Detection of zero-day attacks via sample augmentation for the Internet of Vehicles

Abstract

Detecting zero-day attacks is a critical challenge in the Internet of Vehicles (IoV). Due to the limited availability of labeled attack data, anomaly-based methods are predominantly employed. However, the variability in the driving environment and behavioral patterns of vehicles introduces significant fluctuations in normal behavior, which in turn leads to high false positive rates when using these methods. In this work, we propose a novel detection method for zero-day attacks in IoV through sample augmentation. We first analyze the similarities between known and zero-day attacks in IoV. Based on the analysis, a Few-shot Learning Conditional Generative Adversarial Network (FLCGAN) model with multiple generators and discriminators is developed. Within this framework, an attack sample augmentation algorithm is designed to enhance input data by expanding the known attack dataset, thereby reducing false positives. To address the data imbalance caused by the limited number of input attack samples, an ensemble focal loss function is incorporated into the generator to ensure diversity and dispersion of the generated samples. Additionally, a collaborative focal loss function is introduced into the discriminator to improve the classification of difficult-to-classify data. A theoretical analysis is also conducted on the coverage of samples generated by the model. Extensive experiments conducted on the IoV simulation tool Framework For Misbehavior Detection (F2MD) demonstrate that the proposed method surpasses existing approaches in both detection effect and detection delay for zero-day attacks.