A survey of local/cooperative-based malicious information detection techniques in VANETs

Vehicular ad hoc networks (VANETs) are emerged technology where vehicles and roadside units (RSUs) communicate with each other. VANETs can be categorized as a subbranch of mobile ad hoc networks (MANETs). VANETs help to improve traffic efficiency and safety and provide infotainment facility as well. The dissemination of messages must be relayed through nodes in VANETs. However, it is possible that a node may propagate false information in a network due to its malicious behaviour or selfishness. False information in VANETs can change drivers’ behaviour and create disastrous consequences in the network. Therefore, sometimes false safety messages may endanger human life. To avoid any lass, it is more important to detect and avoid false messages. This paper has explained some important algorithms that can detect false messages in VANETs. The categorization of false message detection schemes based on local and cooperative behaviour has been presented in this article. The limitations and consequences of existing schemes as well as future work has been discussed.

This article analyses Single/local and Cooperative based malicious information detection techniques in VANETs. Single/local based detection schemes are further comprised of plausibility, consistency and single node behavior. However, these techniques performances are not upto the mark, because of single node reliance. The cooperative based detection techniques are more efficient than Single/local based detection schemes. The prerequisites for these scheme need more nodes, unlike Single/local based detection schemes. These techniques are classified based on consistency and behavior with neighbors. Trust-based detection techniques are analysed on previous communication history. However, these scheme needs a honest and sufficient number of nodes for reliable result.

Vehicular ad hoc networks (VANETs) have got much importance for road side safety, security and traffic efficiency in recent years. VANETs have emerged as subclass of mobile ad hoc networks (MANETs). VANETs are having various differences in properties from MANETs; therefore, protocols of MANETs cannot directly be applied to VANETs [1]. In recent announcements from car manufacturers, they have equipped their vehicles with wireless access vehicular environment (WAVE) devices. WAVE protocols are based on IEEE 802.11p standard and provide basic radio standard for dedicated short-range communication (DSRC) in VANETs [2–5]. The DSRC protocol is used for vehicle to vehicle (V2V) and vehicle to infrastructure (V2I) communication [6]. Every vehicle consists of an on-board unit (OBU), which broadcasts messages about its position, speed and other events. OBU has the capability to verify incoming messages from valid entities. Roadside units (RSUs) are fix units which monitor vehicle activities and collect important information about nearest vehicles [5, 7, 8]. Vehicular communication consist of two types of messages. Periodic messages show presence of vehicle in network and emergency messages, which are propagated in the occurrence of some damaging event(s) [3]. Various applications of VANETs exist on road safety, passenger comfort and traffic efficiency [9, 10].

In the future, VANETs will decrease road accidents by providing real-time information about traffic and road status to drivers [9]. The public key infrastructure (PKI) has been developed for VANETs’ security. The PKI concentrates on data integrity and authentication schemes. It provides traditional solutions for VANETs’ communication [11]. The certificate authorities (CAs) are responsible for maintaining credentials of vehicles in network [7, 12]. However, in V2V communication node, misbehaviour may propagate false messages, where a single malicious node may disturb the whole network [13]. False messages in VANETs can create many issues like higher time required to reach destination, more fuel consumption, higher pollution and traffic accidents [6, 14]. The emergency messages are relayed in multi-hop fashion in the network. Bandwidth may become limited due to broadcasting of false messages. There must be some mechanisms to detect and avoid these false messages [3]. A malicious vehicle can broadcast false position information in the network that has adverse consequences in safety applications [15–20]. VANETs’ routing, safety application, traffic management and data aggregation rely on correct vehicle position information [21, 22].

This article has investigated current research efforts on false data detection schemes, like false messages and false position information detection schemes. This article has also described all existing false message detection schemes. The major contributions of this article are as follows:

• Local-based false information detection schemes have been categorized into plausibility, consistency and behaviour-based detection schemes.

• Cooperative-based data detection schemes are normally used for bogus information detection. The cooperative-based schemes are divided into behaviour, consistency and trust-based detection schemes. Trust-based detection techniques are further categorized into direct trust, indirect trust and hybrid trust-based detection schemes.

• This article has described different detection protocols and their issues. These issues must be eradicated to make VANETs’ application more reliable and safe.

• This paper has bring an analysis of the insight information about these protocols.

The rest of the paper is organized as follows:

Section 3 is an introduction to the VANETs. Section 4 delivers a description on secure communication in the VANETs. Section 5 describes misbehaviour in the VANETs. Section 6 categorizes cooperative-based detection schemes for malicious information detection. Section 6 provides a detailed image of cooperative detection schemes. Section 7 presents malicious information detection techniques, and finally, conclusion and future work has been drawn in Section 8.

VANETs are a subclass of MANETs that enable vehicles to communicate with each other and RSUs. In VANETs, vehicles act as a router node as well as a terminal node. The communication takes place in VANETs using V2V and V2I.

The architecture of VANETs consists of different software and hardware components. In VANETs, vehicle are equipped with an OBU. The RSU is deployed on roadside to monitor network nodes’ behaviour information [15] and provide Internet facility access to pasenger on wheels. The CAs distribute security-related information through RSU like public key, private key and privacy-related information in VANETs (Fig. 1).

