SIoV-IDS: SDN-enabled zero-trust framework for explainable intrusion detection in IoVs using Variational Autoencoders and EX-LSTM

In response to cyber attacks targeting the Internet of Vehicles (IoV) ecosystem, we propose SIoV-DS , a secure framework addressing inter-vehicle communication, intra-vehicle networks, and infrastructure threats using a zero-trust approach. Vehicle data is first encoded with a Variational Autoencoder (V-AE) to mitigate inference attacks, then analyzed by an Extended Long Short-Term Memory (EX-LSTM) detector capable of identifying diverse attacks, including Denial of Service (DoS), spoofing, and malware. For interpretability, Shapley Additive Explanations (SHAP) provide insights into EX-LSTM decisions, assisting Security Operations Center (SOC) analysts. SIoV-DS is deployed over a Software-Defined Networking (SDN) architecture to ensure scalability. Evaluations on CIC-IoV2024 and Edge-IIoTset2022 datasets demonstrate high accuracy (99.78% and 95.01%, respectively), while inference-time analysis confirms feasibility for real-time detection, effectively securing the IoV ecosystem against advanced cyber threats.