# VAE-Based Real-Time Anomaly Detection Approach for Enhanced V2X Communication Security
## 3 Proposed Methodology
### Real-Time Anomaly Detection Model  
The method leverages a lightweight VAE architecture integrated with CNNs. Our model is designed to be deployable on board the vehicle, and on an RSU, given its lightweight nature. The model is designed to detect anomalies in real-time using a sliding window mechanism, as shown in Figure 1 below. This approach ensures that incoming data streams are processed incrementally, enabling low-latency anomaly detection in dynamic V2X environments. A sliding window of size 4 with a stride of 1 is used to preprocess the time-series BSM data. Each window captures a short temporal sequence of vehicle features, allowing the model to learn temporal dependencies and detect anomalies at each time step. The window size of 4 was chosen empirically to capture sufficient temporal context from the BSM data, allowing the VAE-CNN to model short-term vehicle dynamics effectively without imposing excessive computational load per window. The stride of 1 ensures that every new incoming data point contributes to an immediate re-evaluation of the vehicle's state, which is critical for the 'prompt detection' mentioned in the abstract. Each window, thus formed as a short temporal sequence of multivariate data points (position, speed, acceleration), is then fed as a single input sample to the VAE-CNN architecture. The model's objective is to reconstruct this entire input window, and the magnitude of the reconstruction error [25] across the window serves as the basis for identifying anomalous patterns. The reconstruction error (RE) is defined as the Mean Squared Error:  
\[\text{RE}=\frac{1}{\text{N}}\sum_{i=1}^{\text{N}}{(\text{original}_{i}-\text {reconstructed}_{i})^{2}} \tag{1}\]  
where N is the total number of elements in the input window, anomalies are flagged when the reconstruction error exceeds a predefined threshold. The threshold is calibrated during validation to strike a balance between false positives and false negatives. This ensures that the model reliably detects anomalies while minimizing unnecessary alerts. Our proposed method ensures the model adapts to evolving traffic patterns, weather conditions, and environmental changes through a periodic retraining strategy. This also enables the model to detect anomalies effectively despite shifts in data distribution. V2X communication operates in highly dynamic environments where the underlying data distribution can change. Previously normal behaviors, such as specific vehicle dynamics, may become anomalous as the environment changes. The model may fail to adapt to these changes without retraining, leading to degraded performance. Figure 1: Proposed Real-time Anomaly Detection Methodology. To retrain the model, recent BSM data is aggregated over fixed intervals (e.g., 30 min) to capture the latest traffic and environmental patterns while retaining historical knowledge. The model is then incrementally trained using recent and a small subset of historical data, balancing adaptability with the retention of long-term patterns. The dataset is preprocessed during retraining using the same sliding window approach as in the initial training phase. Following retraining, the anomaly detection threshold is recalibrated based on the reconstruction error distribution of the updated training dataset, ensuring sensitivity to anomalies under evolving data distributions. The rate of data distribution changes determines the retraining frequency; for highly dynamic environments, retraining can be frequent, while in less dynamic scenarios, intervals can be extended to reduce computational overhead. This means that during periods of significant change in traffic patterns, the retraining frequency would be adjusted. This adjustment can be triggered by actively monitoring data drift metrics or a noticeable decline in the model's anomaly detection performance on a continuous validation set, ensuring the model remains adaptive rather than strictly adhering to a universally fixed interval under all circumstances.