VANET architecture

Full size image

In VANETs, communication information consist of two types of messages, which are beacon and safety messages. Beacon messages are periodic information which shows presence of vehicle in network. It contains position of vehicle, identity of sender, speed and time. Safety messages are broadcasted in the case of safety event occurrence showing location of event [23]. VANET applications consist of vehicle cooperation for traffic management, notify drivers about danger on road and provide other comfort messages for passengers. VANET applications improve passenger safety, avoid collission, detection of movable and fixed obstacles and broadcast weather information [24]. Road safety applications consist of emergency electronic brake light (EEBL), slow/stop vehicle advisor (SVA), cooperative collision warning (CCW), road hazard notification (RHN) and post-crash notifications (PCN) [25, 26]. The driver assistance applications warn driver in specific situations like overtaking vehicles and traffic congestion. This application category contains toll booth collection [27], parking notification and congested road notification(CRN) [24, 28]. The third kind of application facilitates drivers and passengers while travelling. It provides mobile Internet services, discussions between vehicles [24] and entertainment [29]. MANETs and VANETs have some similar properties like self-management and low bandwidth. Frequently disconnected network, vehicle density and pattern of traffic flow are well-known challenges in VANETs. These issues directly effect security protocols and safety on wheels.

High mobility of vehicles is one of the important features, where the vehicle moves with different speed and direction. Signals fading is taken place in communication range because there are so many high-rise building, houses, vehicles and obstacles specially in cities. It may weaken signal strength as well. High traffic density creates jam in network which may cause frequent disconnections in the network. In high mobility VANETs, routing is a very difficult task because vehicle moves with various speeds [30–32]. High mobility makes a frequent topology change in result over a short time connection that is established between nodes in VANETs. Therefore, strong medium access control (MAC) protocols are a prerequisite for effective data dissemination strategies to enhance throughput and reduce communication overhead [33–35]. A dynamic topology network is vulnerable to different security attacks.

Wireless network communication makes VANETs faster, but evil doer may inject bogus information for accident and misleading purposes. Therefore, safety of information has uttermost priority. It is more important that information must not be modified or deleted by attacker [36]. Secure communication have many important metrics. In non-secure communication, outsider attackers try to enter with a fake identity in the network. The authentication is an important task to tackle because the attackers always try to authenticate with fake key/ID in the network. The sender-broadcasted messages must be authenticated to prevent outsider attackers from denial of service (DoS) attacks [37], where a large number of messages are authenticated through group signatures with low overhead and a timely manner [38]. In this category, there are several attacks but key/certificate replication, position faking and Sybil (malicious node create fake IDs and transmit false messages) are considered as critical attacks in VANETs [24]. The delay in authentication should be as minimum as possible [39, 40]. Confidentiality is also a security requirement in VANETs, and it ensures the fact that data will only be read by an authorized entity. In VANETs, data are exchanged among nodes and attacker can get information about locations and privacy related to driver. It is a difficult task in VANETs to detect an attack on confidentiality. Traffic analysis and information gathering are well-known attacks on confidentiality [24]. Securing data from unauthorized alteration during communication in VANETs is very important. Integrity techniques protect data from alteration, deletion and addition. These integrity detection schemes are for V2V and V2I communication in VANETs. In VANETs, an attack is happened when sensor or other OBU and RSU are manipulated by a malicious node [41]. Replay and fabrication/alteration are well-known attacks in VANETs as far as integrity is concerned [24]. Fabrication attack happens when a node creates bogus information in order to get certain privileges [42].

Availability of information is an important factor in VANETs. It enables a system to work all the time and provides information to vehicles. The goal behind DoS attack is to bring the network down and unavailable [43]. Jamming is to disrupt the communication channel [44, 45]. Spamming are messages that have no usefulness for users [46, 47], and DoS are well-known attacks on availability in VANETs. In [48], insider and outsider DoS attackers are mitigated through hash message authentication code (HMAC) and threshold value in VANETs. The drawback of this scheme is that a malicious node can attack with the help of fake messages. In network security, non-repudiation means to ensure that the communication entities are original and cannot be denied after communication happened. Non-repudiation is normally achieved by public key-based techniques [49]. Manipulated data related to safety and privacy is always verified for non-repudiation. In privacy, the attacker analyses vehicle and driver information throughout the journey. The single identity of vehicle create issues for privacy [7, 50]. The user can easily trace or compromise their personal details [51]. Therefore, it is more important to protect the vehicle owner’s privacy. However, for privacy to provide anonymous authentication with low computational cost is a challenging task [52]. Therefore, in VANETs, a set of names are assigned to vehicles called pseudonyms. The actual identity is only known to CA that provides pseudonyms. The other nodes and RSUs only know pseudonyms. Pseudonyms are generated in such a way that actual identity cannot be predicted from pseudonyms. The pseudonyms are changed from time to time specially in mix zone, where nodes are not able to observe [53]. If there is only one vehicle in mix zone, then change in pseudonyms belongs to same node. In [54], a trade-off between security and privacy in VANETs is proposed because trust information is not useful due to frequent change in pseudonyms from time to time.

The management of large number of vehicles require an appropriate security infrastructure. The PKI is a combination of hardware, software and procedural components. A PKI provides many services, and the most important is a trusted third-party validation between the counterparts in VANETs. PKI ensures its role as a CA. It delivers sign and keeps digital certificates up to date that represent digital IDs of nodes. The new vehicular public key infrastructure (VPKI) uses digital certificate as a rapid authentication in vehicular environment [24]. There are other security requirements as well that is handled by VPKI (see Fig. 2).

Simple VPKI structure

Full size image

The above security issues are handled by traditional VPKI. However, there are insider attackers that are equipped with valid credentials (public key/private key). These attackers propagate fake messages in VANETs. These attacks cannot be detected through VPKI. To detect fake messages, VANETs will need newly developed enhanced security techniques.

