SkyVehiGuard‐Net: A Mamba‐MoE Framework for IoV Security Over Space–Air–Ground‐Integrated Networks

ABSTRACT

The Internet of Vehicles (IoV) operating within Space–Air–Ground‐Integrated Network (SAGIN) environments faces escalating cybersecurity threats, including network intrusion attacks on Controller Area Network (CAN) bus communications and malicious URL‐based phishing campaigns targeting in‐vehicle infotainment (IVI) systems. Existing intrusion detection systems (IDS) and malicious URL classifiers for IoV predominantly assume stable terrestrial network conditions, rendering them fundamentally unsuitable for heterogeneous SAGIN environments characterized by long satellite propagation delays, intermittent UAV relay channels, and bandwidth‐constrained links. To address these compounding challenges, this article proposes SkyVehiGuard‐Net, a novel dual‐task hybrid architecture that synergistically integrates a Selective State Space Model (Mamba) backbone with a Deformable Multi‐Scale Axial Attention Transformer (DMSA‐T) module, orchestrated through a Sparse Gated Mixture‐of‐Experts (SGMoE) routing mechanism specifically engineered for latency‐aware vehicular security inference over SAGIN. The Mamba backbone captures long‐range temporal dependencies in CAN bus traffic sequences and URL character embeddings with linear computational complexity, while the DMSA‐T module introduces learnable deformable sampling offsets for adaptive multi‐scale feature aggregation across heterogeneous vehicular traffic patterns. A Channel‐Aware Adaptive Knowledge Distillation (CA‐AKD) framework compresses the full‐scale model into lightweight student variants deployable across SAGIN tiers—satellite edge, UAV relay, and roadside units (RSUs). A Federated Split Learning with Differential Privacy (FSL‐DP) protocol safeguards sensitive vehicular communication data traversing multi‐domain SAGIN segments. Explainability is ensured through dual‐pathway Grad‐CAM and SHAP interpretation modules. Comprehensive experiments on CICIDS2017, CSE‐CIC‐IDS2018, Car‐Hacking, CAN‐intrusion, and a curated malicious URL dataset under emulated SAGIN channel conditions demonstrate that SkyVehiGuard‐Net achieves state‐of‐the‐art intrusion detection accuracy of 99.47% on CICIDS2017, 99.31% on Car‐Hacking, and malicious URL detection accuracy of 98.92%, while reducing inference latency by 64.8% and model size by 73.2% compared to Vision Transformer baselines. The FSL‐DP protocol maintains detection performance degradation below 0.9% under strict privacy budget .