# Hybrid Trust Model for Node-Centric Misbehavior Detection in Dynamic Behavior-Homogeneous Clusters
## 1 Introduction  
Vehicular ad hoc network (VANET) systems, leveraging advanced communication technologies, have achieved a seamless interconnection among vehicles, roads, and cloud services, rendering VANETs complex and open networks. The complexity of VANETs is primarily manifested in the diverse types of vehicle nodes, dynamically varying network topologies, and unique characteristics of participating entities and behaviors [1]. Participants in VANETs confront information security threats from both external and internal attackers across all spatial and temporal dimensions. External attackers in VANETs refer to malicious users attempting to infiltrate the network from outside [2]. These attackers lack direct access to VANET resources and cannot participate in the network's information exchange. Cryptographic technologies are commonly employed to ensure security and defend against external attackers. On the other hand, internal attackers are misbehavior nodes that have penetrated the network and engaged in information exchange. Despite possessing legitimate access, authenticated misbehavior nodes may intentionally manipulate data, disseminate false information, and replay messages. Compared to external attackers, internal attackers with certainlevels of privileges pose a potentially more severe threat to VANETs. Therefore, detecting misbehavior nodes in VANETs is a crucial research direction. Current research on misbehavior detection in VANETs primarily focuses on data dimension, targeting anomalies caused by threatening behaviors [3; 4; 5; 6]. However, these approaches often concentrate solely on data anomalies and overlook other factors that might influence misbehavior, such as the interaction between vehicle nodes, and fail to analyze the behavioral characteristics of vehicle nodes, such as interactions with neighboring vehicles and movement patterns. To address these limitations, some scholars propose that trust management effectively identifies misbehavior vehicles in VANETs [7; 8; 9; 10]. Compared to other methods of detecting misbehavior vehicles, such as watchdog and network monitoring mechanisms, trust model-based node-centric misbehavior detection is suitable for highly dynamic VANET scenarios. It evaluates multiple dimensions of vehicle nodes, including historical behavior, feedback from neighboring nodes, and data authenticity, thereby enhancing the accuracy of misbehavior detection. Trust models typically combine direct and indirect trust assessments, offering a comprehensive evaluation of vehicle node trustworthiness. Even in the face of attackers attempting to tamper with or forge trust values, trust models maintain high robustness. Additionally, trust models are often based on cooperation among vehicle nodes, positively influencing information-sharing, resource allocation, and multi-vehicle collaboration in VANETs. Despite their advantages, trust-based misbehavior vehicle detection also faces a series of challenges. Due to the dynamic, complex, and diverse nature of VANETs, static trust management struggles to capture real-time changes and influences between vehicle nodes. Moreover, complex interrelationships among different types of nodes and vehicles in VANETs make it challenging for static trust management based on historical information to fully reveal the true behavior and trust status of vehicle nodes in the network. Static trust management systems often lack the flexibility to adapt to changing environments or evolving threats, potentially leading to outdated or inappropriate trust assessments. Additionally, they fail to incorporate real-time data or user behavior, which can result in a less accurate representation of the current trustworthiness of entities within a network [11]. In response to these challenges, this study proposes a hybrid trust model detection scheme tailored to the dynamic and intricate nature of VANETs. The scheme aggregates trust values for the same vehicle node from diverse dimensions and information sources within behavior-homogeneous clusters.