# Intelligent Intrusion Detection System for VANET Using Machine Learning and Deep Learning Approaches

Authors: B. Karthiga; Danalakshmi Durairaj; Nishad Nawaz; Thiruppathy Kesavan Venkatasamy; Gopi Ramasamy; A. Hariharasudan
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

Detecting the attacks in Vehicular Ad hoc Network (VANET) system is very important to provide more secure and reliable communication between all vehicles in the system. In this article, an effective Intelligent Intrusion Detection System (IDS) is proposed using machine learning and deep learning approaches such as Adaptive Neuro Fuzzy Inference System (ANFIS) and Convolutional Neural Networks (CNN), respectively. The existing methods focus on detecting only the known attacks in VANET environment. This limitation is overcome by proposing the Intelligent IDS system using soft computing techniques. The proposed method consists of Known IDS (KIDS) and Unknown IDS (UIDS) modules, which detect both known attacks and unknown attacks. The KIDS module uses ANFIS classification module to detect the known malicious attacks, whereas the UIDS module uses a deep learning algorithm to detect the unknown attacks in VANET. Modified LeeNET (MLNET) architecture is proposed in this article to identify the type of unknown attacks. In this work, DoS attacks, Botnet attacks, PortScan attacks, and Brute Force attacks are detected using this hybrid learning algorithm. The proposed system obtains 96.9% of Pr, 98.3% of Se, 98.7% of Sp, and 98.6% of Acc and consumed 1.75 s for detecting the DoS attack on i-VANET dataset. The proposed system obtains 98.1% of Pr, 98.9% of Se, 98.1% of Sp, and 98.1% of Acc and consumed 0.95 s for detecting the Botnet attack. The proposed system obtains 98.7% of Pr, 99.1% of Se, 98.9% of Sp, and 99.2% of Acc and consumed 1.38 s for detecting the PortScan attack. The proposed system obtains 99.1of Pr, 97.8% of Se, 98.7% of Sp, and 98.5% of Acc and consumed 1.29 s for detecting the Brute Force attack. The developed methodology is tested on the real-time CIC-IDS 2017 dataset, and the experimental results are compared with other state-of-the-art methods.


---

## Body

## 1. Introduction

Communication technology plays an essential role in recent vehicle network management. In conventional methods, the wired communication protocols were developed to control the various internal parts of the vehicle under single devised system architecture. This wired method increases the system and maintenance cost of the vehicle. In order to improve cost efficiency, modern vehicular networks use wireless protocols to transfer or receive the data wirelessly within or outside the vehicles. VANET is the recent efficient wireless technology which is presently used in many intelligent transportation networks [1–3], carpooling [4], and even using fifth-generation small-cell networks [5, 6]. Each vehicle belonging to VANET system consists of multiple wireless sensors, converting equipment, and mapping units. Also, the VANET system consists of two interfacing modules, ad On-Board Unit (OBU) and Road Side Units (RSU). The OBU module is integrated within the vehicle and connects to all the wireless sensors within the vehicle. The RSU module is fitted in roadside buildings with individual transmitter and receiver units to communicate each vehicle’s OBU module. When the vehicle enters the VANET system, it senses the vehicle information through the multiple sensors fitted in it and sends all this data to the RSU module. The accidents will be prevented if there is confident coordination between the vehicle OBU module and RSU module. The performance between the OBU module and RSU module will be affected by the presence of intruders. Hence, there is a need to provide a security mechanism between OBU and RSU modules.By implementing these VANET techniques, accidents are significantly reduced by exchanging the vehicle information with its nearby or surrounding vehicles. This VANET can be categorized into Vehicle-to-Vehicle (VV) and Vehicle-to-Infrastructure module (VI). The VV module of the VANET system transfers the information between vehicle and vehicle. In the case of VI module, if the VANET system, the information is transferred from one vehicle to the centralized system or controller. The real-time environment scenario of the VANET is dynamic, and its topology system is changing with respect to the distance and location of vehicles. The factors such as environmental noises affect the quality of the information passage between the vehicles [7–9]. This type of vehicle environment is called a rugged VANET environment, which is easily affected by external attacks such as eavesdropping and hacking the data. Figure 1 illustrates the VANET environment where all the vehicles are connected wirelessly to the centralized controller. The vehicles in VANET and centralized controller are attacked by the attacker. Figure 1 shows the VANET systems, which connect multiple vehicles to the centralized controller, which is called as RSU module. The attackers mostly affected the interference between each vehicle and the interference between the vehicle and the centralized controller.Figure 1
VANET system.The attackers generate different types of attacks to collide with the functional activities of the network environment in VANET system. This will also affect the lives of people who are driving vehicles in these environmental conditions. Therefore, detecting the attacks in VANET system is very important to provide more secure and reliable communication between all vehicles in the system. The attacks in VANET are classified into either external attacks or internal attacks. Internal attacks can be detected or identified using cryptography methods, which use a digital signature to perform encryption and decryption. These methods are not able to detect the external attacks [10–15]. Therefore, the IDS is required in VANET to provide security from external attacks. The external attacks are categorized into Denial of Service (DoS) attacks, Botnet attacks, PortScan attacks, and Brute Force attacks. DoS attack can be generated by any attacker who statically launches the attack in a particular location, or any moving vehicle can launch the attack. The attacker intends to disrupt the network services that are used by the vehicles. Botnet attack is generated due to the devices which are affected by malware. The ports in the device can be affected or attacked by the PortScan attack. The login credentials and passwords of the network devices can be affected by the Brute Force attack. In this article, the attacks in VANET system are detected using deep learning methodologies. The main objective of this article is to design an intelligent IDS system for VANET which detects both known and unknown attacks. Also, the novel hybrid deep learning architecture is proposed in this article to classify various attacks in VANET.The notations and descriptions are given in Table1:Table 1
Notations and descriptions.
AcronymsAbbreviationsADRAttack Detection RateAccAccuracyANNArtificial Neural NetworksANFISAdaptive Neuro Fuzzy Inference SystemCNNConvolutional Neural NetworksDBFDeep Belief NetworksDoSDenial of ServiceDDoSDistributed Denial of ServiceFCNNFully Connected Neural NetworksIDSIntrusion Detection SystemKIDSKnown IDSKNNK-Nearest NeighborMLNETModified LeeNETNNNeural NetworksPNNProbabilistic Neural NetworkPrPrecisionReLuRectified Linear UnitROCReceiver Operating CharacteristicsSSecondsSeSensitivitySpSpecificitySVMSupport Vector MachineUIDSUnknown IDSVANETVehicular Ad hoc NetworkVWCAVehicular Weighing Clustering AlgorithmVVVehicle-to-VehicleThis article is structured as follows: Section2 states the conventional methodologies for detecting the attacks in IDS in VANET, Section 3 proposes an intelligent IDS system using hybrid classification approach, Section 4 discusses the experimental results of this extensive proposed methods, and Section 5 concludes this article.


