Detecting faulty and malicious vehicles using rule-based communications data mining

The reliability of most safety applications that are based on vehicular communications, depends in turn on the reliability of data received by each vehicle from its neighbors. Routine messages exchanged in Vehicular Ad hoc Networks (VANETs) include crucial information for safety applications such as direction, position, etc. A vehicle failure and/or a malicious vehicle transmitting false information may affect the data collection scheme and cause a disturbance for safety applications. In such a scenario, (1) the faulty/malicious vehicle should be detected rapidly and (2) routine messages exchange should be updated in consequence. To be able to detect the faulty/malicious vehicle, we developed a mechanism that collects, at a single vehicle, data regarding each neighbour transmission, and extracts the temporal correlation rules between vehicles implicated in transmissions in the neighbourhood. With the mechanism, called VANETs Association Rules Mining (VARM), a mining process will take place during a-priori constant historical period. The associations rules formulated during the mining process will be used to detect a faulty or malicious vehicle, i.e., a vehicle which is not correlated with vehicles in the neighbourhood following these rules. To react after this kind of anomaly detection, an 1:N technique is used as a protection for reestablishing the accuracy of the data collection process between vehicles communicating in the neighbourhood. Simulation results demonstrate the efficiency of the VARM scheme.