## 4 Methods
### Connected and Automated Vehicles (CAVs) Data Characteristics and Anomaly Model
 \tag{15}\]

By application of total probability theorem, (15) can be expressed as follows:

\[ \begin{split} p(C=\vec{c}_{k}\mid M_{j},D\ =\vec{x}_{i})=\\ \frac{P(M_{j}\mid C=\vec{c}_{k},D\ =\vec{x}_{i})p(C=\vec{c}_{k} \mid D=\vec{x}_{i})}{\sum_{c\in(mal,hon)}[p(M_{j}\mid C=c_{k},D\ =\vec{x}_{i})p(C=c_{k}\mid D=\vec{x}_{i})]}\end{split}  \tag{16}\]

For possible expression of mathematical simplicity, it is assumed that the individual reports remain independent [37]. From conditional probability of honest and malicious information in vehicular networks, the following mathematical expression is deduced:

\[p\left(mal\mid\vec{x}\right)+p\left(hon\mid\vec{x}\right)=1 \tag{17}\]

It can be deduced from (17), that \(\vec{X}\) is malicious, when \(\vec{X}=1-p\left(hon\mid\vec{x}\right)\). Threshold selection for the categorization of the information into malicious and honest classes is adaptively done as detailed in Section 4.4. ## 5 Results and Discussion

This section shows the results of the analysis of anomaly detection mechanisms in CAVs network. Comparing the results of the individual mechanisms are made to highlight their respective capabilities. The detection performances of the different approaches are taken when trained and tested for a specific category of anomaly or in the presence of all the anomaly types. In this study analysis, the three anomaly types are simulated from the CAVs data-set with varying anomaly durations, magnitudes of network density and the anomaly rate \(\alpha\) to draw insight on the performance strength from the use of CNN, BDL, and the proposed approach (DWT-BDL) in detecting/identifying anomalous sensor behaviors in real-time. The simulation is carried out with Python libraries namely: TensorFlow and TensorFlow Probability. The training/validation/testing split of 60%, 20%, 20%, are used on every given sample. The validation and training sets are used to tune the parameters of the selected detection mechanisms and different test sets are used to assess and measure the performance of each of the detection/identification mechanisms. For a higher degree of confidence level, each simulation is repeated 15 times with a different seeds. Each experimental result is the average over the number of repeated simulations

### Mechanisms Under Single Anomaly System

The different detection mechanisms are applied on the modeled anomalies types and their performance evaluations are taken accordingly. Different datasets are generated, each with a specific type of anomaly, with the anomaly incidence rate \(\alpha\), and duration \(d\) set to values of 3% and 3 respectively. Furthermore, in all the experiments we consider a varying network densities \(m_{i}\in\{2000,4000,6000,8000,10000\}\). #### 5.1.1 Impact of Network Density on Anomaly Detection

1. **Instant Anomaly** In this section, the impacts of the magnitude of network density \(m\), on the performance of CNN, BDL and the proposed approach (DWT-BDL) are evaluated. Figure 9 indicates that at a low network density CNN, BDL and the proposed approach show poor performance. Figure 8: Proposed Approach Framework. This is very much observed in the state-of-the-art approaches compared to the proposed approach. For instance at, \(m\) = 2000, CNN and BDL have the performance values of 85.70% and 85.00% and 85.0% and 87.1% in F1-score as plotted in Figure (a)a and sensitivity metrics as plotted in Figure (c)c, while the proposed approach improves over CNN and BDL in the same metric values with performance gains of 4.3% and 2.7% compared to CNN and 2.9% and 1.9% compared to BDL respectively. Similarly, Figure (d)d illustrates the superiority of the proposed approach. However, the CNN approach in this scenario maintained a lead performance in some cases of \(m\) in the experiment as shown in Figure (b)b. However, at high values of \(m\), the overall strength of the detection approaches used in this analysis systematically improves.