A secured IoT-based intelligent transportation system using HyperGraph Neural Networks (HyperGNN) for Suspicious Activity Detection

A secured IoT-based intelligent transportation system using HyperGraph Neural Networks (HyperGNN) for Suspicious Activity Detection | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article A secured IoT-based intelligent transportation system using HyperGraph Neural Networks (HyperGNN) for Suspicious Activity Detection E. RajKumar, K. P. Senthilkumar, S. Famila, S. Yazhinian This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7806634/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract The rapid advancement of the Internet of Things (IoT) has revolutionized Intelligent Transportation Systems (ITS), enabling real-time traffic monitoring, predictive analytics, and enhanced security. However, the increasing connectivity and data exchange in ITS pose significant security risks, including unauthorized access and suspicious activities. This paper proposes a secured IoT-based Intelligent Transportation System (ITS) utilizing HyperGraph Neural Networks (HyperGNN) for suspicious activity detection. HyperGNN is leveraged to model complex, multi-relationship data within transportation networks, capturing intricate interactions among vehicles, infrastructure, and external entities. By employing spatial and spectral hypergraph learning, the system effectively detects anomalies and malicious activities, such as unauthorized vehicle movement, cyber intrusions, and traffic violations. This security mechanism is integrated into the IoT framework to enhance real-time threat detection and mitigate potential cyber threats. Extensive simulations and real-world datasets validate the proposed approach, demonstrating superior detection accuracy, robustness, and efficiency compared to conventional GNN-based methods. The proposed HyperGNN-driven ITS enhances security, optimizes traffic management, and ensures a resilient and intelligent urban mobility system. The proposed HyperGNN achieves, 0.89 of MSE, 0.46 of RMSE and 0.39 of MAE Physical sciences/Engineering Physical sciences/Mathematics and computing Intelligent Transportation System (ITS) security traffic monitoring Graph Neural Network Smart vehicle Figures Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 Figure 7 Figure 8 1. Introduction Intelligent Transport networks (ITS) are essential to current transportation networks, giving many research and development opportunities [ 1 , 2 ]. In 2017, the Middle East ITSs market was worth USD 2.82 billion, and it expects to expand 11.6% during the projected period [ 3 ]. Drivers and passengers' growing desire for real-time traffic information is driving this industry. Traffic congestion is a major concern for ITS, which prioritizes safety and efficiency in transportation systems. ITS uses sensors, networks, and data analytics to gather real-time data, make smart decisions, and improve traffic management [ 4 ]. However, the exponential increase in vehicle numbers on our streets has caused traffic bottlenecks, accidents, transit delays, and environmental damage [ 5 ]. Traffic volume grows continuously in ITS. The growth of automobiles outpaced urban infrastructure and administration, causing traffic congestion and road safety issues. These delays and congestion are caused by specific factors [ 6 ]. ITS's crucial position gives us an incredible potential to improve transportation systems via data-driven decision-making and cutting-edge technologies. Deep Learning (DL) methods harness the potential of complex transportation data in ITS [ 7 ]. This allows us to accurately predict traffic patterns, identify and categorize items, and plan innovative, intelligent actions, making travel smooth and efficient[ 8 ]. ITS's complexity requires computationally strong algorithms that can handle large datasets, especially in the Big Data age. Machine Learning (ML) techniques for classification, regression, ranking, clustering, and dimensionality reduction are fortunately available [ 9 ], [ 10 ], [ 11 ]. These algorithms adapt to