# Streaming-Based Anomaly Detection in ITS Messages
## 1 Introduction
The performance of a model can be evaluated based on the various features that exist within a dataset, and detection rates differ due to specialised models accommodating diverse observational characteristics. Using a collection of unique skills within an ensemble yields a stronger outcome than solely relying on one detector [31]. Some other studies have been considered to detect anomalies as in [32; 33; 34]. This study is focused on contextual anomalies. The notion of context originates from the structure of datasets, wherein two distinct sets of attributes characterise each data instance [3]:  
* _Contextual attributes_: These are utilised for establishing the context (or neighbourhood) of a particular instance. Contextual features of a location in spatial datasets include its longitude and latitude. In time series data, time serves as a contextual characteristic that determines the position of an instance within the entirety of the sequence. * _Behavioral/indicator attributes_: These attributes have a direct correlation with the anomaly detection process, as they establish the anomalous behaviour. Within a spatial data collection outlining the mean precipitation levels within a specific nation, the proportion of rainfall observed at a given site shall be deemed a behavioural attribute. Our approach involves utilising data to actively detect anomalies through unsupervised methods that target local contextual anomalies. We propose an enhancement of an ensemble anomaly detector called enhanced locally selective combination in parallel outlier ensembles (ELSCP). ELSCP is tailored for streaming scenarios by leveraging a pipeline framework that transforms data into a stream and passes it to ELSCP using a reference window model that implements a sliding window approach. The updated version facilitates the handling of information in a continuous flow, thereby allowing us to assess how effective our algorithm is in a streaming environment. Our approach involves the use of hypothesis testing to identify any unusual patterns in vehicle movement on the road. The primary assumption of our analysis is that _\"normal instances are far more frequent than anomalies\"_. The central hypothesis is that _\"If vehicles change their speed abruptly at a specific point, then it implies an incident has occurred\"_. We seek to investigate the following questions:  
1. What is the significance of data associations in anomaly detection, especially in a constrained road network? 2. How can a balance between variance and bias be achieved in ensemble learning? 3. How can we improve the detection rate of anomalies in CAM data streams? 4. Can enhancing the LSCP algorithm improve the identification of anomalies in CAM data streams? * How can the adapted technique be applied to real-world problems? We propose the following contributions: 1. We define and investigate the issue of completely unsupervised anomaly ensemble construction; 2. We propose a robust ensemble-based methodology for the detection of anomalies from data streams in the C-ITS context; 3. We evaluate the proposed technique using a dataset of CAM messages generated in the C-ITS environment and compare its performance with state-of-the-art techniques in the streaming context. This paper is structured as follows: Section 2 presents the data generation and pre-processing steps. They correspond to the used materials. It also introduces our anomaly-detection approach, called enhanced LSCP (ELSCP), and the performance indicators that we used. Section 3 presents the experimental results. Section 4 is dedicated to discussion and limitations, with Section 5 giving the conclusion and future work.