# Streaming-Based Anomaly Detection in ITS Messages
## 2 Materials and Methods
### Proposed Enhanced LSCP Algorithm (ELSCP)
The computation of the Harvesine distance is presented in Equation (13):  
\[d=2\ r\ sin^{-1}\left(\sqrt{sin^{2}\left(\frac{\
icefrac{{\varphi_{2}}}{{2}}- \
icefrac{{\varphi_{1}}}{{2}}}{2}\right)+cos(\varphi_{1})\ cos(\varphi_{2})\ sin^{2}\left(\frac{ \
icefrac{{\lambda_{2}}}{{2}}-\
icefrac{{\lambda_{1}}}{{2}}}{2}\right)}\right) \tag{13}\]  
where \(r\) is the radius of the Earth (6371 km), \(d\) is the distance between two points, \(\varphi_{1}\) and \(\varphi_{2}\) are the latitudes of the two points, and \(\lambda_{1}\) and \(\lambda_{2}\) are the longitudes of the two points, respectively. Suppose we have a dataset \(\mathbb{R}\) that is divided into training and test datasets: let \(X_{train}\in\mathbb{R}^{m\times a}\) represent the set of training data with \(m\) points and \(a\) attributes, and \(X_{test}\in\mathbb{R}^{y\times a}\) be the set of test data with \(y\) points and \(a\) attributes. The ELSCP technique begins with a heterogeneous list of base detectors \(D\) being fitted to the training data. The outcome of this training is a predicted set of outlier scores \(O_{train}\), which is presented in Equation (14):  
\[O(X_{train})=[D_{1}(X_{train}),D_{2}(X_{train}),\ldots,D_{k}(X_{train})]\in \mathbb{R}^{m\times k} \tag{14}\]  
The second step is to generate the training pseudo ground truth (_target_) by picking the highest score across all detectors from \(O_{train}\). The third step is to define a local (\(\xi\)) for each test instance, \(X_{test_{i}}\). This is defined by calculating each instance's \(k\) nearest neighbours using the ball tree KNN algorithm with the Harvesine distance. This is formalised as follows:  
\[\xi=x_{j}\ |\ x_{j}\in X_{train}),\ x_{j}\in L_{ens} \tag{15}\]  
where \(L_{ens}\) is the set of a test instance's nearest neighbours according to ball tree ensemble criteria. Feature spaces are created by randomly picking \(t\) groups of \([d/2,d]\) features to form the local region \(L_{ens}\). The \(k\) training objects closest to \(X_{test}\) in each group are found using the Harvesine distance. Training objects that occur more than \(t/2\) times are added to the \(L_{ens}\) array. After defining the local region, a local pseudo ground truth (\(target_{s}\in\mathbb{R}^{s\times l}\)) is constructed by extracting the points in \(\xi\) from _target_. Using Equation (16), the local training outlier score for the test instance is obtained from the pre-computed training score matrix \(O_{train}\):  
\[O(X_{train_{s}})=[D_{1}(X_{train_{s}}),D_{2}(X_{train_{s}}),\ldots,D_{k}(X_{ train_{s}})]\in\mathbb{R}^{s\times k} \tag{16}\]  
The fourth step is to choose the optimal detector. This is done by calculating the similarity between the base detector scores and pseudo target using correlation measures. The absence of direct and consistent access to binary labels in unsupervised outlier identification motivates similarity computation. Although it is feasible to convert pseudo outlier scores to binary labels, obtaining an accurate conversion threshold is challenging [46]. Furthermore, because imbalanced datasets are common in outlier identification tasks, utilising similarity measures is more reliable [19]. We propose an implementation of ELSCP that computes the final score using Pearson correlation and weights. **Definition 6**. : _Pearson Correlation: Let \(x\) and \(y\) be two vectors of length \(n\), where \(\overline{x}\) and \(\overline{y}\) are the means of the vectors. The Pearson correlation coefficient is defined as the ratio of the co-variance of the two vectors to the product of their respective standard deviations (presented in Equation (17)). It assesses the linear relationship between two numerical variables.