The Internet of Vehicles (IoV), a burgeoning application of the Internet of Things (IoT), confronts a growing array of cyber-attacks, necessitating a robust network intrusion detection system (NIDS) to safeguard its security. Current NIDS solutions have limitations in key performance metrics such as accuracy, recall, and false positive rate, and they exhibit inadequate generalization in identifying novel attack patterns. To address these challenges, we design an anomaly-based network intrusion detection system within a fog computing architecture. Our model employs a Variational Autoencoder (VAE) to extract deep features from network traffic and establish a baseline of normal behavior patterns. Any traffic that deviates significantly from this baseline is identified as an anomaly, potentially indicating an attack. By utilizing the Receiver Operating Characteristic (ROC) curve, we carefully select the optimal decision threshold to enhance the model’s detection performance. We conduct a comprehensive evaluation on the BoT-IoT dataset, and the results indicate that our method’s accuracy and recall is 4% to 11% and 3% to 15% higher than other methods, respectively. These results highlight the potential of our approach in providing advanced network security protection in the IoV environment.