Misbehavior Detection Method by Time Series Change of Vehicle Position in Vehicle-to-Everything Communication

In recent years, research has been conducted on connected vehicles (CVs) that are equipped with communication devices and can be connected to networks. CVs share their own position information and surrounding information with other vehicles using Vehicle-to-Everything (V2X) communication. CVs can recognize obstacles on non-line-of-sight (NLoS), which cannot be recognized by autonomous vehicles, and reduce travel time to a destination by cooperative driving. Therefore, CVs are expected to provide safe and efficient transportation. On the other hand, problems of security of V2X communication by CVs have been discussed. Safe and efficient transportation by CVs is on the basis of the assumption that correct vehicle information is shared. If fake vehicle information is shared, it will affect the driving of CVs. In particular, vehicle position faking has been shown that it can induce traffic congestion and accidents, which is a serious problem. In this study, we define position faking by CV as misbehavior and propose a method to detect misbehavior on the basis of changes in vehicle position time series data com-posed of vehicle position information. We evaluated the proposed method using four different misbehavior models. F-measure of misbehavior models that CV sends random position information detected by the proposed method is higher than one by a related method. Therefore, the proposed method is suitable for detecting misbehavior in which the position information changes over time.


Introduction
In recent years, expectations for connected vehicles (CVs) equipped with communication devices have increased, and studies for their widespread use have been widely conducted. CVs communicate with other vehicles and a cloud by vehicle-to-anything (V2X) communication between multiple CVs. CVs share their own position information and surrounding information with other vehicles using V2X communication. By sharing position information and surrounding information, CVs can recognize obstacles on non-line-of-sight (NLoS), which cannot be recognized by autonomous vehicles, and prevent accidents [1]. Moreover, CVs can change lanes safely [2] and reduce travel time to a destination [3] by cooperative driving. Therefore, CVs are expected to provide safe and efficient transportation.
However, the connection of CVs to networks is expected to cause security problems.
Possible CVs security problems include vehicles being hijacked on the basis of hacking from outside the vehicle [4], intentional traffic congestion due to vehicle camouflage [5] and Sybil attacks [6]. Therefore, CVs security is very important because attacks on CVs directly endanger the lives of drivers and pedestrians. Conventional vehicle security methods are not sufficient because they do not take into account that the vehicles are connected to networks. Hence, a security countermeasure method that assumes the use case of the attacks on CVs is necessary. Past research focused on position faking among the attacks against CVs. However, position faking is difficult to prevent position faking by not only conventional vehicle security methods, but also by network security methods such as pre-shared key (PSK) authentication and public key infrastructure (PKI) [7]. In addition, position faking has various negative impacts such as traffic accidents, partial occupation of roads, and traffic congestion and significantly impacts an intelligent transportation system (ITS).
In this study, we define position faking by CVs as misbehavior and propose a method to detect misbehavior on the basis of changes in vehicle position time series data.

Detection of Malicious Nodes in VANETs Algorithm Method
Detection of malicious nodes in VANETs (DMN) algorithm has been proposed [8]. It is designed to isolate the nodes showing abnormal behavior as well as enhancing the network performance. This method is to detect malicious vehicles that drop or duplicate packets sent from other vehicles. Therefore this attack is not included in the attack that we want to detect.

Machine Learning Method
A misbehavior detection method using machine learning has been proposed [9]. Specifically, the misbehavior detection uses position information of senders and T. Okamura, K. Sato receivers of vehicle-to-vehicle (V2V) communication and received signal strength indicator (RSSI) as features, and performs unsupervised machine learning. For the machine learning model, they proposed a new model based on Deep Autoencoder and used it. As a result, when the ghost vehicle is 100 m away from the real vehicle, the detection rate for the proposed model is nearly 100%.
However, when the ghost vehicle is less than 30 m away from the real vehicle, or when the RSSI values of the ghost vehicle and the real vehicle are close, the masqueraded position data is difficult to detect.
In another study, an ensemble method that combines the results of individual classifiers, such as Native Bayes, Adaboost 1, and so on, into one final result in order to achieve higher detection accuracy is proposed [10]. In this experiment, misbehavior on a highway is assumed. Our method is subject to misbehavior in a city scenario. Therefore this study is not included in our study.
A misbehavior classifier with a set of features by using artificial neural network (ANN) techniques is also proposed [11]. The classifier is trained using feedforward back-propagation ANN with one hidden layer after collection of enough data. This method needs to train the model before detecting misbehavior. In our study, we focused on a misbehavior detection without learning beforehand.

