## 4 Methods
### Connected and Automated Vehicles (CAVs) Data Characteristics and Anomaly Model
At a high value of \(m\), the detection performance of the various approaches used in this context increase across all the metrics. Furthermore, it is shown that in general, the proposed approach outperforms CNN and BDL. For instance, experiment carried out on network density of 10,000, again shows that F1-score, precision and sensitivity approach are increased by 2.4%, 1.8% and 2.6% over the CNN mechanism, and by 2.4%, 2.68% and 4.9% over BDL approach. Moreover, the proposed approach improves upon the detection performance of both DWT and BDL respectively. Figure 11: Detection Performance of Gradual Drift Anomaly type for CNN, BDL and the Proposed Method. Discussions of the Mechanisms Under Single Anomaly

As seen in the experiments of single anomaly types, the performances of the detection approaches significantly increase in consonant with the magnitude of anomaly duration \(d\), network density \(m\) and the considered distributions, \(c\times\mathcal{N}\left(0,0.01\right)\), \(\mathcal{U}\left(0,c\right)\), and \(linspace\left(0,c\right)\). Intuitively, the larger the distribution, the larger the deviation from the true values of the normal sensors behaviors, thus the greater the effectiveness of the approaches in detecting the anomalies. In addition, regarding the high performance of the detection mechanisms with longer duration, is simply because longer duration extends the detection mechanisms time to accumulate a practical body of knowledge about the behaviors and anomaly impacts in a given environment. In all, the single attack system as shown in Section 5.1, the detection mechanisms can generalize and correctly classify previous unseen observation with similar distribution, (test set) throughout the experiment by training on representative training sets. However, in practice, CAVs anomaly detection methods can experience instance of anomalies for which the mechanisms are not trained specifically. Details of the incidents of unseen observations as expressed in the multiple attack scenarios are discussed in the next section below. ### Mechanisms Under Multiple Anomaly System

This section addresses the effectiveness and reliability of a specific detection mechanism used in multiple anomaly scenarios. To obtain a more solid insight on the robustness of detection mechanisms in producing practical performance, the anomaly/attack detection approaches are exposed to multiple attack/anomaly scenarios, with real-time attribute of varying anomalous behaviors. In this context, the instant, bias and gradual drift anomalies are all present in the test data-set and modeled with 100,000 \(\times\mathcal{N}\left(0,7\right)\), \(\mathcal{U}\left(0,3\right)\), \(linspace\left(0,3\right)\) and \(d=7\). Investigation is carried out on the generalisation of the detection mechanisms on the unobserved multiple anomaly scenarios, having been trained on one of the anomaly types. We only consider the impacts of the percentage of anomaly rate \(\alpha\) on the three different sensors in the experimental settings. The evaluation performances of the detection mechanisms are carried out with two anomaly rates (at \(\alpha=10\%\) and \(\alpha=50\%\)) scenarios. To ensure statistical relevance of the performance of the detection mechanisms, the simulations are run multiple times at least 20 times to provide a confidence interval (CIs) for CNN and credible interval denoted in this context as (CRIs) for the proposed mechanism and BDL respectively. Specifically, we present the mean performance along with the 95% CI and CRIs. Figure 12 depicts the performance of the detection mechanisms used in this study, for the multiple anomaly scenario with \(\alpha=50\%\). The value of \(\alpha\) is set high to capture the behaviors and detection capabilities of the selected mechanisms for threat that can pose considerable risk to the operation of the CAVs system. Figure 12a shows that the detection performances of all the metrics vary across the sensors, in all the experiments.