A survey of local/cooperative-based malicious information detection techniques in VANETs

This article analyses Single/local and Cooperative based malicious information detection techniques in VANETs. Single/local based detection schemes are further comprised of plausibility, consistency and single node behavior. However, these techniques performances are not upto the mark, because of single node reliance. The cooperative based detection techniques are more efficient than Single/local based detection schemes. The prerequisites for these scheme need more nodes, unlike Single/local based detection schemes. These techniques are classified based on consistency and behavior with neighbors. Trust-based detection techniques are analysed on previous communication history. However, these scheme needs a honest and sufficient number of nodes for reliable result.

VANETs are a subclass of MANETs that enable vehicles to communicate with each other and RSUs. In VANETs, vehicles act as a router node as well as a terminal node. The communication takes place in VANETs using V2V and V2I.

The architecture of VANETs consists of different software and hardware components. In VANETs, vehicle are equipped with an OBU. The RSU is deployed on roadside to monitor network nodes’ behaviour information [15] and provide Internet facility access to pasenger on wheels. The CAs distribute security-related information through RSU like public key, private key and privacy-related information in VANETs (Fig. 1).

In VANETs, communication information consist of two types of messages, which are beacon and safety messages. Beacon messages are periodic information which shows presence of vehicle in network. It contains position of vehicle, identity of sender, speed and time. Safety messages are broadcasted in the case of safety event occurrence showing location of event [23]. VANET applications consist of vehicle cooperation for traffic management, notify drivers about danger on road and provide other comfort messages for passengers. VANET applications improve passenger safety, avoid collission, detection of movable and fixed obstacles and broadcast weather information [24]. Road safety applications consist of emergency electronic brake light (EEBL), slow/stop vehicle advisor (SVA), cooperative collision warning (CCW), road hazard notification (RHN) and post-crash notifications (PCN) [25, 26]. The driver assistance applications warn driver in specific situations like overtaking vehicles and traffic congestion. This application category contains toll booth collection [27], parking notification and congested road notification(CRN) [24, 28]. The third kind of application facilitates drivers and passengers while travelling. It provides mobile Internet services, discussions between vehicles [24] and entertainment [29]. MANETs and VANETs have some similar properties like self-management and low bandwidth. Frequently disconnected network, vehicle density and pattern of traffic flow are well-known challenges in VANETs. These issues directly effect security protocols and safety on wheels.

High mobility of vehicles is one of the important features, where the vehicle moves with different speed and direction. Signals fading is taken place in communication range because there are so many high-rise building, houses, vehicles and obstacles specially in cities. It may weaken signal strength as well. High traffic density creates jam in network which may cause frequent disconnections in the network. In high mobility VANETs, routing is a very difficult task because vehicle moves with various speeds [30–32]. High mobility makes a frequent topology change in result over a short time connection that is established between nodes in VANETs. Therefore, strong medium access control (MAC) protocols are a prerequisite for effective data dissemination strategies to enhance throughput and reduce communication overhead [33–35]. A dynamic topology network is vulnerable to different security attacks.

Wireless network communication makes VANETs faster, but evil doer may inject bogus information for accident and misleading purposes. Therefore, safety of information has uttermost priority. It is more important that information must not be modified or deleted by attacker [36]. Secure communication have many important metrics. In non-secure communication, outsider attackers try to enter with a fake identity in the network. The authentication is an important task to tackle because the attackers always try to authenticate with fake key/ID in the network. The sender-broadcasted messages must be authenticated to prevent outsider attackers from denial of service (DoS) attacks [37], where a large number of messages are authenticated through group signatures with low overhead and a timely manner [38]. In this category, there are several attacks but key/certificate replication, position faking and Sybil (malicious node create fake IDs and transmit false messages) are considered as critical attacks in VANETs [24]. The delay in authentication should be as minimum as possible [39, 40]. Confidentiality is also a security requirement in VANETs, and it ensures the fact that data will only be read by an authorized entity. In VANETs, data are exchanged among nodes and attacker can get information about locations and privacy related to driver. It is a difficult task in VANETs to detect an attack on confidentiality. Traffic analysis and information gathering are well-known attacks on confidentiality [24]. Securing data from unauthorized alteration during communication in VANETs is very important. Integrity techniques protect data from alteration, deletion and addition. These integrity detection schemes are for V2V and V2I communication in VANETs. In VANETs, an attack is happened when sensor or other OBU and RSU are manipulated by a malicious node [41]. Replay and fabrication/alteration are well-known attacks in VANETs as far as integrity is concerned [24]. Fabrication attack happens when a node creates bogus information in order to get certain privileges [42].