## 2. Related Works

Hind Bangui et al. [16] used a hybrid data-driven methodology for detecting the various attacks in the VANET IDS system. This methodology used the integration approach for combining the various data models to identify the malicious nodes in the VANET system using the data-driven model. This methodology was tested on various environmental VANET systems to validate the proposed hybrid data-driven model. Alsarhan et al. [17] used a rule-based security filter for filtering the anomaly nodes in the VANET system. These filtered nodes were used to extract the linear properties using Dempster–Shafer’s theory. The authors tested this rule-based anomaly-driven approach on a large real-time dataset to optimize the detection rate of the VANET system. The positive impact of the developed anomaly detection method was tested and compared with various machine learning-based IDS systems in the VANET environment. Rasika et al. [18] used a deep learning algorithm for detecting intruders in VANET by improving the basic architecture of the IDS module. This work mainly concentrated on detecting the attacks between the modules in roadside units and vehicles. The authors used Deep Belief Networks (DBF) deep learning algorithm for detecting the attacks, and this method was tested on CIC-IDS2017 dataset to validate the experimental results. Abdulaziz Alshammari et al. [19] designed an advanced IDS module in VANET using different classification methods. The extensive experimental results were analyzed through different validation methods. Zeng et al. [20] used the machine learning algorithm Neural Networks (NN) to improve the performance efficiency of the VANET environment. The developed model was analyzed to a number of internal layers and its weighting bias.Erfan A Shams et al. [21] developed a machine learning classifier-based intrusion detection system for detecting the various forceful attacks in networks. The kernel-based Support Vector Machine (SVM) was used to classify the known IDS from the unknown IDS in the VANET system. This method failed to detect the attacks when there were high numbers of vehicle nodes in the VANET system. Muder Almi’ani et al. [22] devised a non-linear intrusion detection method for detecting malicious attacks in the VANET system. The authors computed the number of clusters for determining the self-organizing maps in VANET. These self-organizing maps were used to classify the attacks in network system. This intelligent intrusion detection system was tested with various VANET environmental systems to validate the obtained self-organizing and clustered maps. Laisen Nie et al. [23] used CNN methodology to improve the learning and testing rate of the anomaly identification system in VANET. The authors computed various spatio-temporal properties from the vehicle or nodes in VANET, and these features were learned and classified using this CNN method. Kang et al. [24] implemented deep learning architecture for the detection of anomaly nodes in the VANET system. The authors tested the real-time traffic network through different numbers of deep learning algorithms to verify the effectiveness of the network architecture.Danalakshmi et al. [25] proposed an IDS technique in which the Deep Belief Network is used by enhancing with a rule-based technique to improve the accuracy of the detection rate and reduce the false alarm rate as well. The authors concentrated only on False Data Injection and DoS attacks. To identify the port scan attacks, efficient detection rules are generated in the IDS, which detects the real-time native port scan attacks using Snort [10]. But the snort has some limitations that, due to noise, can limit the effectiveness of IDS. Guangzhen Zhao et al. [26] utilized two classification models, DBF and Probabilistic Neural Network (PNN), for detecting intrusion in the VANET system. The authors analyzed the performance of the system by implementing the IDS system with these two classification models. Hao [27] used an encryption-based key management system for detecting the various attacks in IDS system of the VANET environment. The developed key management system provided different encrypted keys for handling a large amount of data between the roadside unit and the vehicles. Daeinabi et al. [28] proposed a vehicular weighing clustering algorithm (VWCA) for improving the security level of the nodes in VANET. The authors constructed a weight-based clustering framework for detecting the nodes being attacked by the host node.Mengting Yao et al. [29] proposed mutual authentication method for improving the security enhancement in VANET using a forward secrecy approach. The shared key in this method was verified through the batch normalization process. The authors detected impersonation and forgery attacks using this mutual authentication technique. Shen et al. [30] developed a data aggregation approach for VANET to improve security performance. The authors used a batch verification approach between each transmission process of sender and receiver in order to provide a trust behavior network. Gope et al. [31] improved security authentication of VANET by developing a privacy-preserving approach between vehicle and grid. The authors applied and tested the developed security authentication scheme in different rouged environments. Zhang et al. [15] improved the intrusion detection system of VANET using distributed preserving approach. The authors significantly analyzed the impact of these distributed preserving techniques on different VANET environments. Gayathri et al. [32] used certificateless approach to prove the authentication scheme in the VANET environment. This method used certificateless keys between the roadside units and central units in VANET. The effectiveness of this keyless approach was analyzed using hit rate and miss rate analysis parameters.Nayyar et al. [33] developed a hybrid data model for the detection of intrusion in the VANET environment. This method was based on the hybrid model and integrated with the non-linear prediction flow to determine the intrusion activities in VANET. Naqvi et al. [34] detected the malicious activities or any misbehavior activities of the vehicle in VANET using IDS flow. The authors mainly focused on providing more reliability and security for the vehicle nodes in VANET. The experimental results of this proposed method were compared with other similar algorithms in the same VANET environment. Jabar Mahmood et al. [35] analyzed and synthesized various problems faced in the security flow of the VANET system. The determined countermeasures in VANET identified the major security threats and resolved the issues in VANET, which also optimized the efficiency of the entire network. Irshad et al. [36] proposed a security key authentication system for the VANET system to provide reliable and secure access to vehicle users. The authors discussed various authentication protocols to improve the security of the VANET system. Faisal et al. [37] detected the location coordinates of the Sybil attacks in the VANET system. The authors analyzed the effectiveness of the developed attack prevention system in static and dynamic environments to provide reliability for all the nodes in the VANET system. Mahmood et al. [38] proposed an anonymous identity-based key agreement protocol for maintaining the attack prevention system for the applications of smart grid environments. The authors also discussed the various key agreement protocols for comparing the proposed method in this work.Kumar et al. [39] used blockchain model with deep learning for a privacy-preserving secure framework in the VANET system. The authors discussed various blockchain models to validate the proposed security network. Randhir Kumar et al. [40] developed a privacy preservation model for the VANET system to provide privacy and security in C-ITS infrastructure. The proposed framework provides two levels of security and privacy using blockchain and deep learning modules. Kumar et al. [41] proposed a security strategy that uses artificial intelligence models to understand cyber-attacks and can proficiently protect IoT-enabled Maritime Transportation System (MTS) data. Randhir Kumar et al. [42] proposed blockchain and deep learning (DL)-enabled secure data processing framework for an edge-envisioned green CAV environment.Sourabh Sharma et al. [43] used Singular Value Decomposition (SVD) method for color image watermarking based on bee colony algorithm. Dibakar Sinha et al. [44] used CNN for the detection of coronary artery disease. Idio Guarino et al. [45] applied a different set of machine learning approaches for identifying intrusion detections with respect to various forms. The limitations of the various machine learning approaches were discussed in this work. Bovenzi et al. [46] developed a model used for intrusion detection framework using Internet of Things (IoT) with the help of machine learning models. The authors discussed certain exhibited limitations of the current intrusion model and provided a prominent solution for intrusion detection. Mirsky et al. [47] designed an autoencoder which was constructed based on the ensemble structural algorithm for detecting intruders on the online platform.Table2 shows the existing methods with their limitations. These limitations are overcome by the proposed method.Table 2
Existing methods with their limitations.
Conventional methodsDistinctive characteristicsLimitationsHind Bangui et al. [16]Hybrid data-driven modelDetected known attacks onlyAlsarhan et al. [17]Features optimizationsConsumed high detection time for attacksRasika et al. [18]Non-linear testingComplex detection algorithmAbdulazizAlshammari et al. [19]Robust algorithmDetected known attacks onlyZeng et al. [20]Required minimum hardware resourcesComplex detection algorithmErfan A Shams et al. [21]Hybrid modelLow sensitivity rateThe main limitations of the conventional methods are stated as follows,(i)
The present IDS systems only focused on detecting the known attacks in VANET(ii)
Most IDS system using deep learning algorithms has a cascade structure, increasing the detection timeThe conventional IDS systems used a mathematical complex model for detecting intrusion in VANET. This article proposes a soft computing approach for detecting intrusion, which combines machine and deep learning algorithms to improve the IDS detection rate. Also, most IDS system using deep learning algorithms has a cascade structure, which increases the detection time.The main contributions of this paper are stated below.(i)
An effective IDS is proposed using machine learning and deep learning approaches(ii)
The proposed IDS framework is designed with KIDS and UIDS modules, which detect both known and unknown attacks(iii)
The known malicious attacks are detected using the proposed KIDS framework, which uses ANFIS, and the unknown malicious attacks are detected using the proposed UIDS, which uses a deep learning algorithm(iv)
Modified LeeNET (MLNET) architecture is proposed in this article to identify the type of unknown attacks. In this work, DoS attacks, Botnet attacks, PortScan attacks, and Brute Force attacks are detected using this hybrid learning algorithm


## 3. Proposed Methodologies for IDS in VANET

This article proposes an effective IDS methodology using machine and deep learning approaches. The proposed method consists of Known IDS (KIDS) and Unknown IDS (UIDS) modules, which detect both known and unknown attacks. The KIDS module uses a machine learning algorithm to detect known malicious attacks. The UIDS module uses a deep learning algorithm to detect unknown attacks in VANET. The entire algorithm or workflow of the proposed IDS of VANET is depicted in Figure2.Figure 2
Hybrid deep learning model for IDS in VANET.