supervised, unsupervised, semi-supervised, online, reinforcement, and active learning. Federated learning (FL) has become essential in this environment [ 12 , 13 ]. With applications in many fields, DL, a subset of ML, is important in ITS. DL algorithms excel at handling large, diversified transportation datasets. Given this, this work's contributions are as follows: ITS data includes surveillance video, LiDAR, traffic sensors, and GPS data. Hence, developing a multi-modal feature extraction and fusion framework that utilizes HyperGraph Neural Networks (HyperGNN) to integrate spatial, temporal, and contextual information from various sources. Comparative evaluation of HyperGNN against existing deep learning and graph-based models to demonstrate improved detection accuracy and robustness. 2. Related works This survey section provides a comprehensive review of neural network-based security models in ITS, focusing on their applications, challenges, and future directions. It explores various neural architectures, including deep learning, graph-based models, and hybrid techniques, highlighting their effectiveness in securing transportation infrastructure. In [ 14 ] proposes a multi-agent graph-based soft actor-critic (MAGSAC) approach for traditional traffic signal control (TSC), which combines graph neural networks with the Soft Actor-Critic (SAC) algorithm and extends it to multi-agent environments to address the TSC problem. Specifically, we employ graph-based networks and attention mechanism to expand the receptive domain of agents, enable environmental information to be shared among agents, and utilize the attention mechanism to filter out unimportant information. In [ 15 ], game theoretic and bayesian optimized bayesian neural network (GTBNN) increases IDS accuracy in ITS Cloud attack detection. The Game-theoretic Model solves attacker-defender non-cooperation. To optimize and test efficiently, this model is paired with a Bayesian Optimized BNN. In [ 16 ], offer a Federated Learning (FL)-based collaborative learning strategy for vehicle misbehavior identification. The reference misbehavior dataset VeReMi is rebalanced using SMOTE-Tomek. The developed IDS system [ 17 ] employs deep neural networks to extract rules in two steps. The first and second variations are identical and use DeepRed and HypInv rule extraction in both phases. Heterogeneous version 3 uses HypInv for binary classification and DeepRed for attack classification. In [ 18 ], graph-based machine learning approaches are proposed to identify fraudulent users in ITS environments, making network traffic analysis and device detection straightforward. Therefore, graph-based machine learning may identify rogue nodes in ITS environments easily. In [ 19 ], offer a VANET topology learning approach that prioritizes anonymization and works with any Graph Learning framework. In [ 20 ] divides valid and harmful data into the Integrity (I-chain) and Fraud (F-chain) chains. This multi-chain technique cuts computational power and solves storage. The developed paradigm uses blockchain for privacy, network security, transparency, and immutability. In [ 21 ] introduces the DTs technology, improves the DL method, and combines the CNN with SVR. In [ 22 ] offered a privacy-preserving safe architecture for C-ITS infrastructure. Blockchain and deep learning modules give two security and privacy levels in the proposed system. C-ITS data is securely sent between AVs–RSUs–TCCs via a blockchain module, and a smart contract-based enhanced Proof of Work (ePoW) approach verifies data integrity and mitigates data poisoning threats. Second, a DL module uses LSTM-AE to encode C-ITS data into a new format to avoid inference attacks. In [ 23 ] offers an explainable deep learning-based intrusion detection system to increase IoT network DL-based IDS transparency and robustness. The framework uses SHapley Additive exPlanations (SHAP) to explain deep learning-based IDS judgments for professionals who use them to secure IoT networks and create cyber-resilient systems. 