VANETs uses different applications for road safety and traffic management. Safety and non-safety information is disseminated in vehicular network. Therefore, assessment of node behaviour is required for reliable communication. The misbehaviour in VANETs is referred as a kind of abnormal behaviour of node, and it is different from the average behaviour of nodes in network [1]. Why misbehaviour happens in VANETs? There are many reasons. According to [6], the causes of misbehavior are divided in two types, intentionally (attacker) or unintentionally (faulty). The intentional misbehaviour type is further divided into selfishness and malicious intent. The unintentional misbehaviour happens due to signal loss or fault in sensors [5]. The selfishness misbehaviour occurs because the node does not want to utilize its own resources for other nodes in the case of node centric misbehaviour. While in data centric misbehaviour, selfish node broadcasts bogus event information (like false congestion information) to change the normal behaviour of other nodes for own benefit. The malicious misbehaviour (attacker) takes place to disturb normal operation and produce confusion in the network. The misbehaviour is sometimes due to signal loss because nodes leave or enter in the network very frequently. The limited communication range of node is also the reason for misbehaviour. The faulty sensor information also plays a role towards misbehaviour in VANETs [32].

The main objective is to detect those misbehaving nodes that broadcast fake data in VANETs. Revoking misbehaving nodes is a process which may prevent fake packets from further participation in network. Detection schemes are divided in two types, node centric detection and data centric detection. The focus of this article is on fake information detection techniques.

Node centric detection

In the node centric detection scheme, a security model monitors security credentials of a node, like digital signature with the help of PKI [55]. The node centric mechanism is precisely concern with a participating agent (node) in the network. They verify node behaviour by analysing packet and message pattern. Node centric detection is divided in two categories, behaviour-based detection and trust-based detection.

Behaviour-based detection

In the behavioural scheme, looking for a node with an observable behaviour and extracting a metric that recognizes how healthy nodes behave, for example, behaviour schemes, may monitor neighbour node transmitting packets whether rates are exceeding from normal rates or not [55]. In this mechanism, consider how many messages in correct pattern (message format) has been delivered? The main focus of these mechanisms are node-related information [56].

The abnormal behaviour of a node is to monitor packet drop or duplication in VANETs. A verifier node is responsible for monitoring misbehaviour. The verifier node is elected on the basis of their trust value. A verifier may discredit a node that drop or duplicate packets. After crossing the threshold value for misbehaviour, a verifier node reports to cluster head (CH) and update whitelist(good nodes) and blacklist(bad nodes). The CH also reports to CA and revoke them from whitelist. The CA updates the whitelist and blacklist and broadcast it in network [57].

Trust-based detection

Trust-based detection depends on past and present reputation of node. A node whose reputation is good in the past is more likely to behave well in the future [55]. The main advantage of trust-based is that it has one step forward to revocation.

Trust-based system consists reputation system that maintains a past communication history of nodes. Trust management also have a voting scheme, where honest vehicles vote for communication in VANETs [56].

Data centric detection

Data centric detection focuses on application data from various neighbours. Data centric misbehaviour detection schemes analyse transmitted data for possible misbehaviour. The data is compared with other nodes in network to verify truism of safety messages. In VANETs, vehicles propagate different kinds of safety messages for road safety and collision avoidance. The false safety messages are considered misbehaviour in VANETs [1]. In data centric detection scheme, the node searches for possible evidence to verify application data locally or with the help of neighbour vehicles. The detection of false safety alerts consist of local-based detection and cooperative-based detection mechanisms.

Local-based detection

The local-based detection techniques check each piece of information independently. In local-based detection, each received data from same sender will be consistent with a previous data. These techniques do not rely on other node response for data detection. These techniques are further divided into the following subcategories. These are plausibility checking, consistency checking and behaviour checking (Fig. 3).

Malicious information detection schemes in VANETs

Full size image

Plausibility checking.

In plausibility checking data, from each node is verified through some predefined rules, for example, one location is not occupied by two nodes at the same time. The allowed speed of vehicles should not exceed that has been established by road authorities. The movement of vehicle is verified by two beacon messages which form distance travelled by the node. It is compared with speed in beacon messages. The plausibility checking model can be used for an expected misbehaviour and filtering false safety messages. Plausibility model can produce a valid result in case majority vehicles are not honest nodes because plausibility checking does not rely on other neighbour information [56].

• Database checking model: To protect VANETs from false information, plausibility validation in network is proposed and consist of database rules and checking model. These rules depend on message type. A valid message will be succeeded in all verifications. In order to detect fake vehicle messages, the rule is vehicle location. It will be in range and plausible and time stamp will be checked, and also, velocity should be plausible [58].

• Multiple parameters: For position verification, plausibility is checked for multiple parameters. The parameters are called maximum density threshold (MDT), acceptance range threshold (ART) and mobility grade threshold (MGT). Messages outside the range will be discarded. Multiple messages sent from single location indicates false position. For a Sybil attack detection, map-based verification and claim position are used. Map-based assign plausibility value to beacon messages and compare it with positions in road map [59].

• Classifier framework: A security framework which categorizes misbehaviour in VANETs. A different attack creates various misbehaviours. J-48, Naive Bayes, IBK, Rrndom forest and Ada Boost1 are used as classifiers. These classifiers efficiently classify different misbehaviour attacks. Features related to verification of position, acceptance range, speed and received signal strength (RSS) are used to classify position and identity spoofing attack. The classification framework is used for different misbehaviour detections. Multiple classifier creates overhead and increases computation cost in detection scheme for single node in VANETs [60].

