# Distributed Reputation for Accurate Vehicle Misbehavior Reporting (DRAMBR)
## 5 DRAMBR Technical Implementation
### DRAMBR: Online Reporting
Reports \(MR_{i}\) and \(MR_{j}\) within \(R_{I_{\text{inc}}}\) are considered part of the same cluster \(G_{I_{\text{inc}},k}\) if:  
\[\|L_{i}-L_{j}\|\leq\epsilon_{L}\quad\text{and}\quad|T_{i}-T_{j}|\leq\epsilon_{T} \tag{12}\]  
Reports that do not meet these criteria or do not belong to any cluster are treated as _noise_ (\(N_{I_{\text{inc}}}\)). Outputs:  
* Clusters (\(G_{I_{\text{inc}},k}\)): Groups of MRs consistent in location and time, representing reliable observations. * Noise(\(N_{I_{\text{inc}}}\)): MRs flagged as outliers (\(MR_{f}\)), which may indicate malicious or erroneous behavior. 3. Determining Ground Truth: For each cluster \(G_{I_{\text{inc}},k}\), the following steps are performed: 1. Majority Voting for Reported Status (\(S_{I_{\text{inc}},k}\)):  
Figure 12: Illustration of DBSCAN. Source: [46]. The dominant reported status \(S_{I_{\text{Inc},k}}\) (e.g., \"accident\" or \"no accident\") is determined using:  
\[S_{I_{\text{Inc},k}}=\arg\max_{s}\bigl{(}\text{Count of $S_{i}=s$ in $G_{I_{\text{Inc},k}}$}\bigr{)} \tag{13}\]  
2. Confidence Aggregation for Ground Truth:  
In this step, the system calculates the cluster's confidence based on the Reporter's RV. The confidence of the majority-reported status \(S_{I_{\text{Inc},k}}\) within a cluster \(G_{I_{\text{Inc},k}}\) is calculated as follows to assess the reliability of the cluster:  
\[\text{Confidence}(S_{I_{\text{Inc},k}})=\frac{\sum_{MR_{i}\in G_{I_{\text{Inc},k}}\text{ and }S_{i}=S_{I_{\text{Inc},k}}}C_{i}}{\sum_{MR_{i}\in G_{I_{\text{Inc},k}}}C_{i}} \tag{14}\]  
where the following:  
* The numerator aggregates the confidence scores \(C_{i}\) of reports within the cluster that align with the majority-reported status \(S_{I_{\text{Inc},k}}\). * The denominator aggregates the total confidence scores of all reports in the cluster. 3. Final Decision:  
If \(\text{Confidence}(S_{I_{\text{Inc},k}})\geq\text{Threshold}\), \(S_{I_{\text{Inc},k}}\) is accepted as the ground truth for incident \(I_{\text{inc}}\). This step ensures that only verified and consistent observations are used to analyze \(Rep_{\text{Velbs}}\) behavior and update their RVs. 4. **Outlier Detection Using Isolation Forest for Anomaly Detection. **  
After DBSCAN groups reports into clusters and flags noise points, Isolation Forest (_iForest_) refines this process by detecting anomalies (e.g., malicious or erroneous reports) within each cluster \(G_{I_{\text{Inc},k}}\)[35; 47; 36]. This step works on the output of DBSCAN clusters and focuses on deeper, feature-based anomaly detection. iForest distinguishes between mild anomalies and extreme outliers. The input is each \(G_{I_{\text{Inc},k}}\) cluster from DBSCAN. The iForest calculates the anomaly score \(s(x,n)\) for each report \(MR_{i}\). Path Length: Define \(h(x)\), the number of splits required to isolate point \(x\). Anomaly Score for \(MR_{i}\):  
\[s(x,n)=2^{-\frac{h(x)}{c(n)}},\quad c(n)=2H(n-1)-\frac{2(n-1)}{n}, \tag{15}\]  
where the following are used:  
* \(H(x)\) is the harmonic number measures the number of steps or splits to isolate \(x\);
* \(n\) is the sample size;
* \(c(n)\) normalizes the path length. Outlier Classification:  
\[s(x,n)>\tau_{if} \tag{16}\]  
MRs are classified as outliers (potential \(MR_{f}\)), where \(\tau_{if}\) is the anomaly score threshold that determines whether an \(MR_{f}\) is classified as an outlier or an inlier. Output: Classification of \(MR_{f}\) as outliers (anomalies) or inliers (consistent). 5. **Gaussian Mixture Model (GMM) for MR Classification** Model the MR features \(\mathbf{x}=[RV,\delta_{L},\delta_{T}]\) using a Gaussian Mixture [37]: \[p(\mathbf{x})=\sum_{k=1}^{K}\pi_{k}\mathcal{N}(\mathbf{x}\mid\boldsymbol{\mu}_ {k},\boldsymbol{\Sigma}_{k}),\] (17) where the following are used: \(\bullet\)\(\pi_{k}\) is the mixing weight (sum to 1); \(\bullet\)\(\boldsymbol{\mu}_{k}\) is the mean vector; \(\bullet\)\(\boldsymbol{\Sigma}_{k}\) is the covariance matrix.