# Streaming-Based Anomaly Detection in ITS Messages
## 2 Materials and Methods
### Data Generation, Pre-Processing and Transformation
#### 2.1.2 Data Pre-Processing and Transformation  
One typical strategy for traffic incident identification is to learn traffic patterns from previously observed accumulated traffic data and identify instances when the real-time traffic data differ significantly from the learned patterns [5; 39]. A important component in this respect is the vehicle's speed, which has a direct influence on the safety, productivity, and the degree of environmental implications for the traffic ecosystem. It is presumed that a vehicle's speed data recorded at successive timestamps would demonstrate temporal continuity with minor, calculated deviations. As a result, the speed standard deviation of a collection of messages belonging to a small sub-trajectory \(T_{i}^{k}\) of a trajectory \(T_{k}\) should be low in normal conditions but may be significant under anomalous conditions. Speeds measured at spatially close locations should also show spatial continuity with minimum fluctuation. Anomaly detection using CAM messages is a multivariate task, in which sub-trajectory sizes must be considered in order to be able to learn typical conditions and recognise abnormal ones. Anomalies are defined as points that do not appear to fit in with the rest of the dataset, based on the assumption that the vast majority of occurrences in the dataset are normal. We present strategies for predicting the occurrence of an incident on a road section based on hypothesis testing. Our research is predicated on the premise that \"if there is a traffic incident on the road, the vehicle speed, as captured in the sent messages, will significantly differ from the typical or expected speed at that section\". The central hypothesis is that _\"If vehicles change their speed abruptly at a specific point, then it implies an incident has occurred\"_. We target non-recurring traffic disruptions, the occurrence of which is usually unexpected and random. In the event that an incident closes the whole lane, we anticipate a significant change in speed as well as a change in heading as the cars approach the incident area (as shown in Figure 1). We focus on local contextual anomalies, where an occurrence may affect a sub-trajectory, and the contextual anomaly can be detected from the behaviour features, speed, and heading. Trajectory mining was utilised to extract the sample data for the study using the PostgreSQL database system, with the spatial extension PostGIS employed for processing spatial data. The CAMs created by vehicles passing through Boulevard Dauphinot (route N51) in Reims, France, were the subject of the study. The initial step was to transform each message's latitude and longitude information into geometry data types using Spatial Reference Systems SRID 4326 (WGS 84), Europe's projection. All messages within a 150-metre radius of an established reference location were retrieved using the _ST_DWithin_ function in PostGIS to build a bounding box. This produced messages for a 300-metre section of road that served as our research area. Since C-ITS vehicles have a communication \begin{table}
\begin{tabular}{l l} \hline
**Parameter** & **Value** \\ \hline Network simulator & OMNeT++ \\ \hline Road traffic simulator & SUMO \\ \hline Framework & Artery (Vanetza, INET, Veins) \\ \hline Number of nodes & 100 \\ \hline Simulation time & 7200 s \\ \hline Road map of Reims & 10,000 m \(\times\) 10,000 m \\ \hline CAM message interval & 0.1 s \\ \hline Carrier Frequency & 5.9 GHz \\ \hline Number of channels & 180 \\ \hline Transmitter power & 20 mW \\ \hline \end{tabular}
\end{table} 
Table 1: Simulation parameters. range of 150 m [40], a roadside unit (RSU) can be stationed at the centre of the designated route. The extracted dataset contains trajectories for 40 vehicles. Anomalies were added to the extracted dataset to construct an evaluation dataset by placing an \"obstacle\" in the centre of the road segment [41].