• RSU-based detection: A centralized detection approach is proposed for a malicious node that is propagating false position information in VANETs. This method develops a series of verifications, which includes acceptance range verification, maximum allowable speed check, maximum density of nodes, speed consistency verification and time interval substantiation. These verifications are the responsibility of RSUs to find the legitimacy of node position. This detection scheme minimizes overhead on other mobile vehicles in the network. For safety alerts, position verification is important, and vehicle will wait for RSU response which creates more latency [15].

• ELIDV: In efficient and light-weight intrusion detection scheme for vehicular network (ELIDV) design to detect false information. The aim of the detection scheme is to protect network from three kinds of attacks like false safety messages, integrity and denial of service (DoS) attacks. The ELIDV detects false information detection based on a set of rules. The drawback of this scheme is when the number of node increases then the detection performance decreases [61].

Local-based consistency checking.

In consistency checking, each data must be consistent to previous data, for example, node at location A in first report and second time report represents location C. The speed to reach from location A to C must be consistent in the second report [55]. In these schemes, false information is detected locally rather than other vehicles in VANETs. The detection is based on consistency of messages from same sender while inconsistency is represented as misbehaviour.

• Data centric (DC): This algorithm detects false messages and node’s misbehaviour by observing their action after sending messages. In the data centric misbehaviour detection scheme (MDS), each node locally decide whether information is correct or not. Consistency-based scheme fails when nodes are at equal distance from each other. This algorithm also fails when a node turns around. It detects false location information. When the vehicle is moving on a flyover, then the actual distance is different from the calculated distance. When the vehicles are moving in a group and one turns to the right and the others turn to the left, then the vehicles behind them consider it as a correct alert. When the nodes are moving in an opposite direction and send false alert, it is not a selfish reason but a malicious intent. The second drawback is if a node cannot receive a beacon after an alert message, so it is assumed as a misbehaviour, but sometimes, honest cannot send beacons due to bad signal. Position verification needs a more efficient mechanism rather than sender and receiver timings [7].

• Heartbeat-based detection (HBBD): A short-term misbehaviour detection scheme for node that propagates false position and speed information through heartbeat/beacon messages. The observing node analyse incoming heartbeat/beacons messages for honest and malicious information detection. From present and past information, an expected and observed position is calculated. If information does not match, the suspicious index of vehicle is increased. When suspicious index crosses threshold value, then the vehicle is declared as a malicious vehicle. The main feature of this misbehaviour detection technique is low overhead and there is no need of additional sensors but use of beacon messages. This scheme looks for inconsistency in consecutive beacons. This is effective, has low overhead, and gets misbehaviour detection from few beacon messages, but beacon messages might loss in a process which effects credibility [62].

Behaviour-based detection.

In malicious information detection schemes, driver behaviour has a key role. These schemes monitor behaviour of event reporter. These schemes rely on behaviour information from single node. A scheme required little time for detection because it does not need behaviour information of other vehicles in reporter vicinity. It consist of techniques that are elaborated below (Fig. 3).

• Trajectory-based detection (TBD): This is a misbehaviour detection scheme for false post-crash notification. This detection technique depends upon the behaviour of driver after sending alert. The position of vehicle is sensed each time slot form the time alert received till passed to crash position. The expected trajectory of event crash modulated mobility is calculated. The actual car trajectory is also calculated. If the differences between two trajectories are above the certain threshold, then it will be considered as false alert, the reason a car does not follow the crash trajectory; otherwise, alert will be considered as true. The main drawbacks of MDS is that it assumes vehicle position. The other issue is low threshold which creates more false positive rate [63].

• Root cause-based detection (RCBD): This is another MDS for PCN. After receiving a PCN message observer monitor the behaviour of driver for comparing with expected behaviour of driver, it finds different root causes based on observation between two nodes. The node will follow the free mobility model in case of no alert. The node follows the crash-modulated mobility model in case of alert messages. The scheme assumes node will always send the right location information. This assumption is invalid because a node can send false location information too and may produce false results [64].

The cooperative data detection schemes observe node verification for false information with the help of neighbour nodes. In cooperative data detection techniques, when the node receives safety-related messages, then it is checked for data relation with multiple vehicles in the network. The neighbour node’s conformation about the safety event will ensure the receiver to accept message and notify the driver. The main benefit of cooperative detection is to identify efficiently misbehaviour node with more confidence. The cooperative-based detection schemes have sufficient knowledge for bogus message detection while detecting fake messages. It has produced low false positive and false negative rates of a node. The cooperative-based data detection schemes consist of behaviour-based detection, trusted-based detection and consistency-based detection, as shown in (Fig. 3).

Behaviour-based detection

In behaviour-based detection for false event information, a receiver is compared with average driver behaviour, with event reporter behaviour at location of the event. The similarity of average behaviour of vehicles with reporter behaviour confirms an event. In case of behaviour difference below the threshold will provide a solid proof for false information. These kinds of detection technique performance rely on maximum number of honest vehicles in the vicinity of malicious node. The behaviour base detection scheme is normally used for verification of false congestion alerts and PCN application. It has some detection techniques that are as follows:

• IDS/RC²RL: An MDS in where misbehaviours like false position information or intrusion detection scheme (do not follow known pattern) are tested. In this case, more density of vehicles the CRL are compressed through the use of a bloom filter RC²RL (revocation using compressed certificate revocation lists). An MDS is to detect false information by comparing the behaviour of each node with the average behaviour of other nodes in its vicinity to build data models on the fly. Moreover, if a true event appears on the low density, MDS will be considered wrong. It is bad for safety messages [65].