### 3.1. Signature Model

The proposed IDS system of VANET is designed with a training model and testing model. The training model uses the signature module and the ANFIS classifier to produce the trained patterns. These trained patterns from the training module are used to classify the attacks in VANET into known or unknown attacks. The size of the network data from VANET is huge, which degrades the conventional IDS system. Hence, data pre-processing is used in the training module to detect and eliminate duplicate and redundant data in network traffic. The removed data from the pre-processing module is fed into the signature module, which is used to separate the header information from the data. The header data from the known malicious attacks (x) and unknown attacks (y) are trained using ANFIS classifier, which produces the trained patterns in the training model of the proposed IDS system. The ANFIS architecture of the proposed IDS system is depicted in Figure 3.Figure 3
ANFIS for IDS system in VANET.The ANFIS module is designed with five layers: the first layer is the input layer, the fifth layer is the output layer, and the remaining three layers are called hidden layers. The input layer receives the header data from known malicious attacks, and they are normalized using the normalization factors A1 and A2. Similarly, the input layer receives the header data from unknown attacks, and they are normalized using the normalization factors B1 and B2. Layer 2 performs the fuzzification process, and layer 3 performs the defuzzification process of the normalized header values of both known and unknown attacks. Layer 5 uses a summation function to add the responses from the layer 3 nodes.In this article, ANFIS is constructed with five numbers of internal layers and each layer is designed with a set of intrinsic equations. Layer 1 is called as adaptive node layer. All nodes in this layer are represented by the following equations.Layer 1 is called as adaptive node layer. All nodes in this layer are represented by the following equations.(1)L1,ix=μAx;i=1,2,L1,iy=μBy;i=3,4.The mean values (μxandμy) are computed using the following equations.
(2)μAx=11+x−c/a2b,μBy=11+y−c/a2b,where a,b,c are the intrinsic parameter set.Layer 2 is called a fixed node layer, and the response of this layer 2 is given as(3)L2,i=wi=μAx∗μBy.The firing strength of each node in layer 3 is computed using the following equation.(4)L3,i=Si=wiw1+w2;i=1,2.The response of Layer 4 node is determined using the firing strength of the response of layer 3.(5)L4,i=Si∗fi.The final response of Layer 5 is given as(6)L5,i=∑Si∗fi.


### 3.2. KIDS Model

This module receives the real-time network traffic from various nodes or vehicles in VANET environment system, and all these obtained real-time traffic data are applied to pre-processing data module. This module identifies each vehicle’s data from the real-time traffic by its individual ID and separates the header information from each data. This header information is fed into the testing phase of the ANFIS classifier with respect to the trained patterns, which are obtained from the training module of the IDS system.The same architecture depicted in Figure3 is also used in testing phase of the ANFIS classifier, where the trained patterns are fed into “x”, and the testing pattern is fed into “y” of the architecture. The ANFIS in testing module produces a binary response (f). The response has the following criteria.
(7)attacktype=Knownattack;iff≥0Unknownattack;ifelse.The training and classification algorithm of ANFIS in the proposed IDS system of VANET is given in the following steps:Algorithm 1: Attack detection and classification using ANFIS.
Input: Real-time traffic from VANET;Output: Known and unknown attack;1. Receives the real-time traffic from VANET environmental system;2. Apply pre-processing to separate the header of individual data from each attacked vehicledia=d1a,d2a,d3a,⋯⋯⋯dna, where na is the total number of vehicles in VANET system.3. Apply pre-processing to separate the header of individual data from each non-attacked vehicledi=d1,d2,d3,⋯⋯⋯dn, where n is the total number of vehicles in VANET system.4. For eachtraffic do5. ComputeANFIStrained=dia,di6. End for7. Sort the trained patterns.ANFISsort=ANFIStrained8. Apply pre-processing to separate the header of individual data from each test vehicledt=dt1,dt2,dt3,⋯⋯⋯dtn, where tn is the total number of test vehicles in VANET system.9. For eachtesttraffic do10. ComputeANFIStested=ANFISsort,dt11. End for12. Apply the criteria to identify the known attacks and unknown attacks usingattack_type=Knownattack;iff≥0Unknownattack;ifelse


