VECLLF: A vehicle-edge collaborative lifelong learning framework for anomaly detection in VANETs

Abstract

With the rapid development of intelligent connected vehicles, Vehicular Ad Hoc Network (VANET) is widely used in intelligent transportation systems. VANETs are vulnerable to attacks in their operating environments, such as denial of service (DoS) attacks and injection attacks. Thus, the development of an efficient anomaly detection framework is a promising solution. Most existing methods can only detect known attacks, are less efficient in detecting unknown attacks, and fail to deal with them. To solve these problems, the lifelong learning framework (LLF) is introduced, which aims to store and label suspicious data by applying blockchain and then retrain the model. However, existing LLFs are overly idealized as they do not adequately consider the key issues of label budget and storage space. To improve the practicality of existing methods, this paper proposes a novel LLF based on the existing LLF, called Vehicle Edge Collaborative Lifelong Learning Framework (VECLLF), which can deploy the model update task on the edge server. Specifically, the proposed anomaly detection module based on ensemble active learning is used to achieve high-performance detection under a limited label budget, the proposed incremental learning module based on a sample library continuously learns the model by replaying representative samples within limited storage space, the proposed optimization-based feature selection module is used to remove redundant and interfering features, and the explainable artificial intelligence (XAI) module is used to explain the model to ensure its interpretability. In addition, the blockchain-based database (BC-DB) module is used to help store suspicious data and interact with security agencies to label it. We conducted experiments on two public datasets, AWID2 and CICIDS2017, and the results show that VECLLF outperforms state-of-the-art anomaly detection models and existing LLF, with F1-scores exceeding 97% on both datasets. Furthermore, we collect data from the Network Simulator 3 (NS-3) simulation environment and conduct experiments to evaluate the effectiveness of VECLLF in real-world scenarios.