• Acknowledgement-based detection (ABD): This scheme consists of false information detection and mechanism for non-cooperative node detection to isolate malicious node from the network. A data packet is used for false information detection. Vehicle “A” sends information about dense traffic while another node "B" is moving with an appropriate speed. The node “B” report that “A” is sending false information. Another case in same geographic area that a node sends information about traffic jam while another node reports high speed is also considered as fraud. Non-cooperative node is identified through time stamp acknowledgement packet. In false congestion, information of a node is also detected through responses of other nodes in network. A non-cooperative node is detected through acknowledgements. The false information detection technique performance is degraded with a decrease of nodes on the road. The second drawback is that acknowledgement process creates a higher overhead and produce more delay for node and that may be time-critical messages. For selfish and non-cooperative nodes, two lists are used, that is, the individual reputation list (IRL) and the general reputation list (GRL). The main limitation of IRL is that a malicious node can insert wrong information about neighbours without communication with them [9].

Consistency-based detection

Consistency-based detection uses consistency data from multiple vehicles to determine false information. A vehicle which uses previous average speed of neighbour vehicles must be consistent with the new speed from beacon messages.

A maximum difference of inconsistency of average speed will provide evidence of false information [56]. Consistency mechanisms are used when there is a conflict of information from more than one vehicle. For example, in the VANET environment, one group of nodes disseminate false road congestion information while the other group propagate no congestion information. Cooperative consistency need maximum number of honest nodes; otherwise, this scheme would be non-effective for malicious information detection.

• Detection based on database (DBD) : The first model proposed for detecting and correcting malicious data in VANETs. It was a general framework that is used to validate safety information based on local sensor data to detect Sybil node attackers. Each node checks validity of data through a model. When inconsistencies are found, then data is considered as malicious. Adversarial model is used based on parsimony argument for best explanations to correct malicious data. There is no validation or performance testing for this approach. To maintain a global database in VANETs is almost impossible. This scheme does not provide location privacy. This scheme will fail when the number of malicious nodes are more than honest nodes in VANETs [66].

• Detection based six source of information (DBSSI): A security model enable VANETs to distinguish false alerts from legitimate alerts. The detection model is based on six sources of information. The drive is sent an alert after agreement of six sources. The filtering model is dependent on two components. One is threshold curve (TC), and the other is certainty of event curve (CoE). The TC depends on distance between event and driver. The CoE means the confidence of received message from neighbour node. If the CoE intersects threshold curves, then the driver will be notified. The performance of scheme depends on two parameters which are TC and CoE. The threshold is important to the driver while certainty of event is related to event confidence. However, this scheme creates more computation and delay due to six sources for false PCN or congestion event detection. In some scenarios, a threshold may not be crossed due to VANETs’ characteristics only to analyse or to endorse the EEBL applications, and no further applications has been tested or evaluated [67].

• Secondary information based detection (SIBD): A secondary information is generated in the result of primary information. The secondary information is used for detection of primary information. This scheme depends on how many vehicles generate secondary information. This means correlated information in response to primary information is known as degree of belief. In the absence of primary alert, it is also a probability that malicious node send secondary information. However, in case of true primary alerts, neighbour node sends large number of secondary alerts that provide a belief on primary alert. When the degree of belief is 1, it indicates a true event. The degree of belief which is 0 shows a false event; however, the performance of this scheme degraded due to high speed. The minimum density of nodes also effect truism of the scheme [68].

• RD⁴ : The proposed scheme is RD⁴ which is used for cooperative deceptive data detection. RD⁴ filters false accident in VANETs. Detection of true accident is handled by accident sources. The car which is actually involved in accident is equipped with tamper-proof component to resist against propagation of fake identities. When accident report is received by vehicle, the decision is based on the signal strength of his own observation and signal strength of the same event of others. In design when accident happens, the road is black and vehicles slow down. Integrating both signal strength of events for accumulative signal strength, if the accumulated signal strength exceeds the pre-set bound to confirm the event, a velocity deceleration used as a signal strength and accumulative signal strength is observed by the vehicle. An increase in speed indicates low signal strength which does not produce good accuracy for false event detection schemes in VANETs [69].

• VANETs association rule mining (VARM) : It is an introductory scheme for detection of malicious data disseminated by malicious or faulty node in VANETs. The scheme builds a mining association role based on routine messages in VANETs. These messages provide a relation among vehicles. In high density, a mining association between vehicles on a single vehicle creates more computation overhead. It needs more storage capacity for a single node [70].

• Cheater Detection Scheme (CDS): The Cheater Detection Scheme (CDS) for a node is a mechanism that broadcasts fake congestion events. This approach is based on local velocity and distance with the help of a radar to verify the congestion event. It uses a kinematic wave to detect congestion period and distance. It is a very effective technique against fake IDs and sent false congestion event because kinematic wave packets contain signatures and certificates. In kinematics, a wave packet is used for detection of non-existing congestion event in VANETs. This is an effective technique for single misbehaviour vehicle (cheater), but when the cheater increases, then the detection process will take more time because the distance between the leading cheater and the last cheater increases as well [71].

• Fox hole region (FHR): A scheme to detect false PCN in VANETs. MDS is based on FHR event which happens at a certain location. An FHR is a four-coordinate region with dimensions depending on speed of the node. The high speed means larger FHR, and the low speed have smaller FHR. The FHR consists of safe and unsafe zones. Two consecutive beacon messages are used for average speed of vehicles; after that, a FHR is found for each vehicle. We find that in threshold D, if the parameter of belief is between D⁺ and D⁻, there might be a misbehaviour. The information may be correct if it is greater than D⁺ and smaller than D⁻. The FHR help to find a safety value for the node on his current location and speed. This detection approach is valid for static event like PCN. The weight-age information is obtained from consecutive beacons. In some cases, it is not useful when an event is near because the vehicle may cross event location [23].

