Which algorithms are compared?
Three algorithms of this kind have already been integrated into F2MD, executing calculations in a traditional manner. One such example is an algorithm that assesses each plausibility detector against a specified threshold value. Should any of the detectors fall below this threshold, the corresponding message is categorized as misbehavior (Threshold - TH). The remaining two detectors, Aggregation (AG) and Behavioral (BH), evaluate these systems over time by conducting straightforward value comparisons and developing a behavioral score, which serves as the foundation for identifying misbehavior.
In addition to the three traditional algorithms, two machine learning-based approaches were developed and trained: a support vector machine (SVM) and a multi-layer perceptron (MLP). The former trains a hyperplane in a multidimensional space, effectively separating points of misbehavior from those exhibiting acceptable behavior. New data points are subsequently classified based on their position relative to this hyperplane. The MLP, on the other hand, is a conventional neural network that is trained and makes its decisions based on numerous mathematical computations. An attempt was also made to implement a long-short-term memory (LSTM) model; however, this approach did not yield any results due to the substantial computational resources required for F2MD.
In summary, the detection performance and computation time of five algorithms were assessed across various scenarios.