### 3.3. UIDS Model

The vehicle node which is affected by known attacks from the KIDS module is mitigated by other vehicle nodes in VANET system. The unknown attacks cannot be identified by the machine learning classifier due to its training algorithm. Hence, there is a need for a deep learning classifier for the detection of unknown attack types in VANET system. Though many conventional deep learning architectures have been available from the past decade, LeeNET is a simple and efficient deep learning architecture designed using fewer internal layers than the other conventional deep learning architectures. In this article, Modified LeeNET (MLNET) architecture is proposed to identify the type of unknown attacks. The conventional LeeNET and proposed MLNET architectures are depicted in Figures4(a) and 4(b), respectively.Figure 4
(a) Conventional LeeNET. (b) Proposed MLNET architecture.
(a)(b)The conventional LeeNET is designed with two numbers of Conv_layer and two numbers of Pool_layer, and three numbers of Fully Connected Neural Networks (FCNN), as illustrated in Figure4(a). The trained patterns are passed through Conv_layer1, and its output response size is reduced using Pool_layer1.The Rectified Linear Unit (ReLu) module is placed between each convolutional layer and pooling layer in order to remove the negative responses from output of each convolutional layer. The function of ReLu module is described in the following equation.(8)fx=0;ifx<0x;ifx≥0,where x is the response of the convolutional layer, and fx is the output of ReLu module.The size-reduced matrix from Pool_layer1 is passed through Conv_layer2, and its output response size is reduced using Pool_layer2. The size-reduced matrix from Pool_layer2 is passed through three consecutive FCNN layers. In this conventional architecture, all the internal modules are functioned in serial mode, and hence the attack detection time is high. This limitation is overcome by proposing MLNET architecture which is constructed using parallel internal modules, as illustrated in Figure4(b). Also, this modified MLNET uses two FCNN layers instead of three FCNN layers in conventional LeeNET architecture. The specification of the proposed MLNET architecture is depicted in Table 3.Table 3
Specification of the proposed MLNET architecture.
Internal layers nameSpecification valuesConv_layer1512 filters,2∗2 stridePool_layer13∗3 max pool algorithmConv_layer2512 filters,2∗2 stridePool_layer23∗3 max pool algorithmFCNN11028 neuronsFCNN22 neuronsThe Softmax module or normalized exponential function is used after FCNN2 layer to perform the exponential-based normalization process to eliminate the over-fitting problems in the output. The function of Softmax module is depicted in the following equation.(9)Softmaxxi=expxi∑expxi,where xi is the response element from FCNN2 layer.The training and classification algorithm of MLNET in the proposed IDS system of VANET is given in the following steps;Algorithm 2: Attack detection and classification using MLNET.
Inputs: Unknown attacks from KIDS module;Output: Types of unknown attack;Start;1.The unknown attacks are separated into various clusters using K-Nearest Neighbor (KNN) clustering approach using the following equation.c1,c2,⋯..cn=KNNC, where C is the unknown attack sequences from KIDS module.2.For eachANFIS_trained do3.ComputeMLNETtrained=MLNETANFIS_trained4.End for5.Sort the trained patterns.MLNETsort=MLNETtrained6.For eachC do7.ComputeMLNET_tested=MLNETsort,C8.End forApply the following criteria to identify the type of the unknown attacks based on the response of FCNN2 (y1) using9. EndUnknownattacktype=Botnetattack;ify1>0PortScanattack;ify1=0BruteForceattack;ify1<0


## 3.1. Signature Model

The proposed IDS system of VANET is designed with a training model and testing model. The training model uses the signature module and the ANFIS classifier to produce the trained patterns. These trained patterns from the training module are used to classify the attacks in VANET into known or unknown attacks. The size of the network data from VANET is huge, which degrades the conventional IDS system. Hence, data pre-processing is used in the training module to detect and eliminate duplicate and redundant data in network traffic. The removed data from the pre-processing module is fed into the signature module, which is used to separate the header information from the data. The header data from the known malicious attacks (x) and unknown attacks (y) are trained using ANFIS classifier, which produces the trained patterns in the training model of the proposed IDS system. The ANFIS architecture of the proposed IDS system is depicted in Figure 3.Figure 3
ANFIS for IDS system in VANET.The ANFIS module is designed with five layers: the first layer is the input layer, the fifth layer is the output layer, and the remaining three layers are called hidden layers. The input layer receives the header data from known malicious attacks, and they are normalized using the normalization factors A1 and A2. Similarly, the input layer receives the header data from unknown attacks, and they are normalized using the normalization factors B1 and B2. Layer 2 performs the fuzzification process, and layer 3 performs the defuzzification process of the normalized header values of both known and unknown attacks. Layer 5 uses a summation function to add the responses from the layer 3 nodes.In this article, ANFIS is constructed with five numbers of internal layers and each layer is designed with a set of intrinsic equations. Layer 1 is called as adaptive node layer. All nodes in this layer are represented by the following equations.Layer 1 is called as adaptive node layer. All nodes in this layer are represented by the following equations.(1)L1,ix=μAx;i=1,2,L1,iy=μBy;i=3,4.The mean values (μxandμy) are computed using the following equations.
(2)μAx=11+x−c/a2b,μBy=11+y−c/a2b,where a,b,c are the intrinsic parameter set.Layer 2 is called a fixed node layer, and the response of this layer 2 is given as(3)L2,i=wi=μAx∗μBy.The firing strength of each node in layer 3 is computed using the following equation.(4)L3,i=Si=wiw1+w2;i=1,2.The response of Layer 4 node is determined using the firing strength of the response of layer 3.(5)L4,i=Si∗fi.The final response of Layer 5 is given as(6)L5,i=∑Si∗fi.


