Optimized stacked ensemble approach for detecting position falsification in VANETs

Abstract

The road safety and traffic efficiency is enhanced by providing communication between Vehicles in Vehicle Ad hoc networks (VANETs). Position falsification attacks represent a significant threat in VANETs, where the accuracy and integrity of location-based information are critical for safe and efficient transportation. The misbehavior detection frameworks can effectively identify position falsification attacks. The frameworks employ machine learning classifiers trained on features derived from inter-vehicular communication data. Optimization can enhance a stacked ensemble model for misbehaviour detection by hyperparameter tuning of classifiers. The proposed methodology involves constructing a stacked ensemble model composed of five diverse base classifiers, such as K Nearest Neighbours Classifier (KNN), Ada Boost Classifier (ADA), Extra Trees Classifier (ETC), Random Forest (RF), and Extreme Gradient Boosting Classifier (XGBC). Meta Classifier is used to combine predictions from the individual classifiers with logistic regression. To achieve the highest accuracy, Artificial Bee Colony (ABC) optimization is used to enhance the hyperparameters for the base classifiers. The optimized stacked ensemble model shows that our model provides the best results when compared with the existing methods.

Introduction

Intelligent Transport Systems is an advanced technology that can enable efficient wireless communication to improve road safety. Moving nodes are connected to the network by an on-board unit mounted on the vehicle. The unit allows for vehicle-to-vehicle communication. There are also roadside units that help the vehicles to communicate with infrastructure¹. Vehicles become possible targets for malicious people because these networks allow them to exchange information with infrastructure and with one another.

Network communication between vehicles, pedestrians, and the network infrastructure is made possible via VANET. VANETs can be classified into the following types of communication², which are depicted in Fig. 1. Data transmission between two vehicles can be done without the need for any infrastructure, and is known as vehicle-to-vehicle communication. Communication between different infrastructures and vehicles is referred to as vehicle-to-infrastructure, infrastructure-to-vehicle, and vehicle-to-RSU. In order to exchange critical information and real-time traffic updates, network infrastructures must communicate with one another through infrastructure-to-infrastructure communication³. Reliability and Safety are ensured by detecting and mitigating these attacks in VANET.

Fig. 1.

Types of VANET communication.

Misbehaviour detection in VANET while using the VeReMi Dataset can be categorized into 3 types: position falsification detection, speed manipulation detection, and message replay detection. Position falsification detection is used to identify the vehicles that report fake or altered GPS positions, which can disrupt traffic flow or cause safety hazards⁴. Speed manipulation detection is used to detect a vehicle that reports incorrect speed values to influence traffic reports. Message replay detection is used to identify a vehicle sending previously captured valid messages repeatedly to confuse or flood the network.

The accuracy can be compared with RF, LR, KNN, NB, and SVM models using the VeReMi dataset, experimenting with voting and stacking to increase accuracy. The overall performance of the method is improved by combining multiple models. However, detection performance was notably lower for some types of attacks⁵. Hyperparameter optimization has a direct impact on model performance, generalization, and reliability; it is essential for machine learning (ML) models. Hyperparameters are manually set and regulate the model’s learning process, in contrast to model parameters, which are learned from data.

The key contribution of the proposed method is:

• A stacked ensemble–based misbehaviour detection model is developed using five heterogeneous base classifiers to improve robustness in VANET environments.

• Logistic Regression is employed as a meta-classifier to effectively fuse the predictions of individual learners through stacked generalization.

• Artificial Bee Colony optimization is applied for hyperparameter tuning, leading to enhanced detection accuracy compared with non-optimized approaches.

The proposed system is organized as follows. Section II describes the related works; Section III presents position falsification detection using the Optimized Stacked Ensemble Approach along with a block diagram and Pseudocode. Section IV discusses the results, and the paper is concluded in Section V.

Related works

ML methods⁶, such as RF and KNN, are used by utilizing a set of features to determine whether a vehicle is behaving maliciously. While the approach successfully introduces a detection mechanism, it lacks a built-in response system. The detection process operates in a centralized manner and must be integrated with the mobility model to enable appropriate action once an attacker is identified. The method uses two consecutive BSMs⁷ from the same vehicle to enhance the dataset and trains various ML models. Among them, KNN and Random Forest showed superior performance.

Results surpassed previous approaches in precision and recall across all five VeReMi attack types. Future work focuses on deep learning to detect both known and novel misbehavior beyond location-based falsification. The ML-based approach⁸ used the novel sender position-related information to improve position falsification attacks detection. The performance is compared with kNN and Random Forest classifiers by verifying their effectiveness in identifying malicious vehicles. An Ensemble Learning strategy combining both models is also evaluated for enhanced performance. The approach focuses exclusively on detection and does not propose any response mechanism for vehicles.

