# A New Multivariate Approach for Real Time Detection of Routing Security Attacks in VANETs
## 2 Background
### Multivariate Normality Tests (MVN)  
Normality tests are mainly employed in statistics to test whether the distribution of an observed dataset follows strictly or approximatively a normal distribution and to calculate the probability that a random variable underlying the dataset is normally distributed [9]. Several methods have been outlined in the literature to help assess this assumption. They can be categorized into two groups: the univariate normality tests (UVN) and the multivariate normal tests or MVN for short. The former consists of one random variable, while the second assesses whether multidimensional data made up of multiple random variables follow a multivariate normal distribution. Checking for multivariate normality assumption is an important task because instead of comparing the distribution of one variable against a univariate normal distribution, they are comparing the joint distribution of several variables against a multivariate normal distribution. However, checking the assumption of normality of multivariate data is more complex compared to a univariate one. In the statistical literature, numerous tests are available for testing multivariate normality. As far as we know, there is no standard or best test for evaluating this assumption. The three most widely used MVN tests include the Mardia test, the Henze-Zirkler test, and the Royston [9]. Details on MVN methods can be found in various review studies such as [17]. In our study, we employed the test proposed by [PERSON] and [PERSON] [12] which is one of the overall tests used to assess normality of a multivariate dataset. According to [PERSON] and [PERSON] [12], the test they proposed appears to be more sensitive than some others in the datasets they have examined. Further, it can easily transform the multivariate conformity analysis to a univariate one and enable users to have accurate results in their work. Given a set of observations \(X_{1}\),..., \(X_{n}\) denoted by \(X\), where each observation is described by a row vector of \(p\) variables. The dataset is thus represented by a matrix \(X_{n}\times p\). According to [PERSON] and [PERSON], each observation vector \(X_{i}\) (\(i=1,\,\ldots\,\ldots,\,n\)) is replaced by a vector defined as follows:  
\[Y_{i}=S^{-1/2}\big{(}X_{i}-\overline{X}\big{)};\,i=1,\ldots\ldots,n \tag{1}\]  
where \(\overline{X}\) and \(S\) are the sample mean and variance-covariance matrix, respectively. The authors [PERSON] and [PERSON] proposed to transform all the \(X_{i}\)'s variables to a single variable. All the N = n * \(p\) observations of the vectors \(Y_{i}\) are considered as a sample of size N from a univariate distribution. After that, any well-known test for univariate normality can be applied to check the normality of the resulted univariate sample (Ryan-Joiner, Anderson-Darling, Kolmogorov-Smirnov tests, etc.) based on the N independent observations. Our study opted for the Ryan-Joiner univariate normality test [13]. The Ryan-Joiner test is a univariate test consisting of the calculation of the correlation coefficient between the sample data and their normal scores. A comparative study of UVN tests in favor of the Ryan-Joiner test is given in the study [18]. Figure 1: Black hole attack in VANETs. The Ryan-Joiner correlation coefficient is defined as follows:  
\[R-J=\frac{\sum Y_{i}b_{i}}{\sqrt{\left(Y_{i}-\overline{Y}\right)^{2}\sum b_{i}{}^ {2}}} \tag{2}\]  
or  
\[R-J=\frac{\sum Y_{i}b_{i}}{\sqrt{s^{2}(N-1)\,\sum b_{i}{}^{2}}} \tag{3}\]  
where \(Y_{i}\) are ordered observations with \(i\) = 1, 2,..., \(N\), \(s^{2}\) the sample variance and bi are normal scores of the ordered data.