## 3.2. KIDS Model

This module receives the real-time network traffic from various nodes or vehicles in VANET environment system, and all these obtained real-time traffic data are applied to pre-processing data module. This module identifies each vehicle’s data from the real-time traffic by its individual ID and separates the header information from each data. This header information is fed into the testing phase of the ANFIS classifier with respect to the trained patterns, which are obtained from the training module of the IDS system.The same architecture depicted in Figure3 is also used in testing phase of the ANFIS classifier, where the trained patterns are fed into “x”, and the testing pattern is fed into “y” of the architecture. The ANFIS in testing module produces a binary response (f). The response has the following criteria.
(7)attacktype=Knownattack;iff≥0Unknownattack;ifelse.The training and classification algorithm of ANFIS in the proposed IDS system of VANET is given in the following steps:Algorithm 1: Attack detection and classification using ANFIS.
Input: Real-time traffic from VANET;Output: Known and unknown attack;1. Receives the real-time traffic from VANET environmental system;2. Apply pre-processing to separate the header of individual data from each attacked vehicledia=d1a,d2a,d3a,⋯⋯⋯dna, where na is the total number of vehicles in VANET system.3. Apply pre-processing to separate the header of individual data from each non-attacked vehicledi=d1,d2,d3,⋯⋯⋯dn, where n is the total number of vehicles in VANET system.4. For eachtraffic do5. ComputeANFIStrained=dia,di6. End for7. Sort the trained patterns.ANFISsort=ANFIStrained8. Apply pre-processing to separate the header of individual data from each test vehicledt=dt1,dt2,dt3,⋯⋯⋯dtn, where tn is the total number of test vehicles in VANET system.9. For eachtesttraffic do10. ComputeANFIStested=ANFISsort,dt11. End for12. Apply the criteria to identify the known attacks and unknown attacks usingattack_type=Knownattack;iff≥0Unknownattack;ifelse


## 3.3. UIDS Model

The vehicle node which is affected by known attacks from the KIDS module is mitigated by other vehicle nodes in VANET system. The unknown attacks cannot be identified by the machine learning classifier due to its training algorithm. Hence, there is a need for a deep learning classifier for the detection of unknown attack types in VANET system. Though many conventional deep learning architectures have been available from the past decade, LeeNET is a simple and efficient deep learning architecture designed using fewer internal layers than the other conventional deep learning architectures. In this article, Modified LeeNET (MLNET) architecture is proposed to identify the type of unknown attacks. The conventional LeeNET and proposed MLNET architectures are depicted in Figures4(a) and 4(b), respectively.Figure 4
(a) Conventional LeeNET. (b) Proposed MLNET architecture.
(a)(b)The conventional LeeNET is designed with two numbers of Conv_layer and two numbers of Pool_layer, and three numbers of Fully Connected Neural Networks (FCNN), as illustrated in Figure4(a). The trained patterns are passed through Conv_layer1, and its output response size is reduced using Pool_layer1.The Rectified Linear Unit (ReLu) module is placed between each convolutional layer and pooling layer in order to remove the negative responses from output of each convolutional layer. The function of ReLu module is described in the following equation.(8)fx=0;ifx<0x;ifx≥0,where x is the response of the convolutional layer, and fx is the output of ReLu module.The size-reduced matrix from Pool_layer1 is passed through Conv_layer2, and its output response size is reduced using Pool_layer2. The size-reduced matrix from Pool_layer2 is passed through three consecutive FCNN layers. In this conventional architecture, all the internal modules are functioned in serial mode, and hence the attack detection time is high. This limitation is overcome by proposing MLNET architecture which is constructed using parallel internal modules, as illustrated in Figure4(b). Also, this modified MLNET uses two FCNN layers instead of three FCNN layers in conventional LeeNET architecture. The specification of the proposed MLNET architecture is depicted in Table 3.Table 3
Specification of the proposed MLNET architecture.
Internal layers nameSpecification valuesConv_layer1512 filters,2∗2 stridePool_layer13∗3 max pool algorithmConv_layer2512 filters,2∗2 stridePool_layer23∗3 max pool algorithmFCNN11028 neuronsFCNN22 neuronsThe Softmax module or normalized exponential function is used after FCNN2 layer to perform the exponential-based normalization process to eliminate the over-fitting problems in the output. The function of Softmax module is depicted in the following equation.(9)Softmaxxi=expxi∑expxi,where xi is the response element from FCNN2 layer.The training and classification algorithm of MLNET in the proposed IDS system of VANET is given in the following steps;Algorithm 2: Attack detection and classification using MLNET.
Inputs: Unknown attacks from KIDS module;Output: Types of unknown attack;Start;1.The unknown attacks are separated into various clusters using K-Nearest Neighbor (KNN) clustering approach using the following equation.c1,c2,⋯..cn=KNNC, where C is the unknown attack sequences from KIDS module.2.For eachANFIS_trained do3.ComputeMLNETtrained=MLNETANFIS_trained4.End for5.Sort the trained patterns.MLNETsort=MLNETtrained6.For eachC do7.ComputeMLNET_tested=MLNETsort,C8.End forApply the following criteria to identify the type of the unknown attacks based on the response of FCNN2 (y1) using9. EndUnknownattacktype=Botnetattack;ify1>0PortScanattack;ify1=0BruteForceattack;ify1<0