The energy-efficient distribution⁹ of green vehicular transportation in the face of growing urbanization and vehicle density. Severe traffic congestion and an increase in CO2 emissions are caused by the mismatch between the infrastructure that is available and the demand for transportation. With an average efficiency of 3.82%, the suggested 2M2C-R2ED model enhances route identification and segregation using IWS. Even with the amount of research that has been done on traffic prediction, obtaining high accuracy is still a major open challenge.

A travel distance feature¹⁰ and a two-stage detection approach to detect the different position falsification attacks such as Constant Offset Attack (COA), Random Attack (RA), Random Offset Attack (ROA), and Eventual Stop Attack (ESA) by using the machine learning models such as K Nearest Neighbour, Decision Tree, and Random Forest models. A Random Forest and Cat Boost with Logistic Regression as a meta-classifier¹¹, enhanced by SHAP (SHapley Additive exPlanations) analysis for feature interpretability. Using the VeReMi dataset, the model achieved higher classification accuracy and reduced misclassifications.

The proposed machine learning-based approach¹² for detecting position falsification attacks using features derived from Basic Safety Messages. It used a Random Forest with the FV2 feature set, which achieved superior performance by improving accuracy and F1-score across multiple attack types. The approach enhances misbehaviour detection reliability in VANETs, supporting safer and more trustworthy vehicular communications in both DSRC and emerging C-V2X environments.

To detect the position falsification attacks¹³ in VANETs using an ensemble-based framework using RF, KNN, and MLP classifiers with bagging for VeReMi Dataset. The continuous BSMs are analyzed to achieve better performance and maintains high accuracy. The method provides an effective ensemble technique for secure vehicle communications by providing scalability and robust solution. The KNN, SVM, Naive bayes, LR, and RF¹⁴ was evaluated using VeReMi dataset for detecting position falsification attacks to evaluate the performance. Then it compares ensemble techniques such as voting and stacking to improve decision-making by combining multiple classifiers. The results demonstrate that ensemble models enhance classification performance by leveraging the complementary strengths of individual algorithms.

Optimized stacked ensemble approach

The machine learning models are used to identify whether the communications between the vehicles is either normal or misbehaving and then classify attacker types based on the contents of their messages. By analysing the frequent communication between the vehicles, it can easily detect the position falsification attacks. The following section describes the process using an approach that integrates ABC optimization with a stacked ensemble of machine learning models. The framework of the proposed system (Fig. 2) is explained below. The approach involves the following steps:

Fig. 2.

Framework of proposed system.

Data preprocessing

The VeReMi dataset¹⁵, which contains data on both normal and misbehaving vehicular behaviour. Data pre-processing is essential to prepare the dataset for hyperparameter tuning and model training. The VeReMi dataset is pre-processed by the Normalization method.

To ensure each parameter contributes equally to the model, the dataset is to be normalized¹⁵ .

1

where X is a feature vector, and is the min and max of that feature across all training data and is a normalized value. The original dataset is split into two types, such as training and testing sets, to improve the performance.

Hyperparameter tuning using ABC optimization

The misbehavior detection models must process large volumes of vehicular communication data generated in dynamic traffic environments. The Artificial Bee Colony Algorithm was selected for the proposed framework because it provides efficient optimization with stable convergence and lower computational overhead when compared with algorithms such as Genetic Algorithm (GA), Particle Swarm Optimization (PSO), Grey Wolf Optimizer (GWO), and Whale Optimization Algorithm (WOA). The adaptive exploration mechanism of the Artificial Bee Colony algorithm enables efficient search in high-dimensional feature spaces while maintaining scalability, making it suitable for optimizing feature selection and classifier parameters in VANET misbehavior detection systems^16,17. As shown in Table 1, the Artificial Bee Colony algorithm provides a balance between convergence stability, scalability, and optimization performance. These characteristics make it suitable for optimizing the stacked ensemble model used for misbehavior detection in large-scale VANET datasets.

Table 1.

Comparison of optimization algorithms in machine learning optimization tasks.

