Evaluating Zero-Day Generalisation in VANET Detection

Abstract

The rapid expansion of the Internet of Vehicles has introduced security vulnerabilities, requiring robust Intrusion Detection Systems. This study evaluates the generalisation capabilities of Random Forest, XGBoost, Naive Bayes, Logistic Regression and Extra Trees against zero-day vehicular attacks. Using the VeReMi NextGen dataset, the methodology separates known and unseen attacks using the Leave-One-Attack-Out strategy to simulate realistic, unseen threat scenarios. Results demonstrate that while Random Forest excels at identifying known threats, it suffers from overfitting, resulting in a low F1-score for zero-day attacks. Conversely, XGBoost and Extra Trees exhibit more consistent zero-day performance, suggesting improved robustness against novel vehicular attacks.