Machine Learning-Based Detection of DDoS Attacks in VANETs for Emergency Vehicle Communication

Vehicular Ad Hoc Networks (VANETs) are central to Intelligent Transportation Systems (ITS), especially for real-time communication involving emergency vehicles. Yet, Distributed Denial of Service (DDoS) attacks can disrupt safety-critical channels and undermine reliability. This paper presents a robust, scalable framework for detecting DDoS attacks in highway VANETs. We construct a new dataset with Network Simulator 3 (NS-3) and Simulation of Urban Mobility (SUMO), enriched with real mobility traces from Germany’s A81 highway (OpenStreetMap). Three traffic classes are modeled: DDoS, Voice over IP (VoIP), and Transmission Control Protocol Based (TCP-based) video streaming (VideoTCP). The pipeline includes normalization, feature selection with SHapley Additive exPlanations (SHAP), and class balancing via Synthetic Minority Over-sampling Technique (SMOTE). Eleven classifiers are benchmarked—including eXtreme Gradient Boosting (XGBoost), Categorical Boosting (CatBoost), Adaptive Boosting (AdaBoost), Gradient Boosting (GB), and an Artificial Neural Network (ANN)—using stratified 5-fold cross-validation. XGBoost, GB, CatBoost and ANN achieve the highest performance (weighted F1-score = 97%). To assess robustness under non-ideal conditions, we introduce an adversarial evaluation with packet-loss and traffic-jitter (small-sample deformation); the top models retain strong performance, supporting real-time applicability. Collectively, these results demonstrate that the proposed highway-focused framework is accurate, resilient, and well-suited for deployment in VANET security for emergency communications.