Attention Driven CNN-Transformer Framework for Intrusion Detection in Internet of Vehicles

The Internet of Vehicles (IoV) has emerged as a vital enabler of Intelligent Transportation Systems (ITS), offering seamless communication between vehicles, roadside units, and cloud servers. By enabling real-time data exchange, IoV improves traffic monitoring, collision avoidance, fleet management, and autonomous driving. However, the openness of wireless vehicular communication makes IoV networks highly vulnerable to cyber threats such as denial-of-service (DoS), probing, spoofing, and malware propagation. These threats compromise service availability and data integrity, ultimately endangering human safety. Thus, intrusion detection becomes a crucial layer of defense. Traditional intrusion detection methods based on machine learning, such as Support Vector Machines (SVM), Decision Trees, and Random Forests, perform satisfactorily on structured data but struggle with the high-dimensional and dynamic nature of IoV traffic. Similarly, standalone deep learning models like Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks capture spatial or temporal patterns independently, but fail to combine both effectively, leading to detection limitations in complex vehicular environments. To address this challenge, a hybrid CNN–Transformer framework is proposed in this paper. The CNN module extracts discriminative spatial features from vehicular traffic records, while the Transformer encoder employs a self-attention mechanism to model long-range temporal dependencies. Experimental validation on the UNSW-NB15 dataset demonstrates that the proposed model achieves 98% detection accuracy with superior precision, recall, and F1-score compared to baseline methods. These results highlight the robustness of the CNN–Transformer IDS in identifying both common and rare categories of IoV cyberattacks.