## 4 Results and Discussion
### Comparison with State-of-the-Art Methods  
In this section, we present a concise comparison of our proposed work with the state-of-the-art methods explored in this study as exhibited in Table 5.  
The comparison is conducted based on several parameters such as the real-time detection, the dataset used, the involved tools, the considered evaluation metrics, and the online learning approach.  
The results of this comparison indicate that the current study may offer a novel strategy, involving incremental online learning for detecting routing attacks in VANETs.  
First, a key benefit of our approach is the ability to monitor the behavior of nodes in the network in real-time. This allows identifying potential threats in time and acting appropriately.  
Further, we build our own dataset for attack detection, which incorporates essential features, which are relevant in capturing the behavior of VANET nodes under black hole attacks.  
Additionally, the adopted simulation methodology allows reliable VANET simulations built upon accurate mobility models that were generated from realistic maps using popular tools like OSM, SUMO, and NS-3.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Study** & **Approach** & **Real-Time** & **Dataset** & **Tools** & \
\begin{tabular}{c} **Performance** \\ **Metrics** \\ \end{tabular} &
\begin{tabular}{c} **Continuous** \\ **Learning** \\ \end{tabular} \\ \hline
[14] & SVM and Logistic & No & VeReMi & PYTHON tools & F1-score & No \\ \hline
[16] &
\begin{tabular}{c} Binary classification with \\ Naïve Bayes, decision tree \\ and Random Forest \\ \end{tabular} & No & VeReMi & PYTHON tools & Accuracy & No \\ \hline
[17] &
\begin{tabular}{c} Random Forest and a \\ posterior detection based \\ on coresets \\ \end{tabular} & No & CICIDS2017 & MATLAB & Accuracy & No \\ \hline
[18] & \begin{tabular}{c} Hybrid \\ optimization-based Deep \\ Maxout Network (DMN) \\ \end{tabular} & No & \
\begin{tabular}{c} BoT-IoT data \\ and \\ NSL-KDD \\ data \\ \end{tabular} & PYTHON tools &
\begin{tabular}{c} Precision \\ and Recall \\ \end{tabular} & No \\ \hline
[19] & \
\begin{tabular}{c} Adaptive Neuro Fuzzy \\ Inference System (ANFIS) \\ and Convolutional Neural \\ Networks (CNN) \\ \end{tabular} & No & CICIDS 2017 & PYTHON tools &
\begin{tabular}{c} Precision \\ Sensitivity \\ Recall \\ Specificity \\ \end{tabular} & No \\ \hline
[22] & \
\begin{tabular}{c} ML methods for \\ classification, KNN and RF \\ \end{tabular} & No & VeReMi & PYTHON tools &
\begin{tabular}{c} Accuracy \\ F1-Score \\ \end{tabular} & No \\ \hline
[21] & SVM & No & \begin{tabular}{c} Generated \\ data \\ \end{tabular} & \
\begin{tabular}{c} SUMO and \\ OMNeT++ \\ PYTHON tools \\ \end{tabular} & TPR, FPR, and
\begin{tabular}{c} \\ ACC \\ \end{tabular} & No \\ \hline
[31] & \begin{tabular}{c} Distributed multi-layer \\ classifier \\ \end{tabular} & Yes & \begin{tabular}{c} Generated \\ data \\ \end{tabular} & OMNET++ SUMO & Accuracy & No \\ \hline Our work & \begin{tabular}{c} Incremental Online \\ classification using \\ Adaptive Random Forest \\ (ARF) and K-Nearest \\ Neighbors (KNN) \\ classifiers \\ \end{tabular} & Yes & Generated & \
\begin{tabular}{c} NS-3 \\ data \\ \end{tabular} &
\begin{tabular}{c} Accuracy \\ Recall \\ Precision \\ F1-score \\ Training time \\ \end{tabular} & Yes \\ \hline \hline \end{tabular}
\end{table}
Table 5: Comparison with state-of-the-art ML methods for attack detection.  
Finally, our proposed approach allows continuous and real-time learning thanks to the incremental learning process, which allows for the use of data as it becomes available, creating models that are constantly up-to-date instead of models that are trained on fixed datasets. This suggests that it is capable of learning and improving its predictions or decisions as new data arrive.