# Connected Vehicles Security: A Lightweight Machine Learning Model to Detect VANET Attacks
## 3 Related Work
### Machine Learning
[51] proposed a real-time malicious node prediction approach using ML. Their results were evaluated using SUMO and OMNET++ with ML classification approaches that included SVM, RF, MLPC, LR, and Gradient Boosted Tree (GBT). The obtained results show that RF and GBT performed better than SVM and LR, by achieving accuracy rates of 98% and 97%, respectively. The authors claimed that the accuracy rate of the proposed system approaches 99%. However, their target attacks were only misbehavior and DDoS. [PERSON] et al. [52] provided an empirical assessment of the use of DL and ML methods for misbehavior detection in VANETs. The RF classifier performed better than other methods. The classification methods evaluated in this study include long short-term memory (LSTM), artificial neural networks (ANNs), deep neural networks (DNNs), AdaBoost, RF, KNN, and DT. The study also focused on the trade-off between training and execution durations, showing that while ensemble and DL models yield more accurate outcomes, simpler techniques are quicker overall. With the exception of the ANN, which exhibits a recall performance lower than 90%, the author reported that all applied classifiersshowed good detection performance, often better than 94%. RF surpassed all of them, with a classification accuracy of 99%. However, the authors indicated that CNN, SVM, and RNN were assessed in terms of their performance, but there is nothing showing that in their article. [PERSON] et al. [43] indicated that securing SDN-based VANETs is essential and required the application of AI methods. To identify DDoS attacks in the automotive domain, they proposed an intrusion detection model. The proposed model uses a grid search cross-validation technique and the SVM classifier's radial basis function (RBF) kernel. The OBUs of each vehicle can be equipped with the proposed model. These units collect vehicular data and perform intrusion detection to determine whether a message is authentic or contains a DDoS attack. The overall accuracy of the proposed model is 99.33%. However, the model focuses on one type of attack, instead of considering various types. The ability to detect several types of attacks can significantly increase the visibility of the proposed model in terms of the computational cost. [PERSON] et al. [53] examined SVM optimization using three ML algorithms: a genetic algorithm (GA), ant colony optimization (ACO), and particle swarm optimization (PSO). They evaluated the optimization results with respect to classification accuracy. Their findings demonstrate that using a GA to optimize SVM parameters resulted in a detection rate of 99%. This indicates that the GA outperformed the PSO and ACO algorithms. These models were tested using the NSL-KDD dataset. However, training their model on a limited number of network scenarios raises questions about the model's robustness [43]. In addition, the NSL-KDD dataset does not include recent attacks [54]. [PERSON] and [PERSON] [12] suggested a hybrid optimization model for attack classification on a VANET based on a Deep Maxout Network (DMN) classifier. Attack categorization was performed using the DMN, which was trained using the presented optimization approach. With a recall and accuracy of 0.9462 and 0.9395, respectively, the proposed model performed better in the classification process. However, the cost requirement is high [48]. [PERSON] et al. [45] proposed an IDS by integrating ML and DL approaches to detect malicious attacks on VANETs. They claimed that the proposed IDS can discover both known and unknown attacks. Known attacks can be identified using the ANFIS classification model, and a DL model is employed to predict unknown attacks. Four types of attacks are considered using the CIC-IDS 2017 and i-VANET datasets. These include DoS, botnet, portscan, and brute force attacks. The average detection accuracy for these attacks was 98.6% when tested on both the i-VANET and CIC-IDS 2017. However, the detection of unknown attacks needs more verification. [PERSON] et al.