# A New Multivariate Approach for Real Time Detection of Routing Security Attacks in VANETs
## 5 Simulation Setup and Implementation
### Implementation of the Proposed Scheme  
The first step in our detection scheme lies on the network traffic monitoring where the following traffic parameters are used:  
* The throughput (TH) expressed in kilobits per second (Kbps), which is defined as a measure of the total amount of bytes successfully transmitted from source node to destination per unit time.
* Dropped packets ratio (DPR) defined as the ratio between the numbers of dropped packets to the total number of transmitted packets.
* Overhead traffic ratio (OTR) which refers to the ratio between the total number of control packets generated by the AODV routing protocol during route discovery and route maintenance to the total number of transmitted packets.  
\begin{table}
\begin{tabular}{c c c} \hline \hline N & **Parameter** & **Value** \\ \hline
1 & Network simulator & NS3.29 \\
2 & Mobility simulator & SUMO-0.32.0 \\
3 & Propagation model & frisLoss model \\
4 & Number of vehicles & 100 \\
5 & WiFi channel & YansWifi \\
6 & Mac and Physic layer & IEEE 802.11p \\
7 & Transmission power & 33 dBm \\
8 & Simulation time & 100 s \\
9 & Traffic type & CBR (constant bit rate) \\
10 & Packet size & 1024 bytes \\
11 & Routing protocol & AODV \\ \hline \hline \end{tabular}
\end{table}
Table 2: Simulation settings.  
Figure 3: Simulation zone from El Jadida city from Open Street Map and XML file edited by SUMO.  
We monitor the network traffic over a time interval fixed at one second (1 s), and measure the three metrics, i.e., throughput, dropped packet ratio, and overhead traffic ratio denoted by TH, DPR, and OTR respectively. These measurements are collected and tabulated in CSV files, which are later converted into the form of datasets used by the Matlab environment. The generated multivariate datasets are raw data where columns represent the measurements of the variables TH, DPR, and OTR during the simulation time and rows are observations of these variables.  
The rescaling techniques (ZSN, MMN, and NDS) are applied to compute the new values of each variable denoted by (NewTH, NewDPR, and NewOTR). The datasets are sampled at different times separated by time window (tw). In practice, we consider tw = 5 s; this means that his process is triggered continuously, i.e., at T = 10 s, T = 15 s, T = 20 s, T = 25 s, etc., where the datasets correspond to the T last collected samples.  
The multivariate normality test, namely the Rao-Ali multivariate statistical test, is employed to transform the multivariable samples to univariate ones. Afterwards, the Ryan-Joiner test is applied to measure the R-J correlation coefficient. The values of this correlation coefficient allow us to determine the probability that an attacker is present or not, so that observations with R-J values that fall below a threshold value representing the R-J normal critical value identify an abnormal behavior. The threshold values are computed using formulas in Equation (4), Equation (5), or Equation (6) given in Section 2.3 with \(\alpha=0.05\) chosen as the significance level.  
The calculations are performed using a program that we have implemented in the Matlab environment. This program takes as an input the dataset retrieved from the previous step (step 2) and calculates the observed values of the R-J coefficient using formulas in Equations (2) and (3). Based on the results of step 3, the presence of an attacker is detected whenever the R-J values fall below a threshold value representing the R-J normal critical values with \(\alpha=0.05\).