3. Proposed methodology The Internet of Things (IoT)-enabled Intelligent Transportation System (ITS) generates massive volumes of heterogeneous data from various interconnected sources, such as traffic cameras, vehicle sensors, GPS devices, roadside units (RSUs), and cloud-based transportation management systems. Effectively utilizing this data for suspicious activity detection requires a structured approach, including data collection, preprocessing, threat modeling, and intelligent analysis using HyperGraph Neural Networks (HyperGNNs) as shown in figure-1. 3.1 Data collection This phase includes data cleaning, validation, outlier removal, aggregate, conversion, and segmentation. The IoT-ITS ecosystem uses these strategies across data sources. ITS applications collect, gather, store, and send data, which is vital to the environment. ITS data demands must be well defined. Background data, configuration data, produced data, daily functional inputs, real-time ITS device and application data, and downstream processing data are needed. As shown in Fig. 1 , the dispersed edge devices acquire sensory vehicular data and briefly store it in resource-constrained edge devices before transmitting it to the data processing phase. 3.2 Preprocessing of data The data processing component briefly processed vehicle data to compile the data. This component checks sensor data for accuracy before moving on to the next step. Sensor data is gathered for each vehicle throughout time. Next, feature extraction is performed on each vehicle's data. The extraction of important characteristics is critical to sensor data processing. Many sensors provide complicated, non-linear data. Sensor signals with varied frequencies may be observed due to traffic changes, making them unpredictable. The IoT sensors send moving signals. Thus, the signal's massive array is divided into \(\:N\) windows, each with a predefined \(\:S\) -size feature extraction window. The proposed method retrieves the following characteristics from windows. The correlation between \(\:{X}_{1}\) and \(\:{X}_{2}\) is computed by adopting, $$\:\varvec{C}\varvec{O}\left({X}_{1},{X}_{2}\right)=\frac{\sum\:_{r=1}^{m}({X}_{1}-{\mu\:}_{{X}_{1}})({X}_{2}-{\mu\:}_{{X}_{2}})}{\sqrt{\sum\:_{r=1}^{m}\left({X}_{1}-{\mu\:}_{{X}_{1}}\right).\:}\:\sqrt{\sum\:_{r=1}^{m}\left({X}_{2}-{\mu\:}_{{X}_{2}}\right).\:}}$$ 1 where the mean values of \(\:{X}_{1}\) and \(\:{X}_{2}\) signal is performed as \(\:{\mu\:}_{{X}_{1}}=\sum\:_{m=1}^{m}{X}_{1}\) and \(\:{\mu\:}_{{X}_{2}}=\sum\:_{m=1}^{m}{X}_{2}\) . The output value of \(\:CO({X}_{1},{X}_{2})ϵ(+1,-1)\) suggests similarity between \(\:{X}_{1}\) and \(\:{X}_{2}\) , whereas a near 1 signifies uniqueness. The signal's characteristics are determined by evaluating a five-second timeframe. The multiple sensor signals determine the mean, minimum, maximum, and standard deviation. 3.3 Attack and threat model An attack in an ITS environment can be modeled as a function: $$\:A:(N,E,T,S)\to\:R$$ 2 Where, \(\:N\) is the set of network nodes (vehicles, roadside units (RSUs), cloud servers, IoT devices), \(\:E\) is the set of edges. \(\:T\) refers the time dimension, capturing real-time traffic and security data, \(\:S\) represents the security state of the system (normal, suspicious, compromised)., \(\:R\) represents the risk level or severity score of a detected attack. The risk function can be defined as: $$\:R=\sum\:_{i=1}^{n}{w}_{i}.{f}_{i}(N,E,T,S)$$ 3 Where, \(\:{f}_{i}\) represents different security parameters (e.g., network anomalies, traffic pattern deviations, unauthorized access attempts). \(\:{w}_{i}\) represents the weight assigned to each security parameter, indicating its significance. DoS attacks flood the ITS network, overwhelming resources and preventing normal operations. The impact of a DoS attack can be measured as: $$\:{\gamma\:}_{DOS}=\frac{{P}_{malicious}}{{P}_{total}}$$ 4 Where \(\:{P}_{malicious}\) represents identified malicious packets, \(\:{P}_{total}\) represents network packets, and \(\:{\gamma\:}_{DOS}\:\) exceeds a threshold, an alarm is issued. Under the physical threat, Vehicles that do not match registered IDs or expected behavior patterns are flagged. The probability of unauthorized access is modeled as: $$\:{P}_{unauth}=\frac{{N}_{unr}}{{N}_{total}}$$ 5 Where, \(\:{N}_{unr}\) is the number of unregistered vehicles detected, \(\:{N}_{total}\) is the total number of vehicles in the area. \(\:{P}_{unauth}>{\tau\:}_{access}\) an alert is triggered. 