## 4. Results and Discussion

In this article, CIC-IDS 2017 [48] and i-VANET [49] datasets are used to validate the proposed VANET system using machine and deep learning algorithms. The CIC-IDS 2017 dataset consists of real-world traffic with attacks and non-attack data from various vehicle nodes from the VANET system. The attacks in this real-time dataset consist of Brute Force attacks, heart-bleed attacks, botnet attacks, DoS attacks, DDoS attacks, web attacks, and infiltration attacks. In this article, 1,32,000 records in the category of the data without any attack from this dataset are obtained. Also, 75,000 botnet attack records and 89,000 PortScan attack records and 17,000 Brute Force attack records are obtained from the dataset to verify the effectiveness of the proposed IDS VANET system. The i-VANET dataset is constructed by following IEEE 802.11p protocol for measuring the performance of the proposed IDS system. In this article, 1,12,000 records in the category of the data without any attack from this dataset are obtained. Also, 65,000 botnet attack records and 75,000 PortScan attack records and 15,000 Brute Force attack records are obtained from the dataset to verify the effectiveness of the proposed IDS VANET system.The proposed IDS VANET system model is evaluated using MATLAB R2020 version, and the following metrics are used in this article for validation.(10)PrecisionPr=t1t1+t3,SensitivitySeorRecall=t1t1+t4,SpecificitySp=t2t2+t3,AccuracyAcc=t1+t2t1+t2+t3+t4,where t1 and t2 are the detected attack records and attack-free records, respectively. t3 and t4 are the falsely detected attack records and attack-free records, respectively.In this article, 1,96,000 records from open dataset are tested using the proposed intelligent IDS module and the proposed system stated in this article correctly detected 1,93,715 records. Table4 is the ADR analysis of the proposed IDS VANET system using machine and deep learning methods. The average ADR of the proposed IDS-VANET system is 97.7%, and the same is illustrated in Figure 5. The ADR of the malicious attack detection is about 98.5%, Botnet attack is about 98.9%, PortScan attack is about 99.7%, and Brute Force attack is about 93.9%. From the extensive simulation results obtained in this article, the proposed intelligent IDS module obtains a high value of ADR for detecting the PortScan attack in the VANET environment.Table 4
ADR analysis of proposed IDS VANET system on CIC-IDS 2017 dataset.
Attack typesNumber of recordsCorrectly detected recordsAttack Detection Rate (ADR) in %DoS attack15,00014,78998.5Botnet attack75,00074,19298.9PortScan attack89,00088,76299.7Brute Force attack17,00015, 97293.9196,000193,71597.7Figure 5
ADR analysis.Table5 shows the ADR analysis of the proposed IDS VANET system on i-VANET dataset. In this article, 1,75,000 records from the open dataset are tested using the proposed intelligent IDS module and the proposed system stated in this article correctly detected 1,71,335 records. The average ADR of the proposed IDS-VANET system is 97.4%. The ADR of the malicious attack detection is about 98.5%, Botnet attack is about 97.9%, PortScan attack is about 98.6%, and Brute Force attack is about 98.3%. From the extensive simulation results obtained in this article, the proposed intelligent IDS module obtains a high value of ADR for detecting the PortScan attack in the VANET environment.Table 5
ADR analysis of proposed IDS VANET system on i-VANET dataset.
Attack typesNumber of recordsCorrectly detected recordsAttack Detection Rate (ADR) in %DoS attack20,00018,98594.9Botnet attack65,00063,63897.9PortScan attack75,00073,96398.6Brute Force attack15,00014,74998.3175,000171,33597.4Table6 is the experimental analysis of the proposed IDS VANET system with respect to the performance metrics on CIC-IDS 2017 dataset. The proposed system obtains 97.9% of Pr, 98.9% of Se, 98.3% of Sp, and 98.7% of Acc and consumes 1.87 s for detecting the DoS attack. The proposed system obtains 98.1% of Pr, 97.7% of Se, 98.7% of Sp, and 98.4% of Acc and consumes 2.19 s for detecting the Botnet attack. The proposed system obtains 97.8% of Pr, 98.3% of Se, 98.6% of Sp, and 98.8% of Acc and consumes 0.98 s for detecting the PortScan attack. The proposed system obtains 98.3of Pr, 98.2% of Se, 99.1% of Sp, and 98.5% of Acc and consumed 1.04 s for detecting the Brute force attack. From the extensive simulation results obtained in this article, the proposed intelligent IDS module consumed more detection time for Botnet attacks and consumed less detection time for PortScan attacks. The accuracy efficiency of the PortScan attack is higher than the accuracy level of the other attacks in the VANET system due to its non-linear functional activities. The proposed IDS-VANET system obtains 98.27% of Se, 98.92% of Sp, 98.6% of Acc, and 1.52 s of detection time, which is illustrated in Figure 6. The average accuracy of the proposed IDS model is about 98.6. The ROC of the proposed IDS model is about 98.6, which is similar to the experimental results obtained in this article; hence, the results are validated.Table 6
