## 4 Proposed Scheme (Multi-BSM Approach)
### Detection and Prevention of Position falsification Attack  
As the RSUs are aware of their surroundings and are capable of detecting anomalies in the network when a BSM is received at RSU from a vehicle, it firstly checks all the relevant data in the BSM and scans the centralized database for the previous BSM of the same vehicle. If the previous BSM of the same vehicle does not exist in the records, then the received BSM is documented for that specific vehicle. If the previous BSMs of the same vehicle are found in the records, then the RSU compares the current BSM with the previous BSMs to detect any anomaly that may be present in the concerned data, e.g., position falsification attack that may be initiated by a malicious attacker with an intent to cause harm. These position falsification attack data vary a lot from the legitimate data that are being generated by an authentic vehicle, as the specific fields in the BSM have quite extreme changing of values.Upon the detection of the position falsification attack, the next step is to alert the connected vehicles and prevent any harm that can be caused by such attacks. Algorithm 1 describes the anomaly detection that takes place at an RSU. ```
1:RSU \(\leftarrow\)\(M_{b}\)
2:for\(i=1;\ i\)++; \(i<db.size\)do
3:if\(db.M_{b}==M_{b}\)then
4:\(M_{b}^{t}\leftarrow\phi\)
5:if\(M_{b}==\phi\)then
6: flag \(M_{i}\)
7: broadcast(\(M_{i}\))
8: transmit(\(M_{i}\)) \(\to RSU_{M_{i}^{t}}\)
9:else
10:\(M_{b}^{t}=M_{b}\)
11:endif
12:else
13:\(db=M_{b}\)
14:endif
15:endfor
```  
**Algorithm 1** Anomaly detection at RSU. To accurately detect the position falsification attack, the BSMs are thoroughly checked with the previous BSMs of the same vehicle. In order to detect Attack Type 1, the parameters for the location, speed, and direction are analyzed, in which the malicious vehicle is periodically generating the same position. It can be observed that the position of the vehicle is not changing; it is pretending to be at a stationary location, but the values of the speed parameter are not zero, and the direction is also sometimes changing. This triggers the detection of the anomaly present in the BSMs, and the concerned vehicle is flagged as malicious. In Attack Type 2, the malicious vehicle randomly broadcasts its position through the periodic generation of BSMs, and the RSU, after acquiring these BSMs, analyzes the data. In the respective BSMs, the values for location updates vary a lot from the previously generated location as they are random in nature. These large variations in the location updates trigger the anomaly detection, and the RSU flags the vehicle as malicious because such distances cannot be covered with the given speed of the respective vehicle. Attack Type 3 is more difficult to detect because the malicious vehicle generates genuine information for some time, containing legitimate information updates on the respective vehicle, but after a while, the malicious vehicle starts broadcasting the same location updates in the BSMs to pretend that the vehicle has come to a stop. The RSU, after accumulating enough BSMs for the respective vehicle, can detect the anomaly in the information by comparing the consecutive BSMs and analyzing the different parameters in the BSM. After detecting the position falsification attack, the next step is to prevent it. When an RSU detects a malicious attacker, first of all, it flags the vehicle, updates the database, and broadcasts the information about the attacker in its transmission range. The RSU also transmits and alerts other RSUs as they are all connected. The RSU that detected the position falsification attack initiated by the malicious vehicle transmits the relevant information to the other RSUs in the direction of the attacker to prevent the legitimate vehicle from falling victim to the attacker's plan.