.

Algorithm Workflow

1. Data Collection: Collect sensor data and transmit to central system.
2. Preprocessing: Perform cleaning, encoding, scaling, SMOTE, and PCA.
3. Model Training: Train and tune ML models using cross-validation and evaluate using accuracy, precision, recall, and F1 score.
4. Model Selection: Choose the top-performing model based on metrics.
5. LIME Integration: Generate local explanations by perturbing inputs and fitting simple models to highlight important features.
6. Deployment: Deploy the model into IoV systems and establish a feedback loop for continuous improvement.

LIME works by minimizing the following objective: min₍g∈G₎ Σ πₓ(xᵢ') · L(f(xᵢ'), g(xᵢ')) + Ω(g)
Here, πₓ(xᵢ') weights local instances, L measures loss, and Ω(g) penalizes complexity.

This technique identifies the most impactful features (e.g., RPM, steering angle) behind model decisions and improves transparency in classifying traffic as benign or malicious. It enables the system to identify patterns characteristic of various attacks like DoS or spoofing.

In summary, the methodology combines robust machine learning with explainable AI to offer both accurate and interpretable threat detection for IoV networks. The proposed system is designed to adapt dynamically to evolving threats while preserving stakeholder trust in the decision-making process.

Results and Discussion

An evaluation was conducted to assess the effectiveness of different ML models in the context of IoV security. This includes both multi-class and binary classification tasks for which the models applied were XGBoost (XGB), Random Forest Classifier (RFC), Support Vector Classifier (SVC), Decision Tree (DT), and Logistic Regression. Accuracy, Precision, Recall, and F1 Score were used as evaluation metrics.

Binary Classification Results

• XGB: Achieved 0.98 accuracy, 0.99 precision, 0.9802 recall, and 0.9801 F1 score. Demonstrated effective separation of benign and malicious data.
• RFC: Outperformed all with 0.99 accuracy and F1 score of 0.9851. Excellent for real-time binary classification in IoV systems.
• SVC: Scored 0.95 accuracy, but lower recall at 0.8692 indicated occasional missed attacks.
• DT: 0.96 accuracy and 0.88 F1 score, but reduced recall suggested susceptibility to missing edge-case attacks.
• Logistic Regression: Lowest performance, with 0.90 accuracy and 0.84 F1 score, highlighting its limitations in complex threat contexts.

Multi-Class Classification Results

• XGB: Maintained high performance with 0.98 accuracy and 0.9801 F1 score across all attack types.
• RFC: Matched or exceeded XGB in performance, scoring 0.99 on most metrics—highly suitable for real-world deployment.
• SVC: Achieved 0.94 accuracy, with reduced F1 at 0.8749, indicating difficulty with nuanced attack classification.
• DT: Performed steadily with 0.95 accuracy and 0.8887 F1 score, though slightly weaker than RFC and XGB.
• Logistic Regression: Performed worst with 0.80 accuracy and 0.72 F1 score, unsuitable for fine-grained multi-class scenarios.

Model Comparisons and Observations

RFC and XGB consistently outperformed other models in both binary and multi-class contexts, offering robust classification with high recall and precision. Logistic Regression's simplicity made it a poor fit for the complexity of IoV traffic. SVC and DT showed acceptable performance but lacked the robustness of ensemble methods.

LIME-Based Explainability Insights

Applying LIME to high-performing models like RFC and XGB provided interpretability crucial for trust in security systems. In binary classification, LIME highlighted DATA_3, DATA_7, DATA_0, DATA_1, and DATA_2 as influential features. The model confidently predicted 'Attack' with probability 1.00, showing strong feature discrimination.

In multi-class scenarios, for instance, RPM spoofing, DATA_0 had the highest contribution (value: 2.00), followed by DATA_1, DATA_2, and DATA_5. Predictions were accurate with probability 1.00 for the correct class, and 0.00 for others, demonstrating LIME’s value in local interpretability.

This interpretability enhances user confidence, ensures transparency in real-time decisions, and is essential for securing critical IoV applications.

Summary Table of Results

Future Work & Conclusion

This study demonstrates that machine learning models, particularly Random Forest and XGBoost, when combined with Explainable AI (XAI) techniques such as LIME, can significantly enhance cybersecurity in Internet of Vehicles (IoV) systems. The models achieved high precision in distinguishing between valid and malicious traffic, but further calibration of predictive accuracy can improve overall resilience. The successful application of LIME highlights the growing demand for interpretability in cybersecurity solutions, especially in safety-critical environments where trust in model decisions is paramount.

Integrating explainability bridges the gap between black-box model performance and transparent decision-making, which is essential for stakeholder confidence and real-time deployment in IoV security frameworks.

Looking ahead, federated learning offers a transformative solution to privacy and data-sharing constraints in IoV ecosystems. By enabling decentralized model training across multiple vehicles, this approach avoids centralizing sensitive data, thereby minimizing risks of data breaches during transmission. Additionally, federated learning enhances system scalability and keeps critical information—such as location and vehicle identifiers—confined to edge nodes, improving both privacy and performance.

Moreover, the integration of federated learning with blockchain technologies can ensure tamper-proof aggregation and verifiable model updates through immutable ledgers. This combination can facilitate predictive modeling that detects anomalous IoV behavior in real time and automatically triggers alerts or countermeasures to mitigate potential cyber threats before they escalate.

However, future work is needed to explore the viability of these techniques in real-world deployments. Key research areas include:

• Evaluating communication overhead and synchronization latency in federated settings
• Assessing robustness of decentralized models against adversarial attacks
• Studying the trade-offs between computational efficiency and detection accuracy on resource-constrained vehicle nodes

In conclusion, the integration of predictive ML models, federated learning, and blockchain represents a critical step forward in securing the rapidly evolving IoV landscape. These technologies together can ensure scalable, privacy-preserving, and trustworthy solutions that will enable safer autonomous and connected transportation systems in the future.