An Explainable Semantic Web and Machine Learning Framework For Intrusion Prediction in Internet of Vehicles

Abstract

The Internet of Vehicles (IoV) combines in-vehicle networks, roadside infrastructure, edge/cloud services and heterogeneous wireless links, creating a broad and dynamic attack surface. Machine-learning intrusion detection can classify abnormal traffic, but a class label alone may not explain which vehicle asset, context or security evidence supports the decision. This paper presents an explainable framework that combines Semantic Web knowledge representation, explicit rule traces and Random Forest classification for IoV intrusion assessment. The ontology models vehicles, electronic control units (ECUs), roadside units, communication events, observations, context, vulnerabilities, attack patterns and intrusion assessments, while RDF/OWL relationships preserve the evidence path behind an alert. The reported prototype contains a source-reported 1,200-record, seven-feature binary dataset and a 75/25 stratified split. On the 300-record test set, Random Forest obtained 91.33% accuracy, 92.59% intrusion precision, 84.75% recall and 88.50% F1-score (TN=174, FP=8, FN=18, TP=100). Packet rate (0.3252), source reputation (0.2694) and failed authentication count (0.1556) were the three most influential features. A worked semantic rule trace demonstrates how high packet rate, repeated authentication failure, abnormal beacon deviation and low reputation yield an interpretable risk assessment. The current evidence supports explainable current-event classification; advance attack-onset prediction remains a separate temporal validation task requiring trustworthy timestamps and a declared forecast horizon.