3.4 Intelligent Hyper Graph Neural Network A hypergraph is a development of the notion of a basic graph, more especially in terms of edge as provided in figure-2. Hyperedges may have any number of nodes in a hypergraph. This permits direct depiction of higher-order interactions and improves complicated relationship expression. In a hypergraph \(\:G(V,E)\) , \(\:V=\{{v}_{1},{v}_{2},\dots\:{v}_{n}\}\) represents nodes while \(\:E=\{{e}_{1},{e}_{2},\dots\:{e}_{m}\}\) represents hyperedges. Each hyperedge e in E has several nodes. The incidence matrix \(\:H\in\:{R}^{\left|V\right|.\left|E\right|}\) is defined as \(\:H\left(v,e\right)=1\) if \(\:v\in\:e\) and 0 otherwise. The degree matrices for nodes and hyperedges are \(\:{D}_{V}\) and \(\:{D}_{E}\) . The model labels nodes using the hypergraph incidence matrix \(\:H\) and node feature \(\:X\) . The formal formulation of the lth convolution layer is constructed using the developed information propagation technique. The aggregation of node information in a hyperedge is represented as \(\:{H}^{T}{X}^{\left(l\right)}\) , and the standardization technique is \(\:{D}_{e}^{1/2}{H}^{T}{D}_{v}^{-1/2}{X}^{\left(l\right)}\) . The node information is then added to the hyperedge's current information to update the hyperedge embeddings. The influence of the node information is then controlled by adding a hyperparameter α, which can be written as follows. $$\:{Y}^{(l,1)}=\alpha\:{D}_{e}^{1/2}{H}^{T}{D}_{v}^{-1/2}{X}^{\left(l\right)}+{Y}^{\left(l\right)}$$ 6 Self-attention further automates weight coefficient learning for each node in information aggregation: $$\:{e}^{ij}={\left({W}_{Q}^{T}{x}_{i}\right)}^{T}\left({W}_{K}^{T}{y}_{j}\right)$$ 7 $$\:{\propto\:}_{ij}=\frac{exp\left({e}^{ij}\right)}{{\sum\:}_{{v}_{k}ϵ{N}_{{e}_{i}}}exp\left({e}_{kj}\right)}$$ 8 Where \(\:{W}_{Q}\) and \(\:{W}_{K}\) are parameter matrices. The attention coefficients between node \(\:{v}_{i}\) and hyperedge \(\:{e}_{j}\) are given to the related element of the hypergraph incidence matrix \(\:H\) , resulting in \(\:{H}^{att}=\{{h}_{ij}^{att}={\propto\:}_{ij},if{h}_{ij}\ne\:0,{h}_{ij}ϵH\}\) . The output step is $$\:{Y}^{(l,1)}=\sigma\:\left(\left({\alpha\:}_{1}{D}_{e}^{-\frac{1}{2}}{\left(hor\left({H}^{att}\right)\right)}^{T}{D}_{V}^{-1/2}{X}^{\left(l\right)}+{Y}^{\left(l\right)}\right){\theta\:}_{1}^{\left(l\right)}\right)$$ 9 Where \(\:{Y}^{\left(l\right)}\:\) represents the \(\:l\) th layer hyperedge embeddings, \(\:{X}^{\left(l\right)}\) represents the \(\:l\) th layer node embeddings, and \(\:\sigma\:\) represents the non-linear activation function. The hyperedge outlier removal function is \(\:hor\left(.\right)\:\) and the learnable parameter matrix is \(\:{\theta\:}_{1}^{\left(l\right)}\) . The stage output \(\:{Y}^{(l,1)}\) updates the hyperedge features in the edge-to-edge stage. Since the HE-graph is a simple graph with edge weights, we use a GCN with self-loop to learn the graph structure and upgrade hyperedge embeddings \(\:{Y}^{(l+1)}\) for information transmission. The output is, $$\:{Y}^{(l+1)}=\sigma\:\left({D}_{e}^{-\frac{1}{2}}({H}^{T}H+1){D}_{e}^{-1/2}{Y}^{(l,1)}{\theta\:}_{2}^{\left(l\right)}\right)$$ 10 Where \(\:{Y}^{(l,1)}\) represents hyperedge embeddings with aggregated node information, while \(\:\sigma\:\) is a non-linear activation function \(\:I\) is the identity matrix, while \(\:{\theta\:}_{2}^{\left(l\right)}\) is the trainable parameter matrix. Using mean aggregation, hyperedge data may be written as \(\:{D}_{v}^{-1/2}H{D}_{e}^{-1/2}{Y}^{(l+1)}\) . By combining aggregated node data with a hyperparameter \(\:\beta\:\) , the output stage may be described as $$\:{X}^{(l+1)}=\beta\:{D}_{v}^{-1/2}H{D}_{e}^{-1/2}{Y}^{(l+1)}+{X}^{\left(l\right)}$$ 11 introducing