Experimental analysis of proposed IDS VANET system on CIC-IDS 2017 dataset.
Attack typesPr in %Se in %Sp in %Acc in %Detection time (s)DoS attack97.998.999.398.71.87Botnet attack98.197.798.798.42.19PortScan attack97.898.398.698.80.98Brute Force attack98.398.299.198.51.04Average98.0298.2798.9298.61.52Figure 6
Analysis of proposed IDS VANET system in terms of performance metrics.Table7 is the experimental analysis of the proposed IDS VANET system for the performance metrics on i-VANET dataset. The proposed system obtains 96.9% of Pr, 98.3% of Se, 98.7% of Sp, and 98.6% of Acc and consumes 1.75 s for detecting the DoS attack. The proposed system obtains 98.1% of Pr, 98.9% of Se, 98.1% of Sp, and 98.1% of Acc and consumes 0.95 s for detecting the Botnet attack. The proposed system obtains 98.7% of Pr, 99.1% of Se, 98.9% of Sp, and 99.2% of Acc and consumes 1.38 s for detecting the PortScan attack. The proposed system obtains 99.1of Pr, 97.8% of Se, 98.7% of Sp, and 98.5% of Acc and consumes 1.29 s for detecting the Brute Force attack.Table 7
Experimental analysis of proposed IDS VANET system on i-VANET dataset.
Attack typesPr in %Se in %Sp in %Acc in %Detection time (s)DoS attack96.998.398.798.61.75Botnet attack98.198.998.198.10.95PortScan attack98.799.198.999.21.38Brute Force attack99.197.898.798.51.29Average98.298.598.698.61.34Receiver Operating Characteristics (ROC) are used to analyze the exactness of the proposed IDS model stated in this article. It is computed between the values sensitivity and 1-specificity. The average accuracy of the proposed IDS model is about 98.6%. The ROC of the proposed IDS model is about 98.6%, which is similar to the experimental results obtained in this article; hence, the results are validated.Table8 is the comparative analysis of proposed IDS VANET systems with other similar methods in terms of ADR. Figure 6 is the graphical analysis of comparison between the proposed and conventional IDS methods in the VANET system.Table 8
Comparative analysis of proposed IDS VANET systems on CIC-IDS 2017 dataset.
MethodsAttack Detection Rate (ADR) in %DoS attackBotnet attackPortScan attackBrute Force attackProposed KIDS-UIDS method98.598.999.793.9Hind Bangui et al. [16]97.997.897.293.2Naqvi et al. [34]98.197.997.392.8Jabar Mahmood et al. [35]97.197.596.891.4Faisal et al. [32]96.998.197.990.3Mahmood et al. [38]96.795.996.192.7Nayyar et al. [33]97.196.897.396.9Erfan et al. [21]96.596.997.290.7MuderAlmi’ani et al. [22]96.997.198.689.7LaisenNie et al. [23]96.397.397.790.9The proposed KIDS-UIDS method is compared with Hind Bangui et al. [16], Naqvi et al. [33], Jabar Mahmood et al. [34], Faisal et al. [35], Mahmood et al. [37], Nayyar et al. [32], Erfan et al. [21], Muder Almi’ani et al. [22] and LaisenNie et al. [23] methods for the detection of various attacks in VANET environment. The conventional methods used different numbers of records for IDS to validate the results. In order to make the proposed method uniformly, all the conventional methods or algorithms are tested on the records used in the proposed method. Therefore, the results from the conventional methods and the proposed method can be compared to validate the effectiveness of the proposed intelligent IDS system. Table 9 shows the comparative analysis of proposed IDS VANET systems on i-VANET dataset.Table 9
Comparative analysis of proposed IDS VANET systems on i-VANET dataset.
MethodsAttack Detection Rate (ADR) in %DoS attackBotnet attackPortScan attackBrute Force attackProposed KIDS-UIDS method98.598.999.793.9Hind Bangui et al. [16]93.295.196.490.3Naqvi et al. [34]94.694.996.292.1Jabar Mahmood et al. [35]94.194.297.290.3Faisal et al. [32]93.994.896.991.7Mahmood et al. [38]93.294.297.490.3Nayyar et al. [33]95.294.198.291.5Erfan et al. [21]94.295.797.391.2MuderAlmi’ani et al. [22]95.694.898.190.3LaisenNie et al. [23]94.894.197.991.8Computational complexity is the estimation of the computing resources such as time and memory for implementing the proposed algorithms for IDS system in VANET environment. Table10 is the computational complexity analysis of the proposed IDS algorithm.Table 10
Computational complexity analysis of the proposed IDS algorithm.
DatasetsTime (ms)Memory (MB)CIC-IDS 20171.5214567i-VANET1.3416295