Optimization algorithm	Population update mechanism	Convergence speed	Scalability	Typical accuracy improvement in ML optimization
GA	Evolutionary operators: selection, crossover, mutation	Moderate	Moderate scalability due to expensive genetic operations	~ 2–4% improvement
PSO	Particle velocity and position updates guided by local/global best	Fast initial convergence	Good scalability but may stagnate in high-dimensional problems	~ 3–5% improvement
GWO	Hierarchical hunting strategy (alpha, beta, delta wolves)	Fast and stable convergence	High scalability for large search spaces	~ 4–6% improvement
WOA	Spiral bubble-net hunting and encircling prey mechanism	Moderate–Fast convergence	Good scalability but may slow in very high dimensions	~ 3–5% improvement
ABC	Employed, onlooker, and scout bee search phases	Stable convergence	Very good scalability due to adaptive exploration	~ 5–7% improvement

The foraging habits of honeybees serve as an inspiration for ABC optimization. The goal is to optimize a hyper parameter subset that maximizes the classifier’s performance. During the initialization stage, vehicle nodes, referred to as food sources (FS), are randomly deployed in the network for a specific application. The first step in initializing the ABC algorithm’s parameters is to define the following: SN, which stands for the quantity of food sources or potential fixes.

Let a food source be a hyperparameter vector¹⁸ :

2

where is the Learning rate, is the Number of trees, is the Maximum depth of tree and is the regularization strength.

After initialization, the system progresses through the bee updating stages: employee bee, onlooker bee, and scout bee, repeating the process until the specified conditions are met¹⁸.

In Hyperparameter Subsets, each food source is randomly produced within the constraints of the challenge¹⁸.

3

where is the value of the jth parameter in the ith solution (food source), and is the minimum and maximum value allowed for parameter j and a uniformly distributed random number in [0,1].

Fitness Function is used to evaluate the quality of each hyperparameter subset based on the classification accuracy of a selected base classifier¹⁹.

4

where ) and ) is the accuracy achieved by the classifier using hyper parameter subset X.

Employed Bee Phase: In the context of a classification method, the employee bee searches for a new candidate solution or position within the hyperparameter space. It evaluates a neighbouring position, representing a potential new classification model or set of parameters. For each iteration, the employee bee computes the nectar amount of the neighbouring solution, which corresponds to the classification accuracy or performance metric. If the performance of the new neighbour exceeds that of the current solution, the employee bee moves to the new position. Otherwise, it continues with the current one. Onlooker Bee Phase: In the classification method, the onlooker bee selects a candidate solution based on the fitness value, where solutions with higher accuracy. The onlooker bee facilitates local search by dynamically adjusting the search space around promising solutions¹⁸. The structural representation is explained in Fig. 3.

Fig. 3.

Structural representation of the proposed method.

The evaluation probability for selecting a candidate model is given by²⁰ :

5

where FS represents the set of candidate models, ​is the probability of selecting model i, based on its fitness value fit(X).

The fitness value of each model is calculated, which defines the search radius and impact length. The update for the candidate solution is expressed as²⁰ :

6

where randD is a uniformly distributed random number, Exrad is the exploration radius, and Lim is the length of impact. These are calculated as follows²⁰ :

7

The search radius Exrad is updated with each iteration to control exploration as²¹ :

8

The impact length Lim is computed as²¹:

9

where t is a threshold that adjusts dynamically from higher to lower values, allowing the onlooker bee to explore the search space globally and in an optimal manner. The onlooker bee thus refines the selection of models by narrowing down to regions with higher classification performance.

Scout Bee Phase: In this stage, if a classification model’s performance exceeds a threshold after several iterations, the model is replaced. The scout bee resets, randomly explores new candidate models, and then returns to the employee bee role with a reset count. The optimal classification model is selected based on fitness, and poor models are replaced by better ones. The Cauchy operator facilitates global exploration to prevent getting trapped in local optima. It is defined as²² :

10

where follows a Cauchy distribution, helping expand the search space for better classification models. The process continues for a set number of iterations, or until it stops improving.

Base Classifier Training: After selecting the optimal model parameters using Artificial Bee Colony optimization, the base classifiers are trained. Random Forest method is employing multiple decision trees, each trained on a special data subset²³ .

11

where T is the total number of trees, and is the prediction from the tree. Extra Tree Classifier is used to increase the accuracy by using random splits in the data. For each node, the split is selected randomly from the model parameters values for random splitting²³.

12

where j is a model parameter, θ is a threshold, and is the Gini Impurity or another criterion. Predictions are aggregated similar to RF²⁴,

13

K Nearest Neignbors classification assigns each sample to the class most common among its k nearest neighbors in the model parameters space²⁵.

14

Yi is the class of the i-th nearest neighbour, and c is a class label and the distance between x and each training point xi²⁵:

15

Extreme Gradient Boosting Classifier uses gradient boosting method to minimize the loss function by adding decision trees sequentially²⁶.