Availability of information is an important factor in VANETs. It enables a system to work all the time and provides information to vehicles. The goal behind DoS attack is to bring the network down and unavailable [43]. Jamming is to disrupt the communication channel [44, 45]. Spamming are messages that have no usefulness for users [46, 47], and DoS are well-known attacks on availability in VANETs. In [48], insider and outsider DoS attackers are mitigated through hash message authentication code (HMAC) and threshold value in VANETs. The drawback of this scheme is that a malicious node can attack with the help of fake messages. In network security, non-repudiation means to ensure that the communication entities are original and cannot be denied after communication happened. Non-repudiation is normally achieved by public key-based techniques [49]. Manipulated data related to safety and privacy is always verified for non-repudiation. In privacy, the attacker analyses vehicle and driver information throughout the journey. The single identity of vehicle create issues for privacy [7, 50]. The user can easily trace or compromise their personal details [51]. Therefore, it is more important to protect the vehicle owner’s privacy. However, for privacy to provide anonymous authentication with low computational cost is a challenging task [52]. Therefore, in VANETs, a set of names are assigned to vehicles called pseudonyms. The actual identity is only known to CA that provides pseudonyms. The other nodes and RSUs only know pseudonyms. Pseudonyms are generated in such a way that actual identity cannot be predicted from pseudonyms. The pseudonyms are changed from time to time specially in mix zone, where nodes are not able to observe [53]. If there is only one vehicle in mix zone, then change in pseudonyms belongs to same node. In [54], a trade-off between security and privacy in VANETs is proposed because trust information is not useful due to frequent change in pseudonyms from time to time.

The management of large number of vehicles require an appropriate security infrastructure. The PKI is a combination of hardware, software and procedural components. A PKI provides many services, and the most important is a trusted third-party validation between the counterparts in VANETs. PKI ensures its role as a CA. It delivers sign and keeps digital certificates up to date that represent digital IDs of nodes. The new vehicular public key infrastructure (VPKI) uses digital certificate as a rapid authentication in vehicular environment [24]. There are other security requirements as well that is handled by VPKI (see Fig. 2).

The above security issues are handled by traditional VPKI. However, there are insider attackers that are equipped with valid credentials (public key/private key). These attackers propagate fake messages in VANETs. These attacks cannot be detected through VPKI. To detect fake messages, VANETs will need newly developed enhanced security techniques.

VANETs uses different applications for road safety and traffic management. Safety and non-safety information is disseminated in vehicular network. Therefore, assessment of node behaviour is required for reliable communication. The misbehaviour in VANETs is referred as a kind of abnormal behaviour of node, and it is different from the average behaviour of nodes in network [1]. Why misbehaviour happens in VANETs? There are many reasons. According to [6], the causes of misbehavior are divided in two types, intentionally (attacker) or unintentionally (faulty). The intentional misbehaviour type is further divided into selfishness and malicious intent. The unintentional misbehaviour happens due to signal loss or fault in sensors [5]. The selfishness misbehaviour occurs because the node does not want to utilize its own resources for other nodes in the case of node centric misbehaviour. While in data centric misbehaviour, selfish node broadcasts bogus event information (like false congestion information) to change the normal behaviour of other nodes for own benefit. The malicious misbehaviour (attacker) takes place to disturb normal operation and produce confusion in the network. The misbehaviour is sometimes due to signal loss because nodes leave or enter in the network very frequently. The limited communication range of node is also the reason for misbehaviour. The faulty sensor information also plays a role towards misbehaviour in VANETs [32].

The main objective is to detect those misbehaving nodes that broadcast fake data in VANETs. Revoking misbehaving nodes is a process which may prevent fake packets from further participation in network. Detection schemes are divided in two types, node centric detection and data centric detection. The focus of this article is on fake information detection techniques.

5.2 Data centric detection

Data centric detection focuses on application data from various neighbours. Data centric misbehaviour detection schemes analyse transmitted data for possible misbehaviour. The data is compared with other nodes in network to verify truism of safety messages. In VANETs, vehicles propagate different kinds of safety messages for road safety and collision avoidance. The false safety messages are considered misbehaviour in VANETs [1]. In data centric detection scheme, the node searches for possible evidence to verify application data locally or with the help of neighbour vehicles. The detection of false safety alerts consist of local-based detection and cooperative-based detection mechanisms.