## 5. Conclusions

In this article, an intelligent IDS is proposed by integrating machine and deep learning algorithms to improve the efficiency of the VANET. The novelty of this article is that the intelligent IDS system is proposed in VANET, which detects both known and unknown attacks using a signature model. Also, the novel hybrid deep learning architecture is proposed in this article to classify various attacks in VANET. The known attacks in VANET are detected using ANFIS classifier, and the unknown attacks are detected using a deep learning algorithm. In this article, the conventional LeNET algorithm is modified in the proposed IDS to improve the detection time of the various attacks. The ADR of the malicious attack detection is about 98.5%, Botnet attack is about 98.9%, PortScan attack is about 99.7%, and Brute Force attack is about 93.9%. The proposed IDS-VANET system obtains 98.27% of Se, 98.92% of Sp, 98.6% of Acc, and 1.52 s of detection time on CIC-IDS 2017 dataset. The proposed system obtains 96.9% of Pr, 98.3% of Se, 98.7% of Sp, and 98.6% of Acc and consumes 1.75 s for detecting the DoS attack on i-VANET dataset. The proposed system obtains 98.1% of Pr, 98.9% of Se, 98.1% of Sp, and 98.1% of Acc and consumes 0.95 s for detecting the Botnet attack. The proposed system obtains 98.7% of Pr, 99.1% of Se, 98.9% of Sp, and 99.2% of Acc and consumes 1.38 s for detecting the PortScan attack. The proposed system obtains 99.1of Pr, 97.8% of Se, 98.7% of Sp, and 98.5% of Acc and consumes 1.29 s for detecting the Brute Force attack. The future extension of this article is to implement intelligent key management and deep learning methods to improve the security of the IDS in VANET. It could be implemented in an embedded hardware system to validate the effectiveness if the developed IDS method stated in this paper as the future scope. In the future, the performance can be optimized using the extension of the proposed methods stated in this article.



---

*Source: 5069104-2022-10-13.xml*