16

The number of increasing rounds is M, the weight for the m-th tree is γm; and the m-th tree’s prediction is . Ada Boost Classifier algorithm, Boosts the performance of weak classifiers by focusing on samples that were misclassified in previous rounds²⁶.

17

where is the weight of the m-th classifier, ​ is the error of the m-th classifier, and is the prediction of the m-th classifier.

AdaBoost Classifier (ADA) combines weak classifiers iteratively to create a strong classifier. Each weak classifier h_t (x) is weighted based on its accuracy²⁷.

18

Meta-classifier (logistic regression (LR))

Logistic Regression is commonly used as the meta-classifier because it learns the optimal weights for each base classifier’s prediction, allowing the ensemble to emphasize more reliable models while reducing the influence of weaker ones. Logistic regression is one of the most widely adopted meta-learners in stacking ensembles, particularly in classification tasks and imbalanced datasets. The popularity is due to its capability to efficiently combine heterogeneous classifiers and produce robust predictions with low computational complexity²⁸.

The outputs from base classifiers are combined into a meta-feature vector as a stacking input:

19

The prediction function of the meta classifier (LR) is described below,

20

The Expansion of the prediction function is,

21

Sigmoid Function

22

Logistic Regression for Meta-Classification applies Logistic Regression on the aggregated predictions P. The meta-classifier is trained to minimize the log-loss²⁸:

23

Final Prediction

24

The base classifiers independently estimate class probabilities using diverse learning mechanisms such as bagging (RF, ETC), instance-based learning (KNN), and boosting (XGBoost, AdaBoost). These outputs are transformed into a meta-feature space and fed into a Logistic Regression meta-classifier, which learns optimal weights through cross-entropy minimization. The formulation enables the stacked ensemble to effectively integrate heterogeneous model predictions and improve detection performance in VANET misbehavior scenarios.

The ABC optimization technique is employed to fine-tune hyperparameters for each base classifier, as described in Algorithm 1. It simulates the intelligent foraging behaviour of honeybee swarms to search the solution space efficiently. It begins by initializing a population of food sources, each representing a possible configuration of the model.

Algorithm 1.

ABC Optimization for Base Classifier Hyperparameters

Employed bees search the vicinity of their current solutions for better alternatives, whereas onlooker bees choose food sources based on a probability that reflects their fitness. If a solution does not improve after several trials, scout bees abandon it and introduce a new randomly generated solution. The objective function here is typically the classification accuracy on a validation set, and the algorithm iteratively updates hyperparameters to converge on the most effective combination for each classifier. Algorithm 2 employs a stacked ensemble learning approach using the ABC algorithm to detect the position falsification attack. Initially, five base classifiers such as RF, ETC, KNN, XGBC, and ADA are individually trained on the input training data using their respective ABC-optimized hyperparameters. These trained models generate prediction outputs that are combined to form a new stacked feature matrix, which serves as input to a Logistic Regression meta-classifier.

During prediction, the same base classifiers produce outputs on the test data, which are stacked and passed to the meta-classifier to produce the final predicted labels. Then, the evaluation metrics like accuracy, precision, recall, F1-score, and AUC-ROC (Receiver Operating Characteristic − Area Under Curve) is used to compare model’s predictions.

Algorithm 2.

Train and Evaluate ABC-Optimized Stacked Ensemble Model

Computational complexity

For the Artificial Bee Colony (ABC) algorithm, the computational cost mainly depends on the number of food sources (solutions), iterations, and fitness evaluations^29–31. It is expressed as:

25

where SN is the Number of food sources and I is the Number of iterations, is the cost of fitness evaluation (i.e., training and validating the classifier in the VANET context).

In VANET-based misbehavior detection, dominates the complexity since it involves training ML models on vehicular data. If the dataset size is n and the feature dimension is d, then:

26

Thus, overall complexity becomes:

27

It indicates that complexity scales linearly with dataset size, feature space, and optimization cycles.

Space complexity

The space requirement of ABC is primarily due to storing food sources and associated parameters:

O(NS× D) 28

where NS is the number of solutions and D is the number of hyperparameters (dimension of search space).

In VANET applications, additional memory is required for dataset storage:

O(n× d) 29

Thus, total space complexity:

30

ABC in VANET environments exhibits linear scalability with respect to population size, iterations, and dataset dimensions. While computational cost is influenced by repeated model evaluations, space requirements remain moderate, making ABC suitable for offline optimization in large-scale vehicular networks.