5.2.1 Local-based detection

The local-based detection techniques check each piece of information independently. In local-based detection, each received data from same sender will be consistent with a previous data. These techniques do not rely on other node response for data detection. These techniques are further divided into the following subcategories. These are plausibility checking, consistency checking and behaviour checking (Fig. 3).

Plausibility checking.

In plausibility checking data, from each node is verified through some predefined rules, for example, one location is not occupied by two nodes at the same time. The allowed speed of vehicles should not exceed that has been established by road authorities. The movement of vehicle is verified by two beacon messages which form distance travelled by the node. It is compared with speed in beacon messages. The plausibility checking model can be used for an expected misbehaviour and filtering false safety messages. Plausibility model can produce a valid result in case majority vehicles are not honest nodes because plausibility checking does not rely on other neighbour information [56].

• Database checking model: To protect VANETs from false information, plausibility validation in network is proposed and consist of database rules and checking model. These rules depend on message type. A valid message will be succeeded in all verifications. In order to detect fake vehicle messages, the rule is vehicle location. It will be in range and plausible and time stamp will be checked, and also, velocity should be plausible [58].

• Multiple parameters: For position verification, plausibility is checked for multiple parameters. The parameters are called maximum density threshold (MDT), acceptance range threshold (ART) and mobility grade threshold (MGT). Messages outside the range will be discarded. Multiple messages sent from single location indicates false position. For a Sybil attack detection, map-based verification and claim position are used. Map-based assign plausibility value to beacon messages and compare it with positions in road map [59].

• Classifier framework: A security framework which categorizes misbehaviour in VANETs. A different attack creates various misbehaviours. J-48, Naive Bayes, IBK, Rrndom forest and Ada Boost1 are used as classifiers. These classifiers efficiently classify different misbehaviour attacks. Features related to verification of position, acceptance range, speed and received signal strength (RSS) are used to classify position and identity spoofing attack. The classification framework is used for different misbehaviour detections. Multiple classifier creates overhead and increases computation cost in detection scheme for single node in VANETs [60].

• RSU-based detection: A centralized detection approach is proposed for a malicious node that is propagating false position information in VANETs. This method develops a series of verifications, which includes acceptance range verification, maximum allowable speed check, maximum density of nodes, speed consistency verification and time interval substantiation. These verifications are the responsibility of RSUs to find the legitimacy of node position. This detection scheme minimizes overhead on other mobile vehicles in the network. For safety alerts, position verification is important, and vehicle will wait for RSU response which creates more latency [15].

• ELIDV: In efficient and light-weight intrusion detection scheme for vehicular network (ELIDV) design to detect false information. The aim of the detection scheme is to protect network from three kinds of attacks like false safety messages, integrity and denial of service (DoS) attacks. The ELIDV detects false information detection based on a set of rules. The drawback of this scheme is when the number of node increases then the detection performance decreases [61].

Local-based consistency checking.

In consistency checking, each data must be consistent to previous data, for example, node at location A in first report and second time report represents location C. The speed to reach from location A to C must be consistent in the second report [55]. In these schemes, false information is detected locally rather than other vehicles in VANETs. The detection is based on consistency of messages from same sender while inconsistency is represented as misbehaviour.

• Data centric (DC): This algorithm detects false messages and node’s misbehaviour by observing their action after sending messages. In the data centric misbehaviour detection scheme (MDS), each node locally decide whether information is correct or not. Consistency-based scheme fails when nodes are at equal distance from each other. This algorithm also fails when a node turns around. It detects false location information. When the vehicle is moving on a flyover, then the actual distance is different from the calculated distance. When the vehicles are moving in a group and one turns to the right and the others turn to the left, then the vehicles behind them consider it as a correct alert. When the nodes are moving in an opposite direction and send false alert, it is not a selfish reason but a malicious intent. The second drawback is if a node cannot receive a beacon after an alert message, so it is assumed as a misbehaviour, but sometimes, honest cannot send beacons due to bad signal. Position verification needs a more efficient mechanism rather than sender and receiver timings [7].

• Heartbeat-based detection (HBBD): A short-term misbehaviour detection scheme for node that propagates false position and speed information through heartbeat/beacon messages. The observing node analyse incoming heartbeat/beacons messages for honest and malicious information detection. From present and past information, an expected and observed position is calculated. If information does not match, the suspicious index of vehicle is increased. When suspicious index crosses threshold value, then the vehicle is declared as a malicious vehicle. The main feature of this misbehaviour detection technique is low overhead and there is no need of additional sensors but use of beacon messages. This scheme looks for inconsistency in consecutive beacons. This is effective, has low overhead, and gets misbehaviour detection from few beacon messages, but beacon messages might loss in a process which effects credibility [62].

