# A New Multivariate Approach for Real Time Detection of Routing Security Attacks in VANETs
## 6 Results and Discussion
### Evaluation of the Proposed Scheme  
In this part, the purpose is to evaluate the proposed approach and demonstrate its applicability to the AODV routing security attack in VANETs. We consider two different scenarios of the AODV routing protocol (scenarios 1 and 2):  
1. Scenario 1: normal AODV without attacks  
In this case, the experiments are performed according to the simulation parameters exhibited in Table 2. The total vehicles involved are 100 vehicle nodes comprising 10 random source-destination pairs. These pairs simultaneously generate CBR traffic with fixed size packets of 1024 Bytes. Packets are routed using normal AODV routing protocol. In this way, all nodes are legitimate vehicles and no black hole node has been taken. The total time for the simulation was configured to 100 s.
2 Scenario 2: AODV with black hole attack  
In this simulation scenario, we implement one malicious node that acts as the black hole attacker. The remaining nodes are legitimate vehicles that behave normally and broadcast genuine messages to the other vehicles in the network. The steps described in the previous flowchart (Figure 2) are executed and the R-J coefficient values are computed accordingly. The following figures (Figures 6 and 7) depict the results. These figures show the curves obtained after applying the proposed detection scheme for both scenarios: scenario 1 and scenario 2. Figure 6: Results of the R–J coefficient calculations in the normal scenario (scenario 1). Figure 6 represents the results of applying our approach MVSDS (Multivariate Statistical Detection Scheme) in the normal scenario (the absence of black hole attack). This figure shows the plots of the calculated R-J values for non-rescaled and rescaled data with Min-Max Normalization (MMN), Z-Score Normalization (ZSN), and Normalization by Decimal Scaling (NDS) techniques. The objective is to illustrate the importance of data rescaling techniques for attack detection schemes in VANETs. Thresholds used for attack detection corresponding to the critical values of the Ryan-Joiner method are also plotted. From this figure, it can be seen that the R-J values start with lower values than in the first seconds of the simulation. These values are logical since the AODV routing protocol uses the route discovery mechanism before launching the data transmission. As the simulation advances, it can be seen that the observed R-J values increase and we observe that the overall R-J values of the multivariate data are higher than the critical values at various times of the simulation. This outcome suggests that the R-J values without black hole attack confirm the multivariate normality assumption. Furthermore, we note from the plots that the R-J values computed after applying the data rescaling techniques are higher than those computed on the original data for almost the three data rescaling techniques. These findings stipulate that applying the data rescaling techniques improve the data sensitivity to the multivariate normality assumption. This can be extremely helpful in accurately identifying the malicious activities in our detection scheme. From Figure 6, it is also seen that the Min-Max technique performs better, since all points in its plot exceed the R-J calculated for the original data followed by the Decimal Scaling technique. The calculated R-J values by applying the Z-Score technique show quite inferior values as we progress in the simulation. In conclusion, the key point to note is that our detection scheme performs better when applying the data rescaling techniques, particularly the Min-Max technique. In contrast, when the black hole attack is initiated in the network (scenario 2), the computed values of the R-J coefficient had lower values than the critical values at various times of the simulation. Figure 7 below shows the results of these calculations.