# VAE-Based Real-Time Anomaly Detection Approach for Enhanced V2X Communication Security
## 4 Experimental Setup and Results
### Anomaly Injection and Evaluation Metrics  
To evaluate the anomaly detection performance of our proposed model, we introduced synthetic anomalies into the test data using a controlled injection method. The first type of anomaly is the Constant Offset Injection, where anomalies are injected by applying a constant offset [38] to select features (speed, acceleration, and position \((x,y)\)) of the test dataset. The offset magnitude was scaled using a parameterized factor \(\left(\text{High}_{(\text{ValueFactor})}\right)\) relative to the feature's maximum value. The second type of anomaly was introduced by applying a constant offset to randomly selected vehicles of specific features (speed, acceleration, and position \((x,y)\)). We injected the offset to a target vehicle to demonstrate an attacker in the V2X communications or a compromised vehicle sending false messages. To simulate a constant offset, an attack factor ranging from 0.1 to 2 with a step size of 0.1 was used to introduce varying levels of abnormality, representing mild, moderate, and extreme deviations from normal behavior. To focus on the anomalies within specific regions of the dataset, a subset of the test data (the middle 30% of records) was selected for modification. This ensured anomalies were localized and mimicked real-world scenarios where errors or attacks may occur in bursts. The method was independently applied to different features, speed, and position \((x,y)\). For example, the offset value added to the speed column was determined as follows. \[\text{Offset}=\text{Max}_{\text{Speed}}\times\text{High}_{(\text{ValueFactor})} \tag{3}\]  
where \(\text{Max}_{\text{Speed}}\) is the maximum value in the speed column of the dataset. We also simulated random offset, as mentioned above, with the same type of scaling factor \(\left(\text{High}_{(\text{ValueFactor})}\right)\) relative to the feature's maximum value. The injection was applied to various features to simulate diverse types of message errors, speed (simulating speed sensor malfunctions with abrupt, random deviations), and position \((x,y)\) (mimicking GPS or localization errors with random positional shifts). Finally, a binary anomaly label was generated, where normal samples were marked as 0 and injected anomalies as 1. The proposed model's performance in detecting anomalies in V2X communications was evaluated using several standard metrics and additional performance indicators. These metrics assess the detection accuracy and the model's ability to generalize and operate efficiently in real-time scenarios. The F1 score is particularly useful in scenarios where false positives and false negatives have significant consequences. * Precision (P): Precision measures the proportion of correctly identified anomalies among all the instances flagged as anomalies by the model. It is defined as \[\text{P}=\frac{\text{True}\,\text{Positives}\,(\text{TP})}{\text{True}\, \text{Positives}\,(\text{TP})+\text{False}\,\text{Positives}\,(\text{FP})}\] (4)
* Recall (R): Recall measures the model's ability to accurately identify all actual anomalies. It is defined as \[\text{R}=\frac{\text{True}\,\text{Positives}\,(\text{TP})}{\text{True}\, \text{Positives}\,(\text{TP})+\text{False}\,\text{Negatives}\,(\text{FN})}\] (5)
* F1-Score: The F1-score provides a harmonic mean of precision and recall, offering a single measure that balances the trade-off between these two metrics. It is calculated as \[\text{F1}=2\cdot\frac{\text{P}\cdot\text{R}}{\text{P}+\text{R}} \tag{6}\]
* Accuracy (A): Accuracy is a measure of the proportion of correct predictions (both positive and negative) made by the model out of the total number of predictions. It is mathematically defined as \[\text{A}=\frac{(\text{TP})+(\text{TN})}{(\text{TP}+\text{TN}+\text{FP}+\text{ FN})}\] (7)  
We determined the anomaly detection threshold by computing the 98 th percentile of the reconstruction errors obtained from the training data.