• Misbehaviour Discovering Method (MisDis): A misbehaviour detection method is known as Misbehaviour Discovering method (MisDis), having accountability of vehicle behaviour by record of evidence to conform it from inside and outside vehicles. MisDis has also identified misbehaviour through inside device (state of automata monitoring) and supervision. A MisDis also keeps a record (security log) for behaviour characteristic of target vehicles. If anything is observed, then a system will inform the RSUs or other security in charge for further assistance. MisDis assumes strong authentication and identification but cannot provide privacy and practical implementation for performance evaluation [72].

• Cooperative Detection and Correction (C−DAC): In Cooperative Detection and Correction (C−DAC), each vehicle calculates his own value of flow (speed, density, flow, location information) and send information to other vehicles. The rest of the vehicles also calculate the value of Speed, density, flow and location information. It provides us a good model for traffic. Each vehicle transmits its flow to another vehicle. If received flow does not match with a VANET model flow, then data will not be accepted. This scheme has effectiveness against node that shares wrong location information. When a node will send false information from multiple identities, then honest nodes that are behind of malicious node ignore this information because of their own speed. When multiple attackers send false information, then the C−DAC scheme cannot detect information as wrong information. The scheme does not provide better result in low density [3]. The scheme performance is enhanced with IDS (intrusion detection system). The IDS uses statistical schemes to identify malicious nodes which broadcast false information [73].

• Subjective logic-based detection (SLBD): A position verification method by enhancing two position verification methods and fusing its data in framework that is known as subjective logic. The parameters have acceptance range threshold (ART) and pro-active neighbour exchange (PNE). Both mechanisms are integrated in the framework. Subjective logic expresses truth value as opinion which consists of belief, disbelief, uncertainty and base rate. Using two methods for position verification ART and exchanging of table is minimum. Therefore, more parameter can be used for better results and low false positive rate in VANETs [22].

Trust-based detection

Trust and reputation are two important tools of security that facilitate nodes in decision making of network [74]. Generally, trust is the expectation and level of confidence of one vehicle about the other vehicle’s action in VANETs [75, 76]. In VANETs, a high dynamic environment and an adapted trust establishment are needed. VANETs are ephemeral kind of network where the connection life is very short and vehicles meet for few seconds. Decision about trust of other nodes must be conducted individually rather than other nodes. Therefore, trust information is collected from other nodes for very limited time [77]. Trusted-based detection techniques assign value to nodes based on their past historical data communication [78]. Trust-based detection system is categorised in three trust systems as shown in Fig. 3.

Direct trust

The established trust is based on mutual sharing of information between nodes in VANETs. This kind of trust does not rely on other node’s trust information. The direct trust is feasible in VANET environment, but sometimes, it cannot provide sufficient trust information for false information detection.

• Particle filter-based detection (PFBD): In this scheme, particle filtering is performed to check the plausibility of data and assess trustworthiness of neighbour nodes. This scheme combines information from different data sources in one particle filter per neighbour, for example, position information is verified through cooperative awareness message (CAM) by sender nodes and neighbour nodes as well as with local sensors (digital road map, radar, Lidar, directional antennas). This scheme is based on the transition shift between two incoming messages. The main benefit of this scheme is that it locally assess trust of neighbour for location verification rather than other vehicles. The accuracy of scheme depends on local sensor data and local sensor data effected from high speed. The drawback of this scheme is more computation overhead and delay for a single vehicle [79].

• Behaviour and position-based trust system (BPBTS) : A method that detects malicious data in traffic signal at intersections. Node creates fake multiple identities (Sybil attack) and transmits information from these fake identities to manipulate traffic signal. The detection of malicious data with the help of combination models expected behaviour of driver and position verification technique. In false information for traffic signal, control is detected by control node. The control node assigns trust level to each node for detection of malicious data. The trust change (update) after each node’s information is received. Sending data with a low or zero trust is considered as a malicious data. In detection scheme, assumption is not valid for node trust to stop on green signal because it will not stop on green signal in a selfishness situation [80].

• Similarity-based trust management system (SBTMS): A similarity-based trust management system (SBTMS) checks for bogus safety event detection in node using similarity index. It assigns trust to one-hop neighbour in the network. This scheme also enhances decision-making power using trust and utilizing echo protocol to check reaction of reporting vehicle. This scheme is feasible when there is more meeting time between vehicles for communication to build a trust system. The second limitation is when a safety event elevator (SEE) sends echo safety event alert to a safety event reporter (SER). If SER does not reply due to signal loss or out of range communication from SEE, it is also considered as malicious data [81].

Indirect trust

In indirect trust system, the node shares trust information of other nodes based on their past communication relationship. This kind of trust is transitive and effective in terms of sufficient information.

• Proof of relevance (PoR) : An event verification responsibility is to put on the reporter. When a vehicle sense safety event, it must be endorsed from vehicle in the detecting area and disseminate it in the network. The drawback is that malicious node could endorse message with fake digital signature in the detecting area. Low density of vehicles in reporter area is also considered as a failure of this scheme [82].

Hybrid trust

Hybrid trust is a combination of direct and indirect trust. The hybrid trust system is good for detection rather than individually using direct and indirect trust, but it consumes more time in detection. Therefore, VANETs need a short time trust management system.

