# VAE-Based Real-Time Anomaly Detection Approach for Enhanced V2X Communication Security
## 4 Experimental Setup and Results
### Performance Evaluation  
We compared our VAE architecture with both a standard autoencoder and a VAE combined with LSTM layers. Autoencoders are simpler models that focus on reconstructing input data. Still, they lack the probabilistic framework of VAEs, which enables them to model uncertainty and better handle variations in the data. We chose to include LSTM layers because they are well-suited for capturing temporal dependencies in sequential data, which is helpful for effective anomaly detection. This choice aligns with findings from other studies that highlight LSTMs as a substantial addition to generative models, such as VAEs and GANs, for this purpose. The performance of our proposed anomaly detection model was more specifically evaluated across four distinct anomaly types: constant or vehicle-targeted offsets in both position and speed. The evaluation focused on key metrics, including precision, recall, F1-score, accuracy, the minimum high-value factor required to achieve satisfactory anomaly detection, and average inference time. Table 1 highlights the superiority of the proposed VAE model over the other architectures in detecting anomalies effectively, especially in challenging scenarios. For instance, the model achieves near-perfect recall of 0.9998 for the Constant Position Offset, indicating its ability to capture nearly all anomalies of this type. In comparison, the traditional autoencoder generally performs worse than the proposed VAE model across all key metrics, especially for more complex anomalies, such as the Constant Speed Offset and Vehicle Speed Offset, the autoencoder's recall and precision drop significantly. Despite its lower detection performance, the autoencoder achieves a slightly lower average inference time of around 0.0010-0.0012 s. Still, this marginal gain in speed comes at a significant cost to detection accuracy and reliability. The VAE with LSTM layers exhibits mixed performance, performing well in simpler anomalies but struggling with more complex ones. For anomalies like Constant Position Offset, it achieves comparable results to the proposed VAE. However, for anomalies such as Vehicle Position Offset and Vehicle Speed Offset, its performance deteriorates significantly. For the Vehicle Position Offset, the precision drops to 0.1679, and the F1-score is only 0.2758, indicating poor anomaly detection capabilities for this type of anomaly. Additionally, the average inference time of the LSTM-based model is higher, ranging from 0.0029 to 0.0034 s, which could impact its usability for real-time applications. The proposed VAE model shows an optimal balance between high detection performance and low computational cost, making it the most effective and efficient choice for real-time anomaly detection in To evaluate the real-time performance of the proposed VAE-based anomaly detection model, test data was streamed row by row with a simulated time interval, mimicking real-world scenarios where data arrives incrementally. A MinMaxScaler was fitted on the training data to normalize the features of incoming test data. A fixed-size sliding window of size four was employed to capture temporal dependencies in the data. The sliding window buffer updates incrementally with each new row, maintaining a continuous flow of recent observations for analysis. The reconstruction error is computed and classified as normal or anomalous for each complete window in real time. The inference time was measured for each sliding window prediction to validate the proposed anomaly detection model's real-time capabilities. The inference time is defined as the duration between the input of a complete sliding window into the trained VAE model and the computation of the reconstruction error. For each complete sliding window, the time taken for the model to generate a reconstruction and compute the reconstruction error was recorded. The average inference time was calculated over all sliding window predictions during the test.