# Distributed Reputation for Accurate Vehicle Misbehavior Reporting (DRAMBR)
## 4 System Model
### Workflow and DRAMBR Phases
#### 4.4.1 Process 1: Offline Evaluation (OE)  
This phase occurs offline, where vehicles evaluate the accuracy of road status information within the offline network. Vehicles monitor each other's behavior and trustworthiness in an ad hoc manner, without relying on trusted authorities to identify potential misbehavior. Before diving into the main steps in the OE process, we first explain the critical events that trigger the local detection and evaluation mechanisms within the system. The trigger event \(O(M)\) for identifying misbehavior occurs when the \(Tar_{\text{veh}}(V_{j})\) transmits contradicts observable conditions, which is the basic event that drives the system responses. \(O(M)\) could indicate misbehavior in two possible activities:  
* Failure Alert Transmission: When \(V_{j}\) detects an incident (e.g., accident) but does not transmit it, nearby observing vehicles (\(Rep_{\text{Vehs}}\)) may detect this omission through their OBUs or reports from other vehicles. * False Alert Transmission: When \(V_{j}\) transmits an emergency when no accident or hazard exists, observing vehicles compare this false claim with their OBUs data and messages from others. These misbehavior activities are referred to as conflicting messages, where multiple messages provide inconsistent or contradictory information. While the work by [41; 42; 43] addresses the issue of receiving conflicting messages, our focus in this OE process is to accurately generate MRs based on observations in offline mode. Various possibilities exist for reporting abnormal behavior under emergencies as stated in Table 3. Outlining these actions is essential to analyze and evaluate the vehicle's behavior in various scenarios involving emergency events. The table shows different possibilities that vehicles can take based on whether they observe a misbehavior and whether they intend to \begin{table}
\begin{tabular}{c l l} \hline \hline
**Unit** & **Purpose** & **Connectivity** \\  & & **Status** \\ \hline \multirow{2}{*}{OBU} & Detecting misbehavior, generating MR, and interacting with other vehicles and the RS. & Online/Offline \\ \hline RS & Aggregates MRs and adjusts the RVs of vehicles. & Online \\ \hline \multirow{2}{*}{DSRC} & Facilitates V2V and & Vehicle-to-Infrastructure (V2I) & Online/Offline \\  & communications. & \\ \hline \multirow{2}{*}{MA} & Global misbehavior detection, generating and & \\  & broadcasting CRLs and creating and storing the CRLs. & Online \\ \hline \hline \end{tabular}
\end{table} 
Table 2: DRAMBR System Units. generate an accurate or false MR. _O(R)_, _O(NR)_, _O(NMR)_, and _O(NNMR)_ capture different aspects of reporting behavior, including truthful, non-reporting, or malicious reporting. These action estimations become part of the system process to aid in decision-making, wherein the RS assesses incoming MRs and verifies them through RVs, cross-verification, and the likelihood of correct reporting behavior. We propose a multi-step process called Local Misbehavior Detection Mechanism (LMDM) in order to cope with insider attackers; see Figure 9. LMDM represents the OE process operating at the local level to detect misbehaviors by analyzing reports and interactions within a localized scope. It is a component of DRAMBR that detects misbehavior locally by directly observing malicious activities (e.g., directly observing a situation incompatible with a received message) or indirectly by receiving conflicting messages, at least one of which must be false. The remainder of DRAMBR concerns storing, reporting, aggregating and integrating the observations. The detection criteria in this phase are as follows:  
* Message Integrity: Ensure that received messages are not altered. * Communication Frequency: Detect flooding attacks if a vehicle sends an excessive number of messages. * Message Validity: Verify that the content of the message (e.g., location or speed) matches observed reality.