Graph neural network approaches and real-time unsupervised learning for anomaly detection in vehicular networks

The growing number of vehicles on modern roads has intensified challenges such as congestion, collisions, and fatalities, with abnormal driving behaviors, reckless, fatigued, or impaired, remaining leading causes. Vehicular networks, as a core component of intelligent transportation systems (ITS), enable real-time vehicle–infrastructure communication through Cooperative Awareness Messages (CAMs), offering opportunities to detect anomalies in both driving behavior and communication patterns.This dissertation proposes a dual-layer anomaly detection framework targeting: (1) unsafe driving behavior, and (2) Denial-of-Service (DoS) attacks in vehicular networks. For behavioral anomaly detection, spatial–temporal vehicle interactions are modeled as dynamic graphs and evaluated using six Graph Neural Network (GNN) architectures: Graph Convolutional Network (GCN), Graph Attention Network (GAT), GraphSAGE, Temporal GCN (T-GCN), Gated Convolutional LSTM (GConvLSTM), and Gated Convolutional GRU (GConvGRU). The GConvLSTM and GConvGRU models achieved the highest precision, recall, and F1-scores, with GraphSAGE and GAT providing competitive performance. To mitigate class imbalance, the Synthetic Minority Over-sampling Technique (SMOTE) improved recall, particularly for GCN and T-GCN. Performance was further enhanced by edge weight learning, which adaptively emphasized critical inter-vehicle relationships, and supervised triplet loss, which improved class separability. For communication-layer anomaly detection, a real-time, unsupervised framework was developed using a modified Online K-Means clustering algorithm integrated with outlier detection methods (One-Class SVM, Local Outlier Factor, Isolation Forest, and Elliptic Envelope). The proposed approach incorporates centroid repulsion, dynamic buffer normalization, and outlier-score-based thresholding, enabling adaptive detection without labeled data. Experiments on seven large-scale vehicular datasets generated with VSimRTI demonstrated that the modified Online K-Means, especially with One-Class SVM, consistently outperformed conventional clustering approaches in accuracy, adaptability, and efficiency. By addressing both behavioral and communication threats, this work advances the development of secure and resilient vehicular networks. The framework’s combination of interpretable GNN-based modeling and scalable online clustering contributes toward safer, more reliable connected and autonomous transportation systems.

Name thesis:degree_name

Ph.D. (Doctor of Philosophy)

Level thesis:degree_level

Doctoral

Discipline thesis:degree_discipline

Computer Science (UMKC)

Grantor

University of Missouri--Kansas City

Year dc:date.issued

2025

Author dc:creator

• Razzazi, Harir

Advisor dc:contributor.advisor

• Nait-Abdesselam, Farid

Language dc:language.iso

en_US

Handle dc:identifier.uri

https://hdl.handle.net/10355/112257

OAI identifier oai:identifier

oai:mospace.umsystem.edu:10355/112257