# FSCB-IDS: Feature Selection and Minority Class Balancing for Attacks Detection in VANETs
## 2 Background and Related works
### Background
The anomaly detection consists of defining and characterizing the right static form or the correct dynamic behavior for the system and then the detection of changes or illegal behaviors. It depends on being able to determine the wanted form or pattern of the system and then discriminate whether that form or behavior are undesirable changes or anomalies. The frontier between normal and abnormal form is definable because only one different bit signals a failure. The frontier between normal and abnormal patterns of behavior is harder to identify [22]. The second approach, misuse detection, consists  
Figure 1: VANET Architecture. of the identification of possible ways to access a system. Every one of these elements is usually expressed as a model. The abuse detection system tracks the explicit patterns, where the pattern could be either a string of bits or a sequence of suspicious actions [22]. In various cases, both detection types are integrated in a combined and complementary form in one system. Although, novel forms of pattern specification for abuse detection have been created, and techniques designed for simple systems have been modified and adapted to deal with intrusions in networks and distributed systems. System effectiveness and monitoring have been enhanced, as have user interfaces, including those for specification of new abuse patterns and interaction with the security administrator of the system. A number of researchers have proposed IDS based on ML or DL methods. In vehicular networks, IDSs examine traffic packets in the network to identify malicious activities. Two different approaches to IDSs can be distinguished: for the first, the IDS is installed inside the vehicle, and for the second, the IDS is installed on the RSU. LR [23] which is a modified version of the linear regression method, is commonly used for classification issues. It is helpful in applications like filtering spam and detecting intrusions. The probability of LR is calculated according to Equation (1):  
\[\mathrm{h}_{\theta}=\sigma\left(\theta^{T}X\right) \tag{1}\]  
\(\mathrm{h}_{\theta}\): the hypothesis function  
X: the vector of feature input  
\(\theta\): the parameters of the LR  
\(\sigma\): stands for the sigmoid function that defines the threshold \(\sigma\left(r\right)=\frac{1}{1+\mathrm{e}^{-1}}\)  
DT [24], consisting of a tree graph composed of internal nodes representing the test on an element, of branches showing the result of the test and of leaf nodes representing the class label. The Gini impurity is used as a dividing criterion, as presented in Equation (2):  
\[\mathrm{G}(D)=\sum_{4=1}^{C}(P(i)*(1-P(i)) \tag{2}\]  
D: training dataset  
C: class label collection  
P(i): proportion with the label category I in C  
KNN [25] is a non-parametric approach that does not anticipate the distribution of the underlying data. It finds a group of k observations in the training ensemble that are most similar to testing observation and attributes a label according to the common class of the k neighbors. Equation (3) represents the Euclidian distance which measures the difference between two samples:  
\[\mathrm{d}(x,y)=\sqrt{\sum_{i=1}^{n}(x_{i}-\ y_{i})^{2}} \tag{3}\]  
d(x,y): Euclidian difference of two samples  
\(x_{i}\): first observation  
\(y_{i}\): second sampling  
N: the observation  
Reference [26] is a supervised ML approach that may be applied to solve classification and regression problems. It belongs to the ensemble learning that couples multiple decision trees to create a model to predict the class of a data with higher accuracy. SVM [27; 28] is a classification technique that deals with linear and non-liners datasets. This algorithm consists in the identification of a hyperplane which enhances the distinction between the classes. \[\mathrm{K(x,y)}=\ \mathrm{e}^{-\frac{||x-y||^{2}}{2\theta^{2}}} \tag{4}\]  
\(\sigma\): variance  
\(||\mathrm{x-y}||\): Euclidean distance of two points.