# Zero-Day Botnet Attack Detection in IoV: A Modular Approach Using Isolation Forests and Particle Swarm Optimization

arXiv: https://arxiv.org/abs/2504.18814 · HTML: https://mlsanity.com/paper/2504.18814/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 27 references that are in the map.
- First posted on arXiv 26 Apr 2025.

## Builds on (most cited first, 7 of 7)

- [Zero-X: A Blockchain-Enabled Open-Set Federated Learning Framework for Zero-Day Attack Detection in IoV](https://mlsanity.com/paper/2407.02969/) (2024)
- [Beyond Detection: Leveraging Large Language Models for Cyber Attack Prediction in IoT Networks](https://mlsanity.com/paper/2408.14045/) (2024)
- [Federated Learning for Zero-Day Attack Detection in 5G and Beyond V2X Networks](https://mlsanity.com/paper/2407.03070/) (2024)
- [A Life-long Learning Intrusion Detection System for 6G-Enabled IoV](https://mlsanity.com/paper/2407.15700/) (2024)
- [BARTPredict: Empowering IoT Security with LLM-Driven Cyber Threat Prediction](https://mlsanity.com/paper/2501.01664/) (2025)
- [AntibotV: A Multilevel Behaviour-based Framework for Botnets Detection in Vehicular Networks](https://mlsanity.com/paper/2407.03506/) (2024)
- [AI-Driven Fast and Early Detection of IoT Botnet Threats: A Comprehensive Network Traffic Analysis Approach](https://mlsanity.com/paper/2407.15688/) (2024)

## Abstract (arXiv)

The Internet of Vehicles (IoV) is transforming transportation by enhancing connectivity and enabling autonomous driving. However, this increased interconnectivity introduces new security vulnerabilities. Bot malware and cyberattacks pose significant risks to Connected and Autonomous Vehicles (CAVs), as demonstrated by real-world incidents involving remote vehicle system compromise. To address these challenges, we propose an edge-based Intrusion Detection System (IDS) that monitors network traffic to and from CAVs. Our detection model is based on a meta-ensemble classifier capable of recognizing known (Nday) attacks and detecting previously unseen (zero-day) attacks. The approach involves training multiple Isolation Forest (IF) models on Multi-access Edge Computing (MEC) servers, with each IF specialized in identifying a specific type of botnet attack. These IFs, either trained locally or shared by other MEC nodes, are then aggregated using a Particle Swarm Optimization (PSO) based stacking strategy to construct a robust meta-classifier. The proposed IDS has been evaluated on a vehicular botnet dataset, achieving an average detection rate of 92.80% for N-day attacks and 77.32% for zero-day attacks. These results highlight the effectiveness of our solution in detecting both known and emerging threats, providing a scalable and adaptive defense mechanism for CAVs within the IoV ecosystem.