• Vehicle ad hoc network reputation system (VARS): A vehicle ad hoc network reputation system (VARS) uses direct and indirect trust as well as appended opinions from sources to enable confident decisions on event packets. The main problem of this scheme is that it involves accumulation of reputation evaluation which takes more time [83].

• Event reputation system (ERS): The event reputation system (ERS) prevents inaccurate traffic messages in VANETs. A dynamic reputation system is used to determine the incoming traffic trustworthiness to the driver. In this scheme, the vehicle gets enough reputation from inside sensors and received messages. When enough reputation is received, then the traffic warning will be broadcasting to other vehicles in the network. The scheme is dependent on two parameters: event reputation value and event confidence list. Event reputation system consists of three interfaces and four functionalities. One is event table storage for received messages or event from on-board unit sensors. The event table consists of event identity, type of event, time stamp of event, event location, event transmission range, event reputation value and event confidence value list. The event table stores each event separately and set event reputation value. The ERS uses aggregative event observation mechanism and reputation adoption mechanism. The event confidence threshold and event reputation threshold assess event intensity and reliability at the same time. The limitation of ERS is that event reputation value is low in high speed because of the sensor capability (minimum detection). The event confidence is small in low density. The other factors like event duration and transmission range also have an effect on ERS [84].

• Event reputation model (ERM): An event-based reputation model is where an event observer node checks the expected behaviour of event reporters. If the behaviour matches, then the reputation of event as well as that of node’s increases. Otherwise decreases in false information situation. A faulty or malicious node can inject wrong reputation value [85].

• Cascading and oversimple (CAO): A misbehaving node cannot send malicious information at all times due to selfishness reasons. Therefore, depending on circumstance in the network, having said that a node cannot point out all the time a good or bad. Another issue of trust management is based on the voting system. The voting threshold value is not reached due to a constantly changing topology. Another problem in trust management is cascading (where nodes influence other nodes in decision-making). The cascading is solved through a mechanism where more weight-age is given to a node that is closer to event location from nodes which are away from the event location but till there are loopholes. If the nodes are at same distance from event propagating different opinions about same event, then the proposed scheme does not work properly [86].

• RMS: The misbehaviour detection scheme is based on reputation management system (RMS). The RMS has three components: misbehaviour detection, event rebroadcast, and global eviction and filtration of false information. Each node maintains event information and a corresponding action for detecting misbehaving nodes. The detection scheme uses a risk value of bad node to calculate risk level. The event reporter’s sense event creates alert and sends it to their neighbours. If an event observer within one hop of reporter can observe the behaviour of reporter, vehicles beyond one hop of reporter participate and can forward the alert but cannot detect behaviour of reporter [87].

The purpose of this article is to provide an overview of current cooperative-based malicious information detection schemes in VANETs. The detection of malicious event information is very important for road safety and human lives. This article has categorized data centric misbehaviour detection schemes based on their tendency for malicious information.

Local-based detection schemes rely on available information from a single source. Although it is efficient in term time for detection due to not having any dependance on other nodes, there is another well-known parameter for fake data detection that means delay and is experienced in the network due to VANET characteristics. The delay has various parameters in Table 1. A scheme with low delay is considered to be fast and vice versa [88]. All mechanisms in Table 1 efficiently detect location of nodes. However, lack of sufficient information from single node cannot provide accurate result for malicious information detection [7, 62]. The schemes in [7, 62] are also vulnerable to weak signal strength in detection area.

However, local base detection can produce good result in low density like [7, 62]. In [63, 64], observing behaviour of node after transmission of safety message. The main drawback of these schemes is they assume valid position information at detection time. A malicious node can provide consistent and plausible data to reduce the effectiveness of local-based schemes as in Table 1. The accuracy of the schemes is measured in terms of overhead and false positive rate in worst scenarios. In worst scenarios, there are more malicious vehicles that propagate false messages. The exchange of extra data with vehicles is known as communication overhead. To incorrectly classify honest nodes as malicious is false positive. The schemes having low overhead and minimum false positive rates are normally considered better false data detection schemes [73] (see Tables 1 and 2)

The cooperative-based detection schemes have more effectiveness than local-based detection. The neighbour vehicles provide evidence for malicious behaviour. These schemes provide low false positive rate than local-based detection schemes. They accurately detect Sybil attacks. Cooperative detection scheme creates more overhead and computation rather than local detection schemes. The malicious information detection requires minimum latency as shown in Table 2. The [66, 70] maintain database for malicious information detection on single node. A high density network cannot maintain database on one node. The main drawback of these schemes are when malicious nodes increase than honest nodes which creates a false result [3]. In VANETs, low density of vehicles also decreases the performance of cooperative detection schemes [9, 65, 68] as shown in Table 2.

VANETs is an ephemeral kind of network where connection between nodes is very short time [86]. Therefore, VANETs are vulnerable to different security attacks [89]. To constitute trust system is a difficult task [90]. A misbehaviour node may not be malicious all the time but due to selfishness.