attention method to calculate weight updates of the incidence matrix H and improving the hypergraph structure with hyperedge outlier elimination mechanism, information transmission from hyperedges to nodes may be stated as $$\:{e}_{ij}^{{\prime\:}}={\left({{W}^{{\prime\:}}}_{Q}^{T}{x}_{i}\right)}^{T}\left({W{\prime\:}}_{K}^{T}{y}_{j}\right)$$ 12 $$\:{\propto\:}_{ij}^{{\prime\:}}=\frac{exp\left({e}_{ij}^{{\prime\:}}\right)}{\sum\:_{{v}_{k}ϵ{N}_{{v}_{i}}}exp\left({e}_{ik}^{{\prime\:}}\right)}$$ 13 $$\:{X}^{(l+1)}=\sigma\:\left(\left(\beta\:{D}_{v}^{-\frac{1}{2}}hor\left({H}^{at{t}^{{\prime\:}}}\right){D}_{e}^{-\frac{1}{2}}{Y}^{\left(l+1\right)}+{X}^{\left(l\right)}\right){\theta\:}_{3}^{\left(l\right)}\right)$$ 14 Here, \(\:\beta\:\) is a hyperparameter, \(\:{W}_{Q}^{{\prime\:}},{W}_{K}^{{\prime\:}},{\theta\:}_{3}^{\left(l\right)}\) are learnable matrices, \(\:{H}^{at{t}^{{\prime\:}}}\) is the attention score incidence matrix, and \(\:hor\left(.\right)\:\) is the hyperedge outlier removal function. The \(\:l\) hypergraph convolution layer is built as follows, $$\:{Y}^{\left(0\right)}={D}_{e}^{-1}{H}^{T}{X}^{\left(0\right)}$$ 15 $$\:{Y}^{\left(l\right)}=\sigma\:\left(\left(\alpha\:{D}_{e}^{-\frac{1}{2}}{\left({H}^{att}\right)}^{T}{D}_{v}^{-1/2}{X}^{\left(l\right)}+{Y}^{\left(l\right)}\right){\theta\:}_{1}^{\left(l\right)}\right)$$ 16 $$\:{Y}^{(l+1)}=\sigma\:\left({D}_{e}^{-\frac{1}{2}}({H}^{T}H+I){D}_{e}^{-\frac{1}{2}}{Y}^{\left(l\right)}{\theta\:}_{2}^{\left(l\right)}\right)$$ 17 $$\:{X}^{(l+1)}=\sigma\:\left(\left(\beta\:{D}_{v}^{-\frac{1}{2}}{\left({H}^{att{\prime\:}}\right)}^{T}{D}_{v}^{-1/2}{Y}^{(l+1)}+{X}^{\left(l\right)}\right){\theta\:}_{3}^{\left(l\right)}\right)$$ 18 If the dataset lacks starting hyperedge features and the model only gets initial node characteristics \(\:{X}^{\left(0\right)}\) , the average of node features inside each hyperedge must be calculated to create \(\:{Y}^{\left(0\right)}\) using Eq. ( 15 ). If we eliminate the beginning stage and examine a convolution layer without self-loops, Eq. ( 16 ) may be multiplied to represent (18), $$\:{X}^{\left(l+1\right)}=\sigma\:\left(\beta\:\alpha\:{D}_{V}^{-1/2}H{D}_{e}^{-1}{H}^{T}{D}_{V}^{-1/2}{X}^{\left(l\right)}{\theta\:}^{\left(l\right)}\right)$$ which represents a hypergraph convolution layer. Therefore, the hypergraph convolution in HyperGNN helps to identify the suspicious activity 4. Performance analysis Dataset description- In 2018, CIC [ 25 ] and CSE [ 24 ] developed a collaborative initiative called the CSE-CIC-IDS2018 dataset. On Amazon Web Services (AWS), the dataset may be downloaded [ 26 , 27 ]. The collection includes more than 16.2 million samples in 10 CSV files, each of which represents ten days of the network traffic that was recorded. Additionally, the CICFlowMeter program retrieved over 80 characteristics. Table 1 lists the six main forms of intrusion assaults that are included in this dataset: distributed denial of service (DDoS), denial of service (DoS), brute force, bot, infiltration, and online attacks. Day Junction point Features Type of attack count 1 Junction-1 80 Benign FTP-Bruteforce SSH-bruteforce 667,534 126,842 187,632 2 Junction-2 80 Benign DoS attack-golden eye DoS attack-slowloris 995,364 56,368 41,794 3 Junction-3 84 Benign DoS attack-hulk DoS attack-slow HTTPtest 456,827 438,128 563,597 4 Junction-4 83 Benign DoS attack-LOIC-HTTP 7,346,961 537,340 Experimental setup - We obtained simulated results using NS-3 (version 3.30.1) on Ubuntu 20.04.2 LTS in order to assess HyperGNN's performance. The quantitative measurements of MSE, RMSE and MAE are used to assess performance. During the simulations, we looked at several network designs with randomly placed car nodes in a square form linked by roads that were one kilometer long and had two lanes in each direction. The performance of the network is examined by varying the network loads, which include different packet sizes, the number of concurrent connections, and various environmental settings, such as mobility speed, node count, and more. The simulation parameters are shown in Table 2. Table-2 