Results and discussion

Dataset description

VeReMi is the first publicly available and extensible dataset³², generated using the Luxembourg SUMO Traffic (LuST) scenario through a VEINS-based co-simulation environment. Simulation of Urban Mobility (SUMO) models realistic vehicle mobility (e.g., position, speed, and traffic dynamics), while OMNeT +  + handles vehicular communication aspects such as message exchange, delay, and packet loss. VEINS links the two simulators, allowing them to work together in real-time. The setup lets the mobility and communication layers interact, which is key for creating realistic scenarios. The dataset is further enhanced using the F2MD framework, which supports the simulation and evaluation of diverse misbehaviour detection scenarios.

Each simulation was executed with varying traffic densities to emulate realistic vehicular environments. Three density levels were analyzed, namely low, medium, and high traffic conditions. In the low-density scenario, the number of vehicles ranged between 35 and 39, generating up to 1,144 Basic Safety Message (BSM) records. The medium-density configuration included approximately 97 to 108 vehicles, producing nearly 4,489 BSM records. For the high-density environment, the number of vehicles varied from 491 to 519, resulting in a significantly larger dataset with up to 21,878 BSM records. The dataset contains multiple communication-related features extracted from vehicle beacon messages, including receiving time, transmission time, sender identifier, message identifier, RSSI value, position coordinates (x, y, z), speed components (x, y, z), as well as position and speed noise vectors. To simulate malicious behavior in the vehicular network, different attacker densities were introduced, where 10%, 20%, and 30% of the vehicles were configured as attackers in each scenario³¹.

The dataset contains 22,165,610 samples with 21 features, which after preprocessing were divided into 17,732,488 training samples (20 features) and 4,433,122 testing samples (20 features) using a stratified split to preserve the original class distribution across the 19 attack categories. Since the class frequencies range from 1,143,918 to 1,246,576 instances, the minority classes were balanced only in the training set using the Synthetic Minority Oversampling Technique (SMOTE) to prevent information leakage. SMOTE generates synthetic samples between nearest-neighbour instances of minority classes, increasing classes such as ConstPos, RandomPos, and EventualStop (~ 1,143,918 samples) toward the majority class GridSybil (1,246,576 samples). The balancing strategy improves the representation of less frequent attack behaviors while maintaining the original distribution in the test data for unbiased evaluation. Consequently, the classifiers in the stacked ensemble model are trained on a more balanced dataset, enabling better detection performance across all 19 misbehavior categories. The VeReMi Dataset contains vehicular communication attributes including rcvTime, senderID, receiverID, msgType, vehicleType, and attackerType, which describe the message transmission details and node identity in the network. It also provides spatial position information through pos_x, pos_y, and pos_z, representing the vehicle’s coordinates within the simulated road environment. In addition, motion-related parameters such as spd_x, spd_y, spd_z, heading, and acceleration capture the dynamic movement behavior of vehicles, enabling the analysis and detection of abnormal or falsified position reports in vehicular ad hoc networks.

The dataset contains several types of data collected from vehicular communication, including both benign and attack data. The dataset’s class categories are organized into three groups: Normal, Fault, and Attack. In that each group represents a specific type of vehicle behaviour, along with the total number of sequences for each type. The Normal group contains a single class (Type 0), which represents standard, correct vehicle behaviour without any errors or harmful actions³². The Fault category, which includes Types 1 through 8, captures unintentional yet erroneous behaviors that typically arise from issues like sensor failures or GPS inaccuracies. In contrast, the Attack category (Types 9 to 17) involves deliberate actions meant to compromise the integrity of the network, deceive participants, or degrade overall performance. Together, these categories provide a comprehensive basis for simulating both inadvertent faults and deliberate attacks, supporting the design and evaluation of effective misbehavior detection systems in VANETs.

The proposed stacked ensemble model was determined using the ABC optimization algorithm to maximize classification accuracy using the optimized hyperparameters for each base classifier. The proposed stacked ensemble model was determined using the ABC optimization algorithm to maximize classification accuracy using the optimized hyperparameters for each base classifier.

Experimental setup and analysis of experimental results

The proposed environment is implemented in a cloud-based Google Colab environment using Python (Version 3.10). The environment is used because of its scalability and ability to handle large-scale vehicle datasets. The experiments are conducted using NumPy and Pandas libraries for data preprocessing and manipulation, Scikit-Learn Library for implementing the machine learning classifiers and evaluation metrics, and XGBoost library for gradient boost classification method. The System is equipped with 16 GB RAM and 64 bit windows operating systems.

