# Intelligent Intrusion Detection of Grey Hole and Rushing Attacks in Self-Driving Vehicular Networks
## 3 The Proposed Intrusion Detection System
### Methodology  
This section details the methodology for proposed IDS that has the ability to provide sufficient security of the external communication of self-driving and semi self-driving vehicles.  
The general structure of the proposed security system is shown in Figure 5. There are the following eight stages in the IDS:  
1 st Stage (generation of the realistic world): Obtain the mobility and traffic model which shows the actual movement of vehicles in VANETs. The ns-2 in this stage made use of the output file from MOVE and SUMO as input to obtain a trace file that defines both normal and abnormal.
2 nd Stage (ns-2): We made use of the output file extracted from the former stage as input files for the ns-2 in this stage. We replicate normal, rushing attacks and grey holes to create two files: Network Animator (NAM) file and trace file.
3 rd Stage (data extraction): Here we revisit stage two to extract all the features that were found in the trace file. Nonetheless, our proposed system can, however, work with a reduced feature set of just fifteen important features selected from all of the features [19]. Decreasing the number of features has an important effect in escalating the rate of detection and reducing the rate of false alarms.
4 th Stage (pre-processing): Here, we convert some letters and symbols to numerical values using the selected features that were pre-processed. We also want to use these selected features to generate a homogenous distribution to balance the various types of classes in the data collection so as to increase the efficiency of the rate of detection and normalization process to turn all the values of the features between 0 and 1 according to Equation (4):  
\[\mathrm{X}=\frac{x-MIN}{MAX-MIN} \tag{4}\]  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Parameter** & **Value** \\ \hline Train Param. Epochs & 46 \\ Train Param. Lr & \(1\times 10^{-8}\) \\ Train Param. Goal & 0 \\ Train Param. min\_grad & \(1\times 10^{-13}\) \\ Gaussian Radial Basis Function & 1 \\ BoxConstraint & \(1\times 10^{5}\) \\ \hline \hline \end{tabular}
\end{table}
Table 3: Feed Forward Neural Networks (FFNN) Parameters.  
Normalising data often allows an increase in the detection rate and enhances the performance of FFNN [12].  
5 th Stage (fuzzy set): In this stage, we convert the ordinary data that were generated in Stage 4 into fuzzified data. The process here can be used in solving some common problems that usually occur in the data set like the lack of clarity and overlap.  
6 th Stage (training and testing phase--FFNN): Stage 5 data are used to train and test the FFNN. We also obtain the rate of detection for both normal and abnormal behaviour in this stage and then determine the four alarm types.  
7 th Stage (training and testing phase--SVM): Here, in parallel to Stage 6, the training and testing of the SVM is carried out with fuzzified data, which was obtained in Stage 5 in order to identify the efficiency of the security system in the identification of rushing vehicles and grey hole in comparison to normal vehicles.  
8 th Stage (Comparison): Here, we compare both of the proposed intrusion detection systems that are based on categories, the number of false alarms, rate of detection, standard deviation and rate of error.