# VAE-Based Real-Time Anomaly Detection Approach for Enhanced V2X Communication Security
## 2 Related Work
### Recent Studies on Anomaly Detection in V2X Communications  
The increasing reliance on V2X communication has led to significant research efforts aimed at enhancing its security. Generative AI and, more broadly, machine learning models have emerged as promising tools for anomaly detection, capable of identifying unusual patterns indicating cyber threats or system malfunctions. These models can learn from vast amounts of data to detect and predict anomalies with high accuracy [13]. One notable approach is the use of GANs for anomaly detection by [PERSON] et al. [14], who present an unsupervised anomaly detection framework optimized for Connected and Autonomous Vehicles (CAVs). The model utilizes LSTM, RNN, and GRU architectures to identify anomalies in vehicle dynamics, including position, speed, acceleration, and heading. Although effective, GANs require complex training and are prone to instability, making them less suitable for real-time deployment in resource-constrained vehicular environments. Conversely, [PERSON] et al. [15] propose a framework, addressing the challenge of deploying resource-intensive deep learning models on constrained devices like RoadsideUnits (RSUs) and On-Board Units (OBUs). The authors combine unsupervised learning with autoencoders and knowledge distillation to create a lightweight yet effective anomaly detection system, introducing a Feature-based Knowledge Distillation (FKD) method that enhances traditional techniques by transferring knowledge across multiple network layers. VAEs have emerged as an alternative due to their ability to learn probabilistic representations of normal behavior. Unlike GANs, VAEs offer a structured latent space, allowing for the detection of anomalies based on reconstruction errors. VAEs are based on an autoencoder, a concept widely recognized in the anomaly detection literature. [PERSON] et al. (2016) developed a D-CNN-LSTM Autoencoder for time-series anomaly detection in CAVs, emphasizing data preprocessing techniques like Differencing (DIFF) and Moving Standard Deviation (MSD) to enhance detection performance. Their work highlights the efficacy of combining CNNs for spatial feature extraction and LSTMs for temporal dependencies within an autoencoder framework. While their focus on preprocessing is notable, their use of a standard autoencoder differs from our proposed VAE, which incorporates a probabilistic latent space to offer better generalization and handling of data uncertainty, potentially. [PERSON] et al. (2017) demonstrated the effectiveness of VAEs in Vehicular Ad-hoc Networks (VANETs), particularly when combined with multi-objective optimization strategies to improve detection performance. The framework mentioned employed algorithms such as AGE-MOEA and R-NSGA-III to optimize multiple objectives, including divergence, Kullback-Leibler (KL) divergence, and reconstruction error. Additionally, hybrid models that integrate VAEs and GANs have been explored, such as CoGAN (2018), which leveraged the strengths of both architectures to enhance anomaly detection in Cellular Vehicle-to-Everything (C-V2X) communication. An approach worth mentioning involves detecting and correcting errors in BSMs to improve V2X security. A study by [PERSON] et al. (2019) proposes a collaborative scheme in which vehicles, RSUs, and Data Centers work together to identify and correct erroneous BSMs caused by sensor failures. By leveraging historical data and statistical analysis, the system effectively improves message accuracy. However, while this method enhances data integrity, it does not explicitly address cyber threats, which require real-time anomaly detection capabilities. Other machine learning techniques, including Support Vector Machines (SVMs) and ensemble learning, are also being investigated for V2X anomaly detection. For instance, [PERSON] et al. (2019) propose an ML-based Cryptographic Protocol IDS (ML-CPIDS) that integrates ML with cryptographic methods for authentication, encryption, and threat detection.