Heartbeat Message Method
A misbehavior detection method using heartbeat messages has been proposed [12]. The specific procedure is shown below.
1) A reporting vehicle periodically broadcasts its positional and kinematics information through their heartbeat message.
2) An observing vehicle running a misbehavior detection scheme receives heartbeat messages from the reporting vehicles.
3) The observing vehicle predicts the current position of the reporting vehicle on the basis of the information acquired at the previous time.
4) The misbehavior detection determines whether the reporting vehicle is misbehaving or not on the basis of its expected current position.
Through a simulation, high precision and recall were measured in a highway scenario without intersections, but low precision and recall were measured in a city scenario with intersections. There is also the problem that the reporting vehicle outside the observing vehicle's dedicated short range communication (DSRC) can misbehave.

Mutual Position Monitoring Method
A misbehavior detection method has been proposed on the basis of the mutual vehicle position monitoring using V2X communication [13]. The specific procedure is shown below.
1) Vehicles exchange vehicle IDs with nearby vehicles using V2V communication.
2) Vehicles send its position information and IDs of peripheral vehicles ob-tained in 1 to a cloud. Then the base station adds the base station ID to the packet.
3) The cloud checks whether the vehicle's position is within the possible V2V communication area of the peripheral vehicles. When the position information is outside the possible V2V communication area, the cloud determines that the received position information has been camouflaged.
This method can detect masqueraded position data from malicious vehicles.
However, it has two problems with this method. First, misbehavior of a vehicle that has no peripheral vehicles cannot be detected. Second, the method may not be able to detect misbehavior if the misbehavior is performed in a short distance from the vehicle's actual position. That is because that position information can be disguised within a range in which peripheral vehicles and the V2V communication range are possible.

System Architecture
One problem with conventional methods for misbehavior detection is that misbehavior is difficult to detect on maps that include intersections or when misbehavior is a short distance away. Therefore, to solve the problems of conventional methods, we verify a misbehavior detection method that focuses on changes in position time series data. Figure 1 shows the system structure of the proposed method. We introduce a cloud and CVs in the system. The cloud is a server on networks that communicates with CVs. In an ITS, the cloud can aggregate vehicle information and pedestrian data to provide a dynamic map [14]. In this study, the cloud obtains vehicle position information from all CVs. Then, the cloud creates position time series data for each vehicle and uses it to detect misbehavior. Position time series data is a vector whose elements are vehicle position information at each time. This time, the position information is added to the time series data every time a cloud communicates with the CVs. When the cloud communicates in 1 s cycles, position information is added every 1 s. Furthermore, the position information is the data that represents the area where the cloud can communicate in the Cartesian coordinate system (x, y).
Next, we describe CVs, which can communicate with the cloud using cellular networks, and with CVs using DSRC or long-term evolution (LTE) direct. In this study, the CV transmits the vehicle position information to the cloud. CVs usually send the exact position information of their vehicles. However, for criminal purposes, CVs send masqueraded position information to the cloud, which is different from the vehicle position. Thus, an act of a CV sending masqueraded position information to the cloud is misbehavior.

Anomaly Detection
Anomaly detection is a method for detecting anomaly samples from a population in statistics [15]. In this study, the population is the position information and the anomaly samples are masqueraded position data. In addition, an anomaly score is defined by singular spectrum transformation (SST). SST is independent of a distribution of time series data, applicable to various types of data, and robust to noise introduced into the data.

Singular Spectrum Transformation
Equations (1) to (7) represents SST. In Equation (1), D is position time series data, whose elements are position information ξ(t) of a vehicle at time t.

First, Equation (1) is transformed into Equation (2). Equation (2) is a Hankel
Matrix. x is a time series data with M elements as shown in Equation (3). From the time series data D, a history matrix X(t) with a window size M and the number of columns n and a test matrix Z(t) with a lag L and the number of columns k are generated as in Equations (4) and (5). The window size is the number of elements of x, which is an element of the matrix.
As a result of singular value decomposition of X(t) and Z(t), matrices of left-singular vectors are obtained as shown in Equations (6)  Finally, an anomaly score a is defined by (8). σ 1 is the largest singular value of ( ) ( ) The anomaly score indicates the magnitude of the difference between the history matrix and the test matrix. If the anomaly score is greater than or equal to a predefined anomaly threshold h, the test matrix is recognized as different from the history matrix and is judged to be anomalous.

