# Streaming-Based Anomaly Detection in ITS Messages
## 2 Materials and Methods
### Proposed Enhanced LSCP Algorithm (ELSCP)
It also applies to features that are normally distributed:_  
\[r_{xy}=\frac{\sum_{i=1}^{n}((x_{i}-\overline{x})(y_{i}-\overline{y})}{\sqrt{ \sum_{i=1}^{n}(x_{i}-\overline{x})^{2}\sum_{i=1}^{n}(y_{i}-\overline{y})^{2}}} \tag{17}\]  
_where \(n\) is the sample size; \(\overline{x}=\frac{\sum_{i=1}^{n}x_{i}}{n}\) denotes the mean of \(x\); and \(\overline{y}=\frac{\sum_{i=1}^{n}y_{i}}{n}\) denotes the mean of \(y\)._  
Using Equation (17), ELSCP computes the correlation between the local pseudo ground truth (\(target_{s}\)) and the local detector scores \(D_{i}(X_{train_{s}})\) as \(r(target_{s}\), \(D_{i}(X_{train_{s}}))\). This calculation loops through all the \(k\) base detectors. A histogram is constructed with \(b\) equal intervals out of Pearson correlation scores, and detectors in the largest bin are chosen as competent base detectors for the given test instance. The Pearson correlation values are then ranked to compute weights. Finally, the selected detector scores are merged using the weighted average of the maximum strategy as \(weighted\_avg(D_{t}^{*}(X_{test_{i}}))\) to obtain the final detection score. The implementation of ELSCP is summarised in Algorithm 1, with Figure 3 showing the flow chart. ```
Input : the pool of heterogeneous detectors \(D\), training data \(X_{train}\), test data \(X_{test}\), the local region size \(k\) Output : Outlier scores for each instance in \(X_{test}\)  Train all base detectors in \(D\) on \(X_{train}\);  Generate training outlier scores \(O_{train}\) with Equation (14) ;  Generate pseudo ground truth: \(target:=max(O(X_{train}))\); for each test instance \(X_{test_{i}}\) in \(X_{test}\)do  Define local region (\(\xi\)) by Ball tree kNN ensemble ;  Extract local pseudo ground truth \(target_{s}\) by selecting \(k\) neighbours in (\(\xi\)) from target; for each base detector \(D_{i}\) in \(D\)do  Get the outlier scores associated with training data in the local region \(D_{i}(\xi)\);  Evaluate the local competency of \(\mathrm{D_{i}}\) by computing the similarity between target\({}_{s}\) and \(\mathrm{D_{i}}(\xi)\) using Pearson correlation with Equation (17) ;  Select a group of \(t\) most similar detectors and add to the empty set \(D_{t}^{*}\);  Compute weights by ranking the Pearson correlation scores; return\(weighted\_avg(D_{t}^{*}(X_{test_{i}}))\) ; returnscores;
```  
**Algorithm 1**Enhanced LSCP. ELSCP implementation applies two base detectors, HBOS and LOF. The local outlier factor (LOF) [20] determines how far a sample's density deviates from its neighbours on a local scale. It is local in the sense that the anomaly score is determined by the object's isolation from the surrounding area. The locality is determined by the distance between the k-nearest neighbours, which is used to estimate the local density. One can discover outliers (samples that have a much lower density than their neighbours) by comparing the local density of a sample to the local densities of its neighbours. The procedure for ELSCP starts with HBOS and LOF base detectors being fitted to the training data. A pseudo ground truth for each train instance is generated by taking the maximum outlier score from all of the base detectors. We implement Pearson correlation in the model selection and combination phases. In the computation of the final ensemble score, we implement a weighted average, where the weight is computed by ranking the Pearson correlation scores. For each test instance, the following are performed:Using the ball tree nearest neighbour algorithm with the Haversine distance metric, the local region is defined to be the set of the nearest training points in randomly sampled feature subspaces that occur more frequently using a defined threshold over multiple iterations. 2. Using the local region, a local pseudo ground truth is defined, and the Pearson correlation is calculated between each base detector's training outlier scores and the pseudo ground truth. 3.