A New Multivariate Approach for Real Time Detection of Routing Security Attacks in VANETs

Routing security attacks in Vehicular Ad hoc Networks (VANETs) represent a challenging issue that may dramatically decrease the network performances and even cause hazardous damage in both lives and equipment. This study proposes a new approach named Multivariate Statistical Detection Scheme (MVSDS), capable of detecting routing security attacks in VANETs based on statistical techniques, namely the multivariate normality tests (MVN). Our detection approach consists of four main stages: first, we construct the input data by monitoring the network traffic in real time based on multiple metrics such as throughput, dropped packets ratio, and overhead traffic ratio. Secondly, we normalize the collected data by applying three different rescaling techniques, namely the Z-Score Normalization (ZSN), the Min-Max Normalization (MMN), and the Normalization by Decimal Scaling (NDS). The resulting data are modeled by a multivariate dataset sampled at different times used as an input by the detection step. The next step allows separating legitimate behavior from malicious one by continuously verifying the conformity of the dataset to the multivariate normality assumption by applying the Rao–Ali test combined with the Ryan–Joiner test. At the end of this step, the Ryan–Joiner correlation coefficient (R–J) is computed at various time windows. The measurement of this coefficient will allow identifying an attacker’s presence whenever this coefficient falls below a threshold corresponding to the normal critical values. Realistic VANET scenarios are simulated using SUMO (Simulation of Urban Mobility) and NS-3 (network simulator). Our approach implemented in the Matlab environment offers a real time detection scheme that can identify anomalous behavior relying on multivariate data. The proposed scheme is validated in different scenarios under routing attacks, mainly the black hole attack. As far as we know, our proposed approach unprecedentedly employed multivariate normality tests to attack detection in VANETs. It can further be applied to any VANET routing protocol without making any additional changes in the routing algorithm.