Anomaly Detection Based on Spatio-Temporal and Sparse Features of Network Traffic in VANETs

Vehicular Ad-Hoc Networks (VANETs) have received a great attention recently due to their potential and various applications. However, the initial phase of the VANET has many research challenges that need to be addressed, such as the issues of security and privacy protection caused by the openness of wireless communication networks among the city-wide applied regions. Specially, anomaly detection for a VANET has become a challenging problem, due to the changes in the scenario of VANETs comparing with traditional wireless networks. Motivated by this issue, we focus on the problem of anomaly detection in VANETs, and propose an effective anomaly detection approach based on the convolutional neural network in this paper. The proposed approach takes into account the spatio-temporal and sparse features of VANET traffic, and it uses a convolutional neural network architecture and a loss function based on Mahalanobis distance for anomaly detection. Furthermore, a comprehensive assessment is provided to validate the proposed approach, which illustrates the effectiveness of this approach.

I. Introduction

The VANET is an important and popular paradigm of mobile Ad-hoc network that provides a promising solution to intelligent transportation systems. A VANET is a self-organized peer-to-peer wireless network made up of On-Board Units (OBUs, e.g. vehicles) and Road Side Units (RSUs) [1], [2]. Under this scenario, the wireless links implement two types of communications, which are Vehicle-to-Vehicle and Vehicle-to-Infrastructure [3], [4]. As a network with high openness, network operators must pay much more attention to the network security threats such as Distributed Denial-of-Service (DDoS) attacks, jamming and PHY-layer Spoofing for guaranteeing users' privacy [5]–[10]. Traffic anomalies express the anomalous behaviors of network caused by various elements (e.g., malware and intrusions) [11]. A great number of approaches have been proposed to detect anomalies in traditional ISP networks over the last decade. Unfortunately, the problem of anomaly detection for VANETs is still a challenge, though the above state-of-the-art approaches have been directly applied to protect the security of VANETs. That is because the framework of a VANET is significantly different from the traditional ISP network, which can be summarized as follows: •

Fast Movement: In VANETs, the vehicles move at high speeds. As a result, the distance between two vehicles changes greatly.

•

Topology variability: The users in VANETs access (or exit) the network frequently and randomly. Hence, the topology of a VANET changes frequently comparing with the traditional ISP network.

•

Short-lived links: The fast movement and topology variability makes the links redirect continually. Moreover, the short-lived link is the major difference between VANETs and traditional ISP networks.