A comparative summary of the baseline stacked ensemble (without optimization) versus the proposed ABC-optimized ensemble (with optimization) for all attack types is shown in Tables 2 and 3, and a performance evaluation summary in Table 4. In VANET, the Position falsification attacks are a major security concern, where vehicles exchange BSMs containing information such as position, speed, and direction to support road safety applications. The attack scenario, a malicious vehicle deliberately transmits incorrect geographic coordinates rather than the actual location, thereby misleading nearby vehicles and roadside infrastructure^33,34. Such manipulation results in false traffic conditions, inaccurate safety warnings, and increased risk in transportation environments due to unreliable situational awareness. Several forms of position falsification attacks are commonly discussed in the literature. A Constant Attack (CA) involves repeated transmission of a fixed false location value. A Constant Offset Attack (COA) involves reporting a location shifted from the real position by a consistent offset distance. A Random Attack (RA) involves continuous broadcasting of randomly generated position coordinates, resulting in irregular movement patterns. A Random Offset Attack (ROA) introduces variable offsets to legitimate position values so that the falsified coordinates appear partially plausible. An Eventual Stop Attack (ESA) begins with correct position reporting and later transmits a stationary location despite continued vehicle movement^35,36.

Table 2.

Performances of the proposed mechanism without ABC optimization.

Metrics/classifier		Accuracy	Precision	Recall	F1-Score
Base classifiers	KNN	0.79	0.77	0.81	0.79
	ADA	0.85	0.84	0.86	0.85
	ETC	0.83	0.82	0.84	0.83
	RF	0.82	0.81	0.83	0.82
	XGBC	0.88	0.86	0.89	0.88
Optimized stacked ensemble approach	Proposed	0.90	0.89	0.91	0.90

Table 3.

Performances of the proposed mechanism with ABC optimization.

Metrics/classifier		Accuracy	Precision	Recall	F1-Score
Base classifiers	KNN	0.85	0.84	0.82	0.83
	ADA	0.90	0.88	0.89	0.88
	ETC	0.89	0.88	0.87	0.87
	RF	0.88	0.87	0.85	0.86
	XGBC	0.93	0.92	0.91	0.91
Optimized stacked ensemble approach	Proposed	0.94	0.93	0.92	0.93

Table 4.

Average performance comparison before and after ABC optimization.

Metric	Without optimization (baseline)	With ABC optimization	Absolute improvement	Relative improvement (%)
Accuracy	0.90	0.94	+ 0.04	+ 4.44%
Precision	0.89	0.93	+ 0.05	+ 5.68%
Recall	0.91	0.92	+ 0.01	+ 1.10%
F1-Score	0.90	0.93	+ 0.03	+ 3.33%

The ABC-optimized model achieved a consistent 5% improvement across key evaluation metrics. The enhancement validates the ABC algorithm’s capacity to identify optimal hyperparameter configurations. The Table 5 shows the training time (in seconds) for each classifier. Among base classifiers, KNN has the fastest training time (4.5 s), while XGBoost is the slowest (19.3 s) due to its complexity.

Table 5.

Computational training time of individual classifiers and the proposed ensemble model.

Metrics/classifier		Time (s)
Base classifiers	KNN	4.5
	ADA	6.4
	ETC	13.8
	RF	15.6
	XGBC	19.3
Optimized stacked ensemble approach	Proposed	17.6

The optimized stacked ensemble model takes 17.6 s, which can be compared with the other models. The combined performance comparison graph Fig. 4, illustrates the effectiveness of optimization across various base classifiers RF, ETC, KNN, XGBC, ADA, and the proposed stacked model, based on the evaluation metric accuracy. The plots clearly show that optimization consistently improves performance.

Fig. 4.

Comparison graph for the accuracy of optimization across various classifiers.

The proposed optimized stacked model achieves the highest scores, which is compared to the remaining classifiers, indicating its superior ability to detect attacks in VANETs. The performance of six base classifiers’ ROC diagram (Fig. 5) based on their AUROC values and F1 Score Before and After Optimization with % Improvement (Fig. 6). The figure shows how optimization improves the F1-scores of different classifiers used for intrusion detection. After applying optimization techniques, all models show better performance. The Random Forest model increased its F1-score from 0.82 to 0.86, and the Extra Trees Classifier showed the highest improvement, rising from 0.83 to 0.87 (a 5.4% gain). K-Nearest Neighbours also improved by 5.1%, from 0.79 to 0.83. Similarly, XGBoost moved from 0.87 to 0.91, while AdaBoost improved from 0.85 to 0.88. The proposed ensemble method recorded the best overall F1-score of 0.93 after optimization, up from 0.90. These findings convincingly indicate that optimization improves model accuracy for classifiers.

