## 4 Methods
### Connected and Automated Vehicles (CAVs) Data Characteristics and Anomaly Model
The proposed approach demonstrates a superior performance over BDL and CNN in all the performance metrics except at some accuracy values as shown in Figure (b)b, where CNN has a better performance. However, the proposed approach outperforms CNN, BDL in the rest of the metrics in all the cases of \(m\). For instance, at density \(m\) = 10,000, the sensitivity of the proposed approach shows performance gains of 5.0% and 4.0% when compared to BDL and CNN, respectively. This superior performance trend of the proposed approach is replicated in all the performance metrics as seen in Figure 9.

It can be generalized that as the value of \(m\) decreases, the overall detection approaches systematically deteriorates. This clearly indicates the relevance of \(m\) in anomaly detection system. The consistent superior performances of the proposed approach, relatively in all the metrics as a result of combining the performance of the BDL and DWT. The proposed

Figure 9: Detection Performance of Instance Anomaly type for Convolutional Neural Network (CNN), Bayesian Deep Learning (BDL) and the Proposed Method. approach utilizes the decomposition and denoising qualities of DWT, coupled with the robust BDL mechanism in optimal decision making. 2. **Bias Anomaly** Figure 10 presents the bias anomaly type results for BDL, CNN and the proposed mechanism. As demonstrated in the experiments, at a very small magnitude of \(m\), the BDL approach performs better than the CNN, while the proposed approach outperforms both BDL and CNN mechanisms in all the metrics in small network density scenario. For example, BDL's accuracy as shown in Figure 10, by approximately 5.2% higher than CNN's, while the proposed approach has performance gain of 1.2% and 5.2% over BDL and CNN respectively, with \(m=2000\) samples drawn from \(\mathcal{U}\left(0,1\right)\). At \(m=10{,}000\) in the simulation, the efficiency of these approaches increase as the magnitude of network density increases. Detection mechanisms in this anomaly/attack case show a similar behavior as shown in instant anomaly case with the distribution drawn from a fixed random variable \(\mathcal{U}\left(0,1\right)\) and duration \(d=3\). The proposed approach shows improvement in sensitivity metrics as illustrated in Figure 10, more than BDL and CNN by values of 4.5% and 2.6%, respectively. Similarly, the performance evaluation on bias anomaly as demonstrated in Figure 10,d support the superiority of the proposed approach over BDL and CNN. 3. **Gradual Drift Anomaly** Figure 11 shows the results of the BDL, CNN, and proposed approach for gradual drift anomaly type detection. This type of anomaly involves a gradual rise in sensor values making it difficult to identify and discern the onset of anomaly from normal sensor values. In general,

Figure 10: Detection Performance of Bias Anomaly type for CNN, BDL and the Proposed Method. for a small magnitude of network densities, BDL outperforms the CNN detection performance. For instance, in Figure (a)a,d using BDL approach, at network density of 2000, the F1-score and precision respectively, increase by approximately 2.0% and 14.10% when compared to CNN mechanism. However, at high magnitude of network density, CNN consistently outperforms BDL in all the performance across the experiments. For instance, at \(m=10\),000, the F1-score and precision metrics of CNN, improve by 2.4% and 3% over BDL approach. Considering the anomaly detection performance of the proposed approach for gradual drift anomaly, the following is noted. The experiments indicate that the proposed approach provides a significant improvement in low and high density networks scenarios when compared to CNN and BDL. For instance, at low density network, the proposed approach in respect to F1-score, precision and sensitivity, as plotted in Figure (a)a,c,d has performance gains of 9%, 16% and 20%, respectively, over CNN approach and 6.95%, 1.95% and 2% compared to BDL.