# Streaming-Based Anomaly Detection in ITS Messages
## 1 Introduction
Consequently, the sensitivity of RRCF is reduced when the sample size is decreased. A robust random cut data structure is utilised as a summary or representation of the input stream. While detecting anomalies, RRCF maintains the original distances between all pairs of data points. The LSCP (locally selective combination in parallel outlier ensembles) [19] detector builds a small area surrounding a test instance, utilising the consensus of its nearest neighbours in randomly selected feature subspaces. It employs an average of maximum technique, in which a homogenous set of base detectors is fitted to the training data before generating a pseudo ground truth for each occurrence by picking the maximum outlier score. It locates and combines the best detectors in the area and investigates both global and local data linkages. Its strength is that it can quantify the magnitude of local outliers. The local outlier factor (LOF) [20] measures how much a sample's density deviates from its neighbours on a localised level. The score for the anomaly is determined based on the object's isolation from its surroundings, giving it a localised significance. The distance between the \(k\)-nearest neighbours determines the locality, which is used to estimate the local density. The initial step is to compute the \(k\)-_distance_ between a point \(p\) and its \(k\)-th neighbour. Measurement of the distance can be accomplished by various methods, though the Euclidean distance is frequently utilised (Equation (6)):  
\[d(p,o)=\sqrt{\sum_{i=1}^{n}(p_{i}-\alpha_{i})^{2}} \tag{6}\]  
Given a dataset \(D\) and a positive integer \(k\), the \(k\)-nearest neighbours of \(p\) is any data point \(q\), whose distance to \(p\) is not greater than \(k\)-_distance (\(p\))_ (Equation (7)):  
\[N_{k\text{-}distance(p)}(p)=\{q\in D\setminus\{p\}\mid d(p,q)\leq k\text{-} distance(p)\} \tag{7}\]  
The reachability distance of data point \(p\) with respect to data point \(o\) is defined using Equation (8):  
\[reach\text{-}dist_{k}(p,o)=max\left\{k\text{-}distance(o),\,d(p,o)\right\} \tag{8}\]The next step is the estimation of the local reachability density (\(lrd\)), which is inversely proportional to the average reachability distance of \(p\) to its nearest \(k\) neighbours (Equation (9)):  
\[lrd_{\text{MinPts}}(p)=1\ \Bigg{/}\ \Bigg{[}\frac{\sum_{\alpha\in N_{MinPts}(p)} reach-dist_{MinPts}(p,\,o)}{\big{|}N_{MinPts}(p)\big{|}}\Bigg{]} \tag{9}\]  
The LOF is then calculated, which is the mean ratio of the \(lrd\) of point \(p\) to the \(lrds\) of its neighbouring points (Equation (10)). If a point is considerably distant from its surrounding points in relation to their proximity to one another, it is deemed an anomalous point:  
\[LOF_{MinPts}(p)=\frac{\sum_{\alpha\in N_{MinPts}(p)}\frac{lrd_{MinPts}(0)}{ \big{|}N_{MinPts}(p)}}{\big{|}N_{MinPts}(p)\big{|}} \tag{10}\]  
LOF primarily excels at identifying outliers within a local context. If a point is proximal to a cluster with an extremely high density, it is classified as an anomaly. The interpretation of LOF is challenging, as it is presented in the form of a ratio. There is no specific threshold at which a point is considered an outlier. The identification of an anomaly is influenced by both the issue at hand and the individual analysing it. Streaming data refers to an ongoing influx of information that has the potential to be unending and can be regarded as a time series featuring multiple variables. The limitless influx of incoming data generates circumstances in which the data can transform over time, culminating in a scenario where modelling behaviour with more recent data holds greater relevance than using older data [21]. The stream data model may be described as follows:  
\[RD(x)=d(x,\hat{u}_{\text{MCD}},\hat{\Sigma}_{\text{MCD}}) \tag{2}\]0  
where \(z(t)\in\mathbb{R}^{N}\) for \(t\geq 1\)  
Algorithms specifically created for handling data streams are capable of managing enormous volumes of data.