The reasons depend on multiple circumstances in the network. A simple trust model is needed to be constructed for fast data evaluation in VANETs [91]. In [92], trust management system for malicious information detection needs high trust nodes and RSUs. The RSUs already has an overhead due to other responsibilities. Another issue is trust management on voting systems. The threshold value does not reach due to the constantly changing topology. In trust management system, faulty or malicious nodes can share false trust information. The single identity of vehicle create problems for privacy. The user can easily trace or compromise their personal details. That is a resaon that a set of names are assigned to a vehicle called pseudonyms. The actual identity is only known to CA who provides pseudonyms [7]. Therefore, pseudonyms are changing after certain time period depending on the mechanism. The trust-related data is removed due to privacy issues. For these reasons, VANETs may be needed as a trade-off between privacy and trust management system [93]. In indirect trust management system, a malicious node can provide bad reputation value for honest node. The majority of vehicle must be honest for false information detection. The trust value is assigned based on their past history of communication, but unpredictable behaviour of vehicle sometimes falsifies their past history.

The following prerequisites are required while designing an efficient trust model for MDS in VANETs [94] as shown in Table 3.

• Decentralization: VANETs are dynamic and distributed networks. Therefore, a decentralized trust management system is required for reliable data communication. The trust models use one to one or one to many interactions while trust-building in a decentralize manners [28]. Some strong authentications are prerequisite for nodes before establishing a decentralized trust management system in VANETs.

  Full size table

• Data scarcity: VANETs have dynamic and distributed type of network where interaction between same nodes in future is almost impossible. Due to short network life, the data received at first time is important for trust-building.

• Network scalability: Scalability is considered as an important factor for trust management. The density of nodes are more, and few of them interact and send information in the network. The observer need to quickly decide about the incoming information. The trust information may be updated a little bit according to the network size. For a good trust management, trade-off between scalability and trust mechanisms are required. In efficient trust management, priorities are given to nodes that are frequently interacting.

• Metric: In trust management, different types of metrics are used for dynamic trust establishment. The metrics for trust management system include post-crash notification (PCN), congestion and weather condition beacons [95, 96]. In [97], trust management system is based on behaviour analysis of neighbour nodes to assign trustworthiness value which is additionally disseminated in network. The priorities are given to event reporters that are relatively close to event location [86] or close in terms of time.

• Confidence: In order to remove uncertainty for event, trust management requires reliability and confidence in the VANETs. A trust management assigns high trust value to nodes that report same event [98–100].

• Security: Trust management system requires strong security credential to authenticate sender that reports safety information in VANETs [101]. Normally, PKI is used to verify reporter authenticity in VANETs [102].

• Privacy: In VANETs, decentralized trust management is dependent on strong authentication for vehicles while using single key create security concern to vehicle owners. Therefore, using multiple keys reduce privacy issues in network [103]. To protect location privacy in VANETs, many pseudonym changing techniques have been proposed to achieve pseudonym changing [104]. In Table 3, most of trust management schemes have not provided good privacy.

• Robustness: Trust management system itself faces challenges of Sybil attack, new comer attack, betrayal attack (trusted node suddenly started misbehaviour) and bad mouthing attack (some nodes provide low reputation intentionally). A robustness trust mechanism is needed to tackle these kinds of attackers as well.

  VANETs require a quickly responsive detection mechanism for malicious information detection. New trust management system is necessary that uses current parameters in different scenarios for VANETs. The focus is needed on alert messages rather than nodes. In VANETs, trust management system should have minimum information (data scarcity), strong authentication and privacy and must be decentralized and scalable.

In VANETs, vehicle communication takes place with each other and RSUs. VANETs have different kinds of applications for health, safety and traffic efficiency. A malicious node can broadcast bogus messages, which can change the behaviour of other nodes. Therefore, detection of malicious information is an important factor to be investigated. This article has categorised existing detection mechanisms in cooperative data detection, local-based detection and trust-based detection techniques. Cooperative-based detection schemes are efficient in the case of dense network and greater number of honest nodes. Trust-based detection schemes showed good performance when the frequency of interaction among nodes was high. Trust-based schemes depend on past interaction information among the nodes for better malicious information detection. However, trust management system and local-based detection for malicious information detection has its own challenges due to VANET characteristics. The existing detection mechanisms cannot provide good and up to the mark performance due to various challenges. Therefore, VANETs require such detection techniques that should provide data scarcity and have minimum delay time.

Local node information-based detection techniques depend on available information from a single node. They are efficient in terms of time because they do not rely on other nodes while detecting bogus messages. The lack of sufficient information from single node does not provide accurate result for malicious information detection. These schemes need more information from single node to enhance their performance.

The cooperative techniques create more delay and overhead while detecting malicious data as compared to local-based detection in VANETs. If a number of malicious nodes increases than honest in VANETs, then it creates false result for malicious data detection. Low density of vehicles in VANETs reduce effectiveness of these techniques as well.

CAs:

Certificate authorities

OBUs:

On-board units

RSUs:

Roadside units

RHN:

Road hazard notification

VANET:

Vehicular ad hoc network

We thank Mr. Waqar Khalid for his valuable inputs in the revised form of this paper.

Funding

This research work is funded by authors themselves.

Affiliations

1. Department of Computer Science, Institute of Management Sciences, Peshawar, Pakistan
   • Muhammad Arshad
   •  & Zahid Ullah
2. Department of Computer Science, University of Peshawar, Peshawar, Pakistan
   • Naveed Ahmad
3. Department of Computer & Information Sciences, Northumbria University, Newcastle upon Tyne, NE1 8ST, UK
   • Muhammad Khalid
   •  & Yue Cao
4. Institute for Communication Systems, University of Surrey, Surrey, GU2 7XH, UK
   • Haithiam Criuckshank

Contributions

All authors have contributed jointly to all parts throughout the preparation of this manuscript, and all authors has read and approved the final manuscript.

Corresponding author

Correspondence to Yue Cao.

Competing interests

The authors declare that they have no competing interests.

Publisher’s Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Reprints and Permissions