# VAE-Based Real-Time Anomaly Detection Approach for Enhanced V2X Communication Security
## 4 Experimental Setup and Results
### Performance Evaluation
In the dataset used for evaluation, the number of vehicles present at a single time step ranged from 1 to 30. To ensure the framework could handle the upper limit of this range, performance metrics were calculated assuming 30 rows (representing data from 30 vehicles) per time step. With a sliding window size of 4 and a stride of 1, each batch of 30 rows was processed sequentially, generating \(30-4+1=27\) overlapping windows per batch. The highest average inference time per sliding window was measured as 0.0013 s. Given the 0.1 s interval between consecutive batches, the total time required to process all 27 windows within a batch was calculated as 0.0351 s based on the Equation (8) below. \[\text{t}_{\text{batch}}=\text{num}_{\text{windows}}\times\text{t}_{\text{ inference}} \tag{8}\]  
This is significantly less than the available 0.1 s interval, demonstrating that the system can reliably process incoming data in real-time. Moreover, the training process was computationally efficient, requiring an average of only 5 min to complete on the given training dataset, which consisted of data collected over 800 s. The resulting trained model is also compact, saving the model's state dictionary results in a file size of approximately 0.02 \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Model** & **Anomaly Type** & **Precision** & **Recall** & **Accuracy** & **F1-Score** & \
\begin{tabular}{c} **High-Value** \\ **Factor** \\ \end{tabular} &
\begin{tabular}{c} **Inference** \\ **Time** \\ \end{tabular} \\ \hline \multirow{4}{*}{Autoencoder} & Constant Position Offset & 0.8467 & 0.9997 & 0.9456 & 0.9168 & 0.5 & 0.0010 \\  & Constant Speed Offset & 0.8021 & 0.7338 & 0.8657 & 0.7664 & 0.6 & 0.0014 \\  & Vehicle Position Offset & 0.7160 & 0.9879 & 0.9440 & 0.8303 & 0.6 & 0.0011 \\  & Vehicle Speed Offset & 0.6808 & 0.8356 & 0.9229 & 0.7503 & 1.2 & 0.0012 \\ \hline \multirow{4}{*}{VAE-LSTM layers} & Constant Position Offset & 0.8930 & 0.9997 & 0.9640 & 0.9433 & 0.5 & 0.0029 \\  & Constant Speed Offset & 0.8865 & 0.9357 & 0.9448 & 0.9104 & 0.6 & 0.0034 \\  & Vehicle Position Offset & 0.1679 & 0.7722 & 0.8594 & 0.2758 & 0.6 & 0.0030 \\  & Vehicle Speed Offset & 0.1925 & 0.9080 & 0.8648 & 0.3177 & 1.2 & 0.0032 \\ \hline \multirow{4}{*}{Our VAE-CNN layers} & Constant Position Offset & 0.9101 & 0.9998 & 0.9703 & 0.9528 & 0.5 & 0.0013 \\  & Constant Speed Offset & 0.9081 & 0.9540 & 0.9572 & 0.9305 & 0.6 & 0.0014 \\ \cline{1-1}  & Vehicle Position Offset & 0.8237 & 0.9604 & 0.9660 & 0.8868 & 0.6 & 0.0012 \\ \cline{1-1}  & Vehicle Speed Offset & 0.8271 & 0.9397 & 0.9644 & 0.8798 & 1.2 & 0.0013 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Performance Results of Our VAE Real-time Anomaly Detection Model compared to Traditional Autoencoder and VAE model with LSTM layers. megabytes. These characteristics--fast inference, efficient training, and small model size--collectively support the 'lightweight' designation of the proposed framework, making it suitable for deployment on typical V2X hardware, such as OBUs and RSUs. Figures 3 and 4 illustrate the distribution of reconstruction errors for normal and anomalous data across different anomaly types. The histograms separate the reconstruction error values of normal and anomalous samples, with the detection threshold indicated by a red dashed line at the 98 th percentile. These distributions show the effectiveness of the VAE model in distinguishing between normal and anomalous behavior based on reconstruction error. In both figures, the left-side histograms represent the reconstruction errors of normal data, while the right-side histograms represent the reconstruction errors of anomalous data. In Figure 3, a comparison of the performance of our proposed VAE model and the VAE with LSTM layers is shown. For our VAE model, the reconstruction error distribution for normal data is tightly clustered below the threshold, with very few false positives. However, the reconstruction error for anomalous data is well-separated, with most anomalous samples exceeding the threshold.