Behaviour-based detection.

In malicious information detection schemes, driver behaviour has a key role. These schemes monitor behaviour of event reporter. These schemes rely on behaviour information from single node. A scheme required little time for detection because it does not need behaviour information of other vehicles in reporter vicinity. It consist of techniques that are elaborated below (Fig. 3).

• Trajectory-based detection (TBD): This is a misbehaviour detection scheme for false post-crash notification. This detection technique depends upon the behaviour of driver after sending alert. The position of vehicle is sensed each time slot form the time alert received till passed to crash position. The expected trajectory of event crash modulated mobility is calculated. The actual car trajectory is also calculated. If the differences between two trajectories are above the certain threshold, then it will be considered as false alert, the reason a car does not follow the crash trajectory; otherwise, alert will be considered as true. The main drawbacks of MDS is that it assumes vehicle position. The other issue is low threshold which creates more false positive rate [63].

• Root cause-based detection (RCBD): This is another MDS for PCN. After receiving a PCN message observer monitor the behaviour of driver for comparing with expected behaviour of driver, it finds different root causes based on observation between two nodes. The node will follow the free mobility model in case of no alert. The node follows the crash-modulated mobility model in case of alert messages. The scheme assumes node will always send the right location information. This assumption is invalid because a node can send false location information too and may produce false results [64].

The cooperative data detection schemes observe node verification for false information with the help of neighbour nodes. In cooperative data detection techniques, when the node receives safety-related messages, then it is checked for data relation with multiple vehicles in the network. The neighbour node’s conformation about the safety event will ensure the receiver to accept message and notify the driver. The main benefit of cooperative detection is to identify efficiently misbehaviour node with more confidence. The cooperative-based detection schemes have sufficient knowledge for bogus message detection while detecting fake messages. It has produced low false positive and false negative rates of a node. The cooperative-based data detection schemes consist of behaviour-based detection, trusted-based detection and consistency-based detection, as shown in (Fig. 3).

The purpose of this article is to provide an overview of current cooperative-based malicious information detection schemes in VANETs. The detection of malicious event information is very important for road safety and human lives. This article has categorized data centric misbehaviour detection schemes based on their tendency for malicious information.

The cooperative-based detection schemes have more effectiveness than local-based detection. The neighbour vehicles provide evidence for malicious behaviour. These schemes provide low false positive rate than local-based detection schemes. They accurately detect Sybil attacks. Cooperative detection scheme creates more overhead and computation rather than local detection schemes. The malicious information detection requires minimum latency as shown in Table 2. The [66, 70] maintain database for malicious information detection on single node. A high density network cannot maintain database on one node. The main drawback of these schemes are when malicious nodes increase than honest nodes which creates a false result [3]. In VANETs, low density of vehicles also decreases the performance of cooperative detection schemes [9, 65, 68] as shown in Table 2.

VANETs is an ephemeral kind of network where connection between nodes is very short time [86]. Therefore, VANETs are vulnerable to different security attacks [89]. To constitute trust system is a difficult task [90]. A misbehaviour node may not be malicious all the time but due to selfishness.

The reasons depend on multiple circumstances in the network. A simple trust model is needed to be constructed for fast data evaluation in VANETs [91]. In [92], trust management system for malicious information detection needs high trust nodes and RSUs. The RSUs already has an overhead due to other responsibilities. Another issue is trust management on voting systems. The threshold value does not reach due to the constantly changing topology. In trust management system, faulty or malicious nodes can share false trust information. The single identity of vehicle create problems for privacy. The user can easily trace or compromise their personal details. That is a resaon that a set of names are assigned to a vehicle called pseudonyms. The actual identity is only known to CA who provides pseudonyms [7]. Therefore, pseudonyms are changing after certain time period depending on the mechanism. The trust-related data is removed due to privacy issues. For these reasons, VANETs may be needed as a trade-off between privacy and trust management system [93]. In indirect trust management system, a malicious node can provide bad reputation value for honest node. The majority of vehicle must be honest for false information detection. The trust value is assigned based on their past history of communication, but unpredictable behaviour of vehicle sometimes falsifies their past history.