Fig. 5.

ROC Plot for various classifiers.

Fig. 6.

F1 Score with and without optimization with % Improvement.

The Artificial Bee Colony optimization with stacked ensemble of diverse machine learning models presents a robust and effective method in vehicular networks for detecting position falsification attacks, achieving superior performance metrics compared to traditional single-classifier approaches. The comparison with existing methods is analysed in Table 6 with metrics used in this method. A comparative analysis with machine learning-based methods has been added to demonstrate the proposed model achieves higher detection accuracy and lower false positive rates due to the integration of optimization and stacked ensemble techniques in Table 7.

Table 6.

Comparison with existing methods.

Paper	Accuracy	Precision	Recall	F1 Score
Bekan et al.13	0.88	0.80	0.75	0.79
Sharma et al. 7	0.91	0.81	0.75	0.74
Secil Ercan et al.6	0.86	0.85	0.78	0.91
Sonker et al.31	0.91	0.90	0.90	0.91
Secil Ercan et al.8	0.89	0.85	0.85	0.85
Optimized stacked ensemble approach	0.94	0.93	0.92	0.93

Table 7.

Performance comparison in terms of accuracy and false positive rate (FPR).

Paper	Accuracy	FPR
Venkatasamy et al.32	0.95	0.02
Borah et al.33	0.94	0.03
Wong et al.34	0.96	0.02
Proposed	0.94	0.01

The scalability of the proposed misbehaviour detection framework is evaluated using experiments with varying network sizes ranging from 50 to 500 vehicles. The results indicate that detection latency increases gradually from 32 to 95 ms as the number of vehicles increases due to higher message processing requirements. Meanwhile, the system throughput increases from 1582 vehicles/sec to 5283 vehicles/sec, as shown in the figure, demonstrating the ability of the proposed framework to process a larger volume of vehicular messages efficiently. The results confirm that the proposed model maintains stable performance even under dense VANET scenarios is explained in Fig. 7.

Fig. 7.

Performance scalability of the proposed model with respect to increasing vehicular density.

The Table 8 illustrates a comparison of accuracy based on various types of attacks for several methods used to detect position falsification, assessed with the VeReMi dataset across the categories of CA, COA, RA, ROA, and ESA. The suggested model demonstrates enhanced accuracy, achieving 0.94 for CA, COA, and ESA, as well as 0.93 for RA and ROA. These results reflect the superior effectiveness of the proposed approach in identifying different position falsification behaviours within VANET communication settings.

Table 8.

Comparative analysis of detection accuracy for various position falsification attacks.

Detection method	CA	COA	RA	ROA	ESA
Kunal Vermani et al.5	0.91	0.79	0.88	0.80	0.84
Secil Ercan et al.6	0.91	0.91	0.91	0.89	0.90
Ibrahim et al.10	0.92	0.90	0.89	0.88	0.89
Eslam et al.12	0.93	0.91	0.90	0.88	0.90
Proposed model	0.94	0.94	0.93	0.93	0.94

Ablation study

Ablation research was carried out in the suggested framework to assess the contribution of various components. At first, the accuracy of a single classifier (XGBoost) was 0.88. The performance increased to 0.89 when several classifiers were merged using majority vote, proving the value of ensemble learning. The accuracy was increased to 0.90 with the introduction of the stacking architecture. The performance greatly improved once the classifier hyperparameters were adjusted using Artificial Bee Colony (ABC) optimization. With an accuracy of 0.94, precision of 0.93, recall of 0.92, and F1-score of 0.93, the suggested ABC-optimized stacked ensemble model performed the best. These findings verify that ABC optimization and the stacking design both significantly enhance the detection of position falsification attacks.

The results in Table 9 shows that the proposed model combining Artificial Bee Colony Algorithm optimization with stacked ensemble learning achieves the highest accuracy across all attack types. Constant offset attacks are easier to detect due to their consistent positional deviation, whereas random attacks are more challenging because of unpredictable falsified positions. The integration of swarm-based optimization improves the performance of base classifiers, while stacking enhances robustness against noisy vehicular messages.

Table 9.

Attack-wise accuracy comparison of different model variants.

