# Streaming-Based Anomaly Detection in ITS Messages
## 2 Materials and Methods
### Problem Statement  
**Definition 1**.: _Message: Each CAM message \(\mathfrak{m}_{i}\) is defined by < \(v_{id}\), \(t\), \(x\), \(y\), \(s\), \(h>\), where we have the following:_  
* \(v_{id}\) _is the vehicle identifier;_
* \(t\) _is the timestamp of the message;_
* \(x\) _is the longitude of the vehicle_ \(v_{k}\) _at time_ \(t\)_;_
* \(y\) _is the latitude of_ \(v_{k}\) _at time_ \(t\)_;_
* \(s\) _is the speed of_ \(v_{k}\) _at time_ \(t\) _in metres/second;_
* \(h\) _is the heading of_ \(v_{k}\) _at time_ \(t\) _in degrees._  
**Definition 2**.: _Vehicle Trajectory: A trajectory is a time-ordered sequence of \(n\) messages belonging to a given vehicle such that \(T_{k}\asymp m_{1},m_{2},\ldots,m_{n}>\)_  
In this work, a trajectory is defined as the collection of all messages that are uniquely identifiable by a single identifier. A sub-trajectory is a series of sequential messages that are part of a trajectory.  
**Definition 3**.: _Sub-Trajectory \(T_{k}^{i}\) is a sub-trajectory of \(T_{k}\) if and only if the following hold:_  
* \(T_{k}^{i}\) _is a trajectory:_ \(T_{k}^{i}\)_=_\(\langle m_{i_{1}},\ldots,m_{i_{p}}\rangle\)_._
* \(\forall m_{i_{j}}\in T_{k}^{i}\)_,_ \(m_{i_{j}}\in T_{k}\)_._
* _All consecutive messages in_ \(T_{k}^{i}\) _are also consecutive in_ \(T_{k}\)_, i.e., there does not exist a message of_ \(T_{k}\) _situated between messages of_ \(T_{k}^{i}\) _that does not belong to_ \(T_{k}^{i}\)_:_ \[\
exists m_{j}\in T_{k}\text{ and }m_{j}\
otin T_{k}^{i}\text{ with }\] \[Rank(T_{k},m_{i_{1}})\leq Rank(T_{k},m_{i})\leq Rank(T_{k},m_{i_{p}})\]  
Suppose we have a dataset \(Z=\{\mathfrak{z}_{1},\mathfrak{z}_{2},\ldots,\mathfrak{z}_{n}\}\), where \(n\) is the total number of instances. Each instance \(i\) of \(Z\) consists of both contextual and behavioural attributes. Additionally, within \(Z\), we have a set \(O\) of instances that are outliers or anomalies. Our goal is to assign each instance \(i\) with an outlierness score \(S_{i}\) such that outliers in \(O\) have much higher values than other instances. The outlierness of an instance results from the abnormal behavioural attributes in its context. Given the contextual attributes, there is an underlying pattern that limits the behavioural attributes to some expected values, beyond which an instance is considered an outlier.  
**Definition 4**.: _Contextual outlier: Based on its contextual features, this is an instance whose behavioural attributes contradict the dependent pattern._  
**Definition 5**.: _Contextual neighbours: Contextual neighbours of instance \(i\) are the instances that are comparable to it based on its contextual attributes. In principle, the collection of contextual neighbours of instance \(i\) is_  
\[CN_{i}=\{j:j\in D\wedge j\
eq i\wedge\text{sim}(x_{i},x_{j})\geq\varphi\} \tag{12}\]  
_where \(x_{i}\) and \(x_{j}\) are contextual attribute vectors, \(D=\{1,2,\ldots,N\}\) denotes the set of instances indexes, sim(\(\cdot\)) is a similarity function of two vectors, which in our case is a correlation measure, and \(\varphi\) is a predefined similarity threshold._  
The study concentrates on unsupervised contextual anomaly detection. It is preferable to develop a robust model capable of efficiently and reliably predicting an observation as an anomaly when the behavioural attributes are anomalous in the context. Moreover, such a model should be sensitive to abnormalities in the contextual attributes and make meaningful predictions using the best available relevant context. With the goal of improving detection performance in anomaly detection, an ensemble-based anomaly detection technique with heterogeneous base detectors is developed.