# Hybrid Trust Model for Node-Centric Misbehavior Detection in Dynamic Behavior-Homogeneous Clusters
## 6 Hybrid Trust Value Based on Weighted Vehicle Behavior
### Vehicle Node Layer Trust Value Computation  
The total trust value at the vehicle node layer is calculated based on past direct interactions between nodes [29; 30] and feedback from other nodes [31], separately computing direct and indirect trust values. Direct trust values are assessed based on data directly received from single-hop broadcast mechanisms, while indirect trust values are derived from feedback trust values received from neighboring vehicles. To objectively evaluate the credibility of a vehicle node, weights are used to balance the proportion of direct and indirect trust, ultimately yielding the total trust value at the vehicle node layer. 1. **Direct Trust Value** In normal mode, interaction information mainly consists of vehicle ID, current position, speed, and status. The direct trust value is evaluated by neighboring vehicles based on the speed, transmission frequency, and node distance indicators from the single-hop broadcast messages. 2. Direct Trust Based on Node Speed The direct trust value based on vehicle speed in interaction information is calculated by comparing the vehicle node's speed with the normal vehicle speed given by the Intelligent Transportation System (ITS) center of the current road section, as follows: \[T_{d}V(v_{i})=\left\{ \begin{array}{ll}0.3&V(v_{i})<0.7V_{L}\text{ or }V(v_{i})>1.3V_{L}\\ 0.5&0.7V_{L}<V(v_{i})<0.85V_{L}\text{ or }1.15V_{L}<V(v_{i})<1.3V_{L}\\ 0.7&0.85V_{L}<V(v_{i})<0.9V_{L}\text{ or }1.1V_{L}<V(v_{i})<1.15V_{L}\\ 0.9&0.9V_{L}<V(v_{i})<1.1V_{L}\end{array} \right.\] (7)  
Figure 5: Distribution mechanism of basic safety-related information in vehicular networks. The direct trust value assessed by vehicle \(v_{i}\) based on the speed \(V(v_{i})\) in the interaction information is denoted as \(T_{d}V(v_{i})\), where \(V_{L}\) is the speed limit of the current road segment. Consequently, the trust value is determined as follows:  
* If \(V(v_{i})\) exceeds the speed limit by more than 30% or is below the speed limit by more than 30%, the trust value is set to 0.3. * If \(V(v_{i})\) is between +30% to +15% or \(-30\%\) to \(-15\%\) of the speed limit, the trust value is set to 0.5. * If \(V(v_{i})\) is between +15% to +10% or \(-15\%\) to \(-10\%\) of the speed limit, the trust value is set to 0.7. * If \(V(v_{i})\) is within +10% to \(-10\%\) of the speed limit, the trust value is set to 0.9. This method of trust value assessment is illustrated in Figure 6.
* Direct Trust Based on Transmission Rate The transmission frequency of sensor data is usually fixed, making it an important indicator for monitoring node behavior. When the network is stable, the relay nodes for each vehicle sensor node are stable. Therefore, it can be assumed that if a sensor node's behavior in scanning and detecting other relay nodes is abnormal, this will affect its trust value. The standard transmission frequency of a sensor node is set as \(M\) standard, and the actual transmission frequency of the \(ith\) vehicle node \(v_{i}\) is denoted as \(m_{i}\). The number of scans performed by the sensor node \(i\) is denoted as \(S_{i}\). The method for calculating the direct trust \(T_{d}TF(v_{i})\) based on transmission frequency is as follows:  
\[ \begin{array}{l}T_{d}TF(v_{i})=\tau_{1}k+\tau_{2}(\frac{Diff_{i}^{TF}}{Time _{TF}})\\ Diff_{i}^{TF}=|S_{i}-{\it{Thre}}_{TF}|\\ k=\begin{cases}0&m_{i}<(M-\delta),m_{i}>(M+\delta)\\ 1&(M-\delta)<m_{i}<(M+\delta)\end{cases}\end{array}  \tag{8}\]  
where \(\tau_{1}\) and \(\tau_{2}\) are weight coefficients, \(0<\tau_{1}\), \(\tau_{2}<1\) and \(\tau_{1}+\tau_{2}=1\). \(\delta\) is fault tolerance coefficient. The threshold of transmission frequency \({\it{Thre}}_{TF}\) represents the upper limit of scanning times. * Calculation of Trust Value Based on Node Distance When the distance between vehicle nodes is less than a specific threshold, malicious nodes may be tailgating or causing accidents. Conversely, if the distance between vehicle nodes exceeds a specific threshold, it could indicate malicious nodes causing traffic congestion due to idling.