# VAE-Based Real-Time Anomaly Detection Approach for Enhanced V2X Communication Security
## 3 Proposed Methodology
### Real-Time Anomaly Detection Model
A potential concern with periodic retraining on new data is the phenomenon of catastrophic forgetting. [26], where the model might lose its ability to accurately represent previously learned patterns. Our retraining strategy aims to mitigate this by not solely relying on recent data. As stated, the model is incrementally trained using recent and a small subset of historical data, balancing adaptability with the retention of long-term patterns. This inclusion of historical data helps to regularize the training process, anchoring the model to established normal behaviors while allowing it to adapt to evolving traffic dynamics and environmental conditions. While dedicated continual learning techniques could be explored in future work, this approach provides a practical balance for maintaining long-term reliability. Our proposed anomaly detection methodology consists of seven steps, as depicted in Figure 1, which are further elaborated below. * Step 1: Incoming messages are filtered in the preprocessing stage to retain only the essential features (position, speed, and acceleration), then normalized to the range [0, 1] using MinMaxScaler. This normalization process helps stabilize training and enhances model performance [27]. * Step 2: A sliding window approach is used to generate overlapping time-series windows [28], with each window containing four consecutive data points and a stride of one. This approach effectively enables the model to capture temporal dependencies within the data. * Steps 3-6: The model analyzes each sliding window in real-time to determine whether it is anomalous or normal. If a window is classified as anomalous, an alarm is triggered, and the corresponding data is sent to an anomaly storage unit for further investigation. On the other hand, if the window is deemed normal, it is aggregated into a separate storage unit for normal data, which contributes to the dataset for periodic model retraining. The model retraining stage is executed at determined intervals to ensure the model remains updated with evolving data distributions. During retraining, the dataset is preprocessed using the same sliding window approach. * Step 7: Following retraining and recalibration of the anomaly detection threshold, the updated model is deployed for continued real-time anomaly detection. The proposed anomaly detection model leverages a lightweight VAE [29] integrated with CNNs as shown in Figure 2 below. The architecture enables the model to capture both temporal and spatial [30] dependencies in BSMs for V2X communication. Moreover, the architecture is designed to provide efficient and scalable anomaly detection, with a focus on real-time performance. The encoder compresses the input data into a latent space representation. It consists of a sequence of convolutional layers for hierarchical feature extraction, batch normalization for stable training, and Leaky ReLU [31] activation functions for computational efficiency. The encoder extracts high-level features while retaining temporal dependencies critical for detecting subtle anomalies in V2X data. After the convolutional layers, the latent space is represented by two vectors, the mean (\(\mu\)) and the log variance (log \(\sigma^{2}\)), which are used for sampling the latent vector via the reparameterization approach. This step ensures smooth latent space representations, allowing for gradient-based optimization. The latent space is a compact representation of the input data. The \(\mu\) and log \(\sigma^{2}\) are optimized during training to learn a robust distribution of standard BSM patterns. The latent vector is sampled using  
\[\mathrm{z}=\mu+\sigma\cdot\epsilon \tag{2}\]  
where \(\sigma=\mathrm{e}^{0.5\cdot\mathrm{log}\sigma^{2}}\) and \(\epsilon\sim\mathrm{N}(0,1)\). This step ensures the model learns probabilistic representations of normal behavior, making it sensitive to deviations. The decoder reconstructs the input data from the latent vector.