# A New Multivariate Approach for Real Time Detection of Routing Security Attacks in VANETs
## 1 Introduction  
Intelligent Transportation Systems (ITSs) are one of the significant facets of a smart city used to intelligently monitor and regulate vehicle traffic by means of various communication types and networks such as Vehicular Ad hoc Networks (VANETs) [1]. VANETs are a subcategory of Mobile Ad hoc Networks (MANETs), wherein nodes are intelligent vehicles with sophisticated on-board technology and innovative features such as GPS, sensor equipment, radars, etc. Vehicles in VANETs communicate in a self-organized mode without using any fixed infrastructure support for message dissemination; this means that vehicles act as routing nodes in multi-hop mode [2]. VANETs are deployed for various reasons including minimizing the risk of car accidents, optimizing vehicle flows by reducing travel time, and avoiding traffic congestion situations. VANETs can also provide information and entertainment applications to road users. Given that VANETs are a subset of MANETs, they share all of their characteristics [3]. Nonetheless, VANETs have certain distinctive features. The first and the most problematic feature is the high and predictable mobility. Vehicles travel at high speeds and their motions are predictable as vehicles typically follow a mobility pattern regulated by road topology. Furthermore, VANETs face severe delay constraints, particularly in times of emergency when timely delivery of messages is a critical issue. Last but not least, nodes in VANETs are not limited in terms of power transmission and have high computational abilities [4]. VANETs pose many challenges due to the open and shared wireless channel, the fast movement, and the frequent disconnections of vehicles. In this study, we will mainly focus on a critical research challenge, specifically the routing security attacks [5]. We consider the black hole attack [6] which is among the most devastating attacks in VANETs. Hence, the core interest of this paper is to propose a new approach named Multivariate Statistical Detection Scheme (MVSDS) to detect routing security attacks against the AODV routing protocol by applying multivariate statistical techniques, namely the Multivariate Normality (MVN) tests [7; 8; 9]. In our detection approach, the first step consists of constructing the input data by monitoring the network traffic over time and measuring multiple performance metrics such as throughput, dropped packets ratio, and overhead traffic ratio. These performance indicators are highly affected when the attacks are launched [10]. The second step consists of rescaling the obtained data by applying three different rescaling techniques, namely the Z-Score Normalization (ZSN), the Min-Max Normalization (MMN), and the Normalization by Decimal Scaling (NDS) [11]. The output is modeled by a multivariate dataset used as an input by the detection scheme. The detection step allows identifying legitimate behavior as opposed to malicious behavior by continuously verifying the conformity of the dataset to the multivariate normality assumption. We combined two methods: the multivariate normality test proposed by [PERSON] and [PERSON] [12] and the Ryan-Joiner univariate normality test [13]. At the end of this step, the Ryan-Joiner correlation coefficient (R-J) is computed at various time windows. The measurement of this coefficient will allow identifying the attacker's presence whenever this coefficient falls below a threshold representing the normal critical values. The main contributions of the present research work are summarized as follows:  
1. Propose a new approach capable of detecting black hole attack in real time and without performing any updates in the routing algorithm operations. 2. Generate multivariate datasets by monitoring the vehicular traffic and simultaneously measuring multiple network metrics. Further, the impact of the black hole attack on these metrics is assessed. 3.