Abstract
Cooperative Intelligent Transportation Systems (cITSs) represent one of the Internet of Things (IoT) applications whose purpose is to improve road safety and traffic efficiency. Within this system, vehicles can communicate with one another by establishing a Vehicular Ad-Hoc Network (VANET) along the particular road section of interest. Although such connectivity facilitates the exchange of information related to road safety and traffic efficiency, at the same time connectivity puts vehicles at risk of compromise. An attacker could exploit one or more vehicles weaknesses, and use them to share false information causing congestion and/or life-threatening accidents. Several studies have tried to address this issue. Generally, those studies assume that the network topology and/or attack behavior is stationary. This is certainly not realistic, as the cITS is dynamic in nature, and the attackers may have the ability and resources to change their behaviour continuously. Therefore, these assumptions are not suitable and lead to low detection accuracy and high false alarms. To this end, this study proposes a misbehaviour detection model that can cope with the dynamicity of both cITS topology and attack behaviour. The model starts by addressing the issue of missing data using a local-global Fuzzy clustering estimation method. Then, a Proportional Conditional Redundancy Coefficient (PCRC) is used to calculate the values of redundancy and relevancy coefficients in the goal function of the feature selection. This helps to better estimate the discriminative features during the model training. The selected features were used to train an online deep learning-based model. The model uses a Bi-variate Moving Average (BiMAV) to observe the polymorphic patterns in the attack’s behaviour and re-adjust the security parameters accordingly was trained. In comparison to reported studies, the results show that the proposed method achieved improvement compared to the existing techniques (ACC - 4.4\% than LR , 3.8\% than SVM, and 3.6\% than CNN) (F1 - 2.9\% than LR, 2.2\% than SVM, 0.8\% than CNN) (FPR - 47\%LR, 46\% than SVM) (DR - 7.4\% than LR, 5.9\% than SVM, 5.4\% than CNN ). Then, the 2nd objective develops the Proportional Conditional Redundancy Coefficient (PCRC) which improves the feature significance estimation for the feature selection process that takes place during the Phase 2. The results show that the proposed method achieved improvement compared to the existing techniques (ACC - 2.6\% than DNN, 2.0\% than SVM, 3.1\% than LR ). During phase 3, the third objective was achieved by incorporating the Bi-variate Moving Average (BiMAV) technique into the DBN-based detection model and adapting to the changes in the cITS system. The results show that our method achieved improvement compared to the existing techniques (ACC - 2.4\% than SVM) (DR - 2.5\% than SVM) (FPR - 42\% than SVM) (F1 - 2.4\% than SVM) in a highly dynamic and potentially contested environment. There are many threats where this approach has much better chances of delivering the needed results and we believe is more resilient (e.g., False Data Injection). The proposed model is expected to overcome the limitations of related solutions by detecting attacks that change their behaviour continuously.