Misbehavior Models
In this study, we evaluate four types of misbehavior models based on the research of So [16] to determine which misbehavior model the proposed method is suitable for detecting.   First, the cloud obtains the position information of the CVs that is sent periodically. The cloud keeps storing the vehicle position time series data. First, the cloud creates history matrices. Once the number of data to which SST can be applied is stored, the cloud applies SST to the position time series data and obtains left-singular vectors. Next, the cloud creates test matrices in the same way, using the position time series data with a time lag L shifted from the history matrices, and obtains left-singular vectors. The cloud calculates the anomaly score using left-singular vectors, and if the anomaly score is greater than or equal to the anomaly threshold, the cloud determines that the vehicle has been misbehaving.

Evaluation Environment
We use a simulator to evaluate a detection rate of misbehavior detection of the proposed method. For the evaluation, CVs, base station, and cloud were reproduced using Scenargie [17], a network simulator developed by Space-Time Engineering (STE).
We used a Manhattan model with roads of 1 km 2 and intersections every 200 m in both the x-and y-axis directions of the map. We used a geographic information system (GIS)-based random waypoint [18], which is a model of random movement on the road on the basis of the random-waypoint mobility model.
The simulation was performed for 10 minutes on the basis of the related methods. We assumed that the malicious vehicles would misbehave for a total of 2 minutes, from 120 s to 180 s and from 420 s to 480 s. Because malicious vehicles are unlikely to misbehave all the time, we set up the malicious vehicles to misbehave for one minute in both the first and second halves of the simulation. Table 1 shows the simulation environment and communication method.
It is highly probable that a misbehaving vehicle may not misbehave all the time. Therefore, we set up the misbehaving vehicle to misbehave for one minute in each of the first and second halves of the simulation.
We calculated anomaly scores by SST with the following parameters. A window size M is 20. The history matrix and test matrix contain 10 columns. We used only one left-singular vector to calculate anomaly scores. Therefore, both r and m are 1. The lag L between the history matrix and the test matrix is 10.
In this study, we focused on misbehavior while driving. Therefore, there is assumed to be no misbehaving at the start of driving. In addition, we do not consider the noise of the position information when the vehicle acquires its own position information.

Evaluation Method
We used precision, recall, and F-measure as evaluation methods for the pro-

Comparison with Conventional Method
To clarify whether the proposed method is effective, we created models on Scenargie on the basis of the mutual position monitoring method. The road environment, the number of vehicles, and the communication method are the same as in the proposed method. The communication method of V2V communication is ARIB STD T109, and the communication period is 100 ms. The radio spread model of V2V communication is ITU-R P.1411. The number of peripheral vehicles necessary for a cloud server to trust is 20 % of the number of vehicles at the base station where the vehicle communicates.

Precision, Recall, and F-Measure of Misbehavior Detection
Figures 4-6 shows the precision, recall, and F-measure for misbehavior detection by the proposed method. In all models, lowering the anomaly threshold   improved recall but reduced precision, whereas the F-measure improved because the recall improved more than the precision. Since the highest F-measure is in Figure 6 when the anomaly threshold was 0.001, the anomaly threshold was fixed at 0.001 in the subsequent evaluations. In addition, in both precision and F-measure, the best value is shown in model 3 for all anomaly threshold values. Even in recall, the best value is shown in model 3 except when the anomaly threshold value is 0.001. From this result, the proposed method is suitable to detect the misbehavior of model 3. On the other hand, there is no significant difference between models 1 and 2.

Conclusions
Misbehavior of position information using vehicle-to-anything (V2X) communication by connected vehicles (CVs) can induce traffic congestion and significantly affect intelligent transportation system (ITS). Therefore, to prevent misbehavior, a method to detect misbehavior is necessary.
In this study, we proposed a method for a cloud to detect misbehavior by detecting changes in position time series data by anomaly detection. In the proposed method, we defined an anomaly score in singular spectrum transformation (SST) and prepared four types of misbehavior models. The proposed method is implemented using the simulator Scenargie. We presented the precision, recall, and F-measure when varying the anomaly threshold and when comparing the proposed method with a related method, the mutual position monitoring method. The results demonstrated that the proposed method can detect misbehavior. In addition, it is verified that the proposed method is more suitable than the mutual position monitoring method for detecting misbehavior in which the position information changes dynamically over time. In this study, the evaluation condition was that CVs did not misbehave at the start of operation. In the future, we need to devise a method to enable misbehavior to be detected at the start of operation with the proposed method. In addition, we need to investigate the effect of time-lag on software used after misbehavior detection.