## 4 Methods
### Connected and Automated Vehicles (CAVs) Data Characteristics and Anomaly Model  
The data for this analysis are derived from the Safety Pilot Model Deployment (SPMD) program research data exchange (RDE) database [31]. The program was implemented with the primary aim of presenting CAVs in real-world environments, with focus on communication systems such as V2V and V2I communications. The system data was generated from high frequency data (gathered every 100 ms) over a span of two years for more than 2500 vehicles. The data characteristics derived from the SPMD data-set used in this analysis includes speed (s) (sensor 1), \(Ax\) (sensor 2), and \(RoC\) (sensor 3). As there is no public data-set available for CAVs that includes anomalous behavior in sensor measurements due to attacks and ground truths, the experimental data-sets are generated by simulations. In particular, three types of anomalous behaviors are considered including instant, bias and gradual drift. In the sensors experiment, we presume anomalous values exist independently due to either attack or faults. Therefore, we assume that no more than one anomalous behavior will begin in any epoch at the same time, which is in fact quite unlikely provided that sensors are usually accurate, and that attacks will occur independently. For our experiment, we generate various anomalous data with different attack rates denoted as \(\alpha\in\{3\%,10\%,50\%\}\), where either exactly one type of attack or all the three types are equally likely to adversely affect each of the three sensors. Explicitly, we sample a uniform random variable of \(\mathcal{U}\left(0,c\right)\) where \(c\in{1,2,3}\) at each time epoch (every 100 ms), in the CAV trip to decide whether anomaly exists, and if so, another uniform random variable of \(\mathcal{U}\left(0,c\right)\) is used to decide the sensor that is affected. Based on the experiments, we randomly sample from a set of one or three types of anomalies, with uniform or normal distributions. The simulation is prepared in Python and the generated attacks are added to the base value of the sensor. Algorithm 1 provides the pseudocode depicting the random generation of anomalies. ```
1\(\alpha\): rate of anomaly
2m: number of sensors
3D: highest anomaly duration
4t: time epoch
5 for\(t\in T\)do
6 for\(i\in\{1,2,\ldots,m\}\)do
7 if no trace of anomaly occurs at time \(t\) for the \(i\)th sensor then
8 if\(\mathcal{U}\left(0,c\right)\leq\alpha\)then
9\(d\leftarrow\)randi(D)
10 switch(Choose anomaly type with probability distribution \(f_{\omega}\))
11 case Instant:
12 Inject 'instant' anomaly type with parameter \(c_{1}\)
13 case Bias:
14 Inject 'bias' anomaly type with parameter \(c_{2}\) and duration \(d\)
15 case Gradual Drift:
16 Inject 'Gradual drift' anomaly type with parameter \(c_{3}\) and duration \(d\)
17 end switch
18 end if
19 end if
20 endfor
21 endfor
22
23

Figure 5: Wavelet Threshold Denoising Mechanism. #### 4.3.1. DWT Pre-Analysis of the Data

BSMs variables are usually in the form of time series format, and successive time series values are not necessarily independent in real time but are strongly correlated. This makes it difficult to establish successful feature selection strategies for the function that operate directly on time series data. To mitigate the problem, DWT which comes with the flavor of both a feature extractor and de-noising techniques as detailed in Section 4.2, can be applied to time series data to transform it from time domain to frequency domain. In this section, we mainly focus on the denoising of the BSMs attributes with DWT. The BSMs data have some disturbances as a result of measurement noise and estimate error, which may cause problems in the training phase of the anomaly detection mechanism. In addition, the inbuilt noise in the system can induce outlier effect which can affect the performance of the attack detection mechanisms. The details of mechanism of operation of DWT is examined on the selected BSMs sensors and the simulation for the experiment is carried out with Python.