## 3 Proposed Scheme  
In this section, we will provide a brief description of the proposed architecture for DoS attack detection using ensemble learning (EL) and gossip learning (GL) frameworks for the Mode 3 and Mode 4 V2X. To fully understand the situation, let us consider an AV environment as shown in Figure 2 below. A vehicle \(V_{i}\) is traveling in the city, and during its journey, it remains connected with a \(j\)th RSU. The AV always remains connected to the RSU to access certain services, known as Mode 3 in V2X, which is backed up by the infrastructure. For Mode 3, we propose ensemble learning, which acquires the predictions of each AV connected with it and decides on an optimal detection result using a voting scheme, as shown in Figure 1.  
The main concept of ensemble learning is to combine weak learner models (trained locally) to enhance the prediction performance of each model by deciding the prediction outcome based on the majority. This is directly related to the possible bias of any trained model during its prediction performance. The RSU in Mode 3 ensembles each AV's local model's prediction after receiving them. Each AV in the environment is required to send only its prediction results rather than sharing the weights of the trained model or the local data, as the existing scheme requires federated learning (FL) [34] or data fusion schemes [35]. For ensemble learning, we utilized support vector machine (SVM) and artificial neural network (ANN) algorithms to train the local models and share their predictions with the RSU for ensemble purposes. The rationale for selecting multiple variants of the SVM classifier [36] and the ANN algorithm [37] lies in their respective strengths. SVM classifiers demonstrate significant performance with high-dimensional datasets, while the ANN algorithm excels in handling complex, non-linear, and large datasets. By incorporating both the SVM classifier and the ANN algorithm, the scalability of our proposed system is enhanced, enabling it to manage datasets of varying sizes and complexities effectively. AVs may experience a situation that lacks the traditional infrastructure, for example, if a vehicle is visiting a lake, the coast, the desert, or mountains; then, vehicles are required to communicate with each other rather than a central infrastructure such as an RSU. In that case, AVs follow the Mode 4 operation of V2X. For Mode 4 operation, we propose a gossip learning (GL)-based solution, in which AVs are required to exchange locally trained models with each other. AVs build a pool of locally trained models and test each model using their testing data. After testing their data, the AVs sort each received model's accuracy in descending order and select the specific model with the highest accuracy, as depicted in Figure 2 above. For GL, models locally trained by SVM and ANN are shared among the AVs. Figure 3 above illustrates the mechanism of DoS attacks in AVs using the support vector machine (SVM) and artificial neural network (ANN) algorithms. To implement both schemes, the first step is to acquire data related to normal traffic and attack traffic in the AV scenarios. After acquiring the data, the preprocessing phase is applied to the collected data. In the preprocessing phase, we check for missing values, perform normalization, and remove duplicate values. After performing the preprocessing step, the refined data are fed into the SVM classifier and ANN algorithm. Both the SVM classifier and the ANN algorithm are utilized for AV traffic classification. A stop criterion is set during the training of the SVM classifier, which is based on the number of iterations or the mean square error (MSE) rate. After meeting the stop criteria, the trained model of both classifier models is obtained and then subjected to data testing for further prediction. After a successful prediction, the prediction performance of both  
Figure 2: EL and GL-based proposed solutions for Mode 3 and Mode 4 in V2X environment.