No abstract

Cooperative Intelligent Transport Systems (C-ITS) is an advanced technology for road safety and traffic efficiency over Vehicular Ad Hoc Networks (VANETs) allowing vehicles to communicate with other vehicles or infrastructures. The security of VANETs is one of the main concerns in C-ITS because there may be some attacks in such type of network that may endanger the safety of the passengers. Intrusion Detection Systems (IDS) play an important role to protect the vehicular network by detecting misbehaving vehicles. In general, the works in the literature use the same well-known features in a centralized IDS. In this paper, we propose a Machine Learning (ML) mechanism that takes advantage of three new features, which are mainly related to the sender position, allowing to enhance the performances of IDS for position falsification attacks. Besides, it presents a comparison of two different ML methods for classification, i.e. k-Nearest Neighbor (kNN) and Random Forest (RF) that are used to detect malicious vehicles using these features. Finally, Ensemble Learning (EL) which combines different ML methods, in our case kNN and RF, is also carried out to improve the detection performance. An IDS is constructed allowing vehicles to detect misbehavior in a distributed way, while the detection mechanism is trained centrally. The results demonstrate that the proposed mechanism gives better results, in terms of classification performance indicators and computational time, than the best previous approaches on average.INDEX TERMS misbehavior detection, machine learning, vehicular ad hoc network, intelligent transport systems, dataset.

Vehicular ad hoc networks (VANETs) are expected to play an important role in our lives. They will improve traffic safety and bring a revolution on the driving experience. However, these benefits are counterbalanced by possible attacks that threaten not only the vehicle's security, but also passengers lives. One of the most common ones is the Sybil attack, which is more dangerous than others since it could be the starting point of many other attacks in VANETs. This paper proposes a distributed approach allowing the detection of Sybil attacks using the traffic flow theory. The key idea here is that each vehicle will monitor its neighbourhood in order to detect an eventual Sybil attack. This is achieved by comparing between the real accurate speed of the vehicle and the one estimated using the V2V communications with vehicles in the vicinity. This estimated speed is obtained using the traffic flow fundamental diagram of the road's portion where the vehicles are moving. A mathematical model that evaluates the rate of Sybil attack detection according to the traffic density is proposed. Then, this model is validated through some extensive simulations conducted using the well-known NS3 network simulator together with SUMO traffic simulator.