Model variant	CA	COA	RA	ROA	ESA
XGBoost	0.87	0.88	0.86	0.87	0.86
Majority voting ensemble	0.88	0.89	0.88	0.88	0.87
Stacked ensemble (without optimization)	0.90	0.91	0.89	0.90	0.90
ABC-optimized base models	0.92	0.93	0.91	0.92	0.91
Proposed model	0.94	0.95	0.93	0.94	0.93

The F1-score results further confirm that the proposed framework achieves the most balanced precision and recall across all attack types in Table 10. Compared with a single XGBoost classifier, the proposed method improves detection performance by approximately 6%, demonstrating that both ensemble learning and Artificial Bee Colony Algorithm-based optimization contribute significantly to improving the robustness and reliability of misbehavior detection in vehicular networks.

Table 10.

Attack-wise F1-score comparison of different detection models.

Model variant	CA	COA	RA	ROA	ESA
XGBoost	0.86	0.87	0.85	0.86	0.85
Majority voting ensemble	0.87	0.88	0.87	0.87	0.86
Stacked ensemble (without optimization)	0.89	0.90	0.88	0.89	0.88
ABC-optimized base models	0.91	0.92	0.90	0.91	0.90
Proposed model	0.93	0.94	0.92	0.93	0.92

Conclusion

To effectively detect the position falsification attacks using the VeReMi dataset, the proposed method uses a practical solution for enhancing security in vehicular networks. The ABC optimization algorithm is integrated with a stacked ensemble of machine learning models, which is used to improve the predictive accuracy, recall, precision, and F1-score. The ensemble model comprises the base classifiers such as RF, ETC, KNN, XGBC, and ADA, with Logistic Regression serving as the meta-classifier. Among the base classifiers, XGBoost and Random Forest demonstrated strong performance, but the stacking ensemble outperformed individual models in accuracy, recall, precision, and F1 Score. The AUC-ROC values confirmed that the ensemble approach reduced, making it highly effective for real-world applications. The method improves the security of vehicular networks against position falsification attacks. Real-world deployment faces challenges like dynamic network conditions, limited computing power in vehicles, differences from simulated data, and security risks. These are addressed using lightweight models, continuous learning, diverse real-world training data, and combining ML with rule-based methods for better reliability.

Practical implications

This model provides a viable and scalable solution for Intelligent Transport Systems and can increase the ability to accurately detect malicious vehicles while also improving the overall trust and security in the network.

Advantages

Higher detection accuracy due to the use of ensemble learning, increased reliability through collective learning and the ability to efficiently optimise the network using ABC makes the framework suitable for a wide range of different dynamic vehicular systems.

Limitations

The approach relies on a single meta-classifier and dataset-specific validation, which may limit generalizability across diverse real-world scenarios and large-scale deployments. The VeReMi dataset has limitations when it comes to using machine learning methods for detecting misbehavior in VANETs. These limitations include the usage of simulation-based data, a small number of attack types, and imbalanced classes. Each of these may have an impact on the capability of models to perform in real-life environments. The rapid change between vehicles can result in the effectiveness of models degrading as time passes. In addition, there is a limit on the available computational power and the potential for models to be manipulated by an intelligent adversary that can affect detection.

Future work

Future enhancements include extending to a dual meta-layer architecture with deep learning-based meta-learners and incorporating spatio-temporal modeling using graph-based approaches such as Graph Neural Networks to further improve detection capability. And the model will be extended to handle scenarios where multiple vehicles are compromised and colluding to falsify position data.

Abbreviations

VANET

Vehicular ad hoc network

ITS

Intelligent transportation system

OBU

On-board unit

RSU

Roadside unit

KNN

K-nearest neighbors

RF

Random forest

ETC

Extra trees classifier

ADA

AdaBoost

XGBC

Extreme gradient boosting classifier

LR

Logistic regression

ABC

Artificial bee colony

AUC-ROC

Area under receiver operating characteristic curve

BSM

Basic safety message

CA

Constant attack

COA

Constant offset attack

RA

Random attack

ROA

Random offset attack

ESA

Eventual stop attack

SMOTE

Synthetic minority oversampling technique

SVM

Support vector machine

MLP

Multi-layer perceptron

Author contributions

The first/corresponding author carried out the whole research and drafted the manuscript. The second author supervised the manuscript and guided the overall research work.

Data availability

The dataset utilized in this research are open accessible, as they are linked to the paper https://doi.org/10.1109/ICC40277.2020.9149132. The experiments were conducted using the VeReMi dataset, which is a publicly available benchmark dataset hosted in an open repository. The datasets analyzed during the current study are publicly available in the VeReMi dataset repository at: (https:/www.kaggle.com/datasets/haider094/veremi-dataset) ³².

Declarations

Competing interests

The authors declare no competing interests.