Short: CARdea: Two-Phase Plausibility-Based Vehicle-to-Vehicle Anomaly Detection System

Ensuring secure vehicle-to-vehicle (V2V) communication is vital to the development of connected and automated vehicles (CAVs). While the threat from external attackers can be effectively thwarted by authentication protocols, a critical vulnerability remains in compromised vehicles—internal attackers—that broadcast anomalous Basic Safety Messages (BSMs). These attacks pose serious safety risks to surrounding vehicles, as control systems often rely on input carried in incoming BSMs. Despite recent advances in anomaly detection, current research largely neglects deployment feasibility in resource-constrained vehicles, proposing either heavy ML-based solutions or expensive sensor fusion techniques that are not yet economically viable. We address this disconnect by developing CARdea, a practical real-time anomaly detection scheme for V2V communication. Specifically, we propose a novel two-phase framework that combines a lightweight in-vehicle statistical phase with a robust ML phase, capable of execution on the vehicle, edge, or cloud depending on available resources. The first phase detects anomalous BSMs with up to 98% sensitivity in just 0.1 ms, while the second phase resolves complex cases the first cannot definitively classify. Our experimental evaluation, consisting of 108 hours of simulated BSM data across realistic traffic scenarios and multiple attack types, demonstrates that practicality need not be sacrificed for detection performance with a carefully engineered two-phase system design.