Simulation Parameters PARAMETER TYPE VALUE Simulator ns-3.30.1 Traffic Simulator SUMO 1.7.0 intrusion DoS attack Number of junctions 4 Number of vehicles 5 Transmission speed 1634 Kbps Transmission power 7.4db Mean Square Error (MSE) The Mean squared error model predicts true perception vs perception esteem. By not expelling the needed variable and using data to fit the model, the predictive power is preserved. Formulation of MSE $$\:MSE=\sum\:_{k=1}^{n}({q}_{k}-{{q{\prime\:}}_{k})}^{2}$$ 21 Where, in (21) \(\:{q}_{k}\) represents the total faults discovered at execution time \(\:{t}_{k}\) using real data, whereas \(\:{q{\prime\:}}_{k}\) predicts the inconsistencies and perceptions in the software failure dataset. MAE The model's efficiency is determined using MAE after receiving the data. The model's efficiency should reduce error parameters. Below are the parameter formulas $$\:MAE=\frac{1}{N}\sum\:_{k=1}^{N}\left|{e}_{k}\right|$$ 22 Where, \(\:{e}_{k}\) - error factor. RMSE: It is a commonly used metric to measure the differences between predicted and actual values in regression tasks. It is calculated as $$\:RMSE=\sqrt{\frac{1}{n}}\sum\:_{i=1}^{n}{\left({y}_{i}-{{y}^{{\prime\:}}}_{i}\right)}^{2}$$ 23 Table-3 Analysis of proposed HyperGNN error on various junctions Junction MSE RMSE MAE J1 0.467 0.342 0.128 J2 0.371 0.279 0.635 J3 0.451 0.524 1.582 J4 0.902 1.568 0.42 Figure 3 shows a comparison between the actual (real) and expected number of vehicles at Junction 1 over time. The x-axis shows the datetime index, while the y-axis depicts the number of cars, which ranges between − 2 and 2. The light pink line reflects the actual values, whilst the darker line indicates the expected values. The projected numbers closely track the real values, suggesting that the model accurately captures traffic patterns. However, some deviations are visible, particularly around data points near 200, 800, and other peaks, where the model underestimates or overestimates vehicle count. Despite these variations, the overall trend alignment suggests that the model provides a reasonable approximation of actual traffic flow. The figure-4 illustrates the comparison between actual (true) and predicted traffic values at Junction 2 over time. The x-axis shows the datetime index, which ranges from 0 to around 1400, and the y-axis depicts the number of vehicles, which ranges from − 4 to 4. The genuine values are shown by a light blue line, while the anticipated values are represented by a darker line. The projected values closely mirror the genuine values, representing the overall traffic pattern with periodic peaks and troughs. Noticeable spikes in traffic are observed at regular intervals (around 200, 400, 600, etc.), suggesting a cyclic pattern in vehicle flow. The model appears to perform well in predicting the trend, although some deviations occur at peak points where the true values exceed 3 or drop below − 3. Despite these fluctuations, the overall alignment between the curves indicates that the model effectively estimates traffic variations at Junction 2. The actual (real) and anticipated traffic levels at Junction 3 over time are shown in Fig. 5 . The y-axis shows the number of vehicles, which ranges from around − 6 to 12, and the x-axis shows the date time index, which ranges from 0 to about 1400. The anticipated values are shown by a deeper line, while the real values are represented by a light purple line. The projected values capture the overall trend with little variations, nearly matching the genuine values. Unlike Junctions 1 and 2, the traffic fluctuations at Junction 3 appear relatively stable, with only occasional spikes, particularly after the 1000th time index. These sudden increases and decreases in traffic, seen in the true values, are not entirely mirrored by the predicted values, indicating potential model limitations in handling sudden variations. However, for the most part, the predictions correlate closely with the actual numbers, indicating that the model works well in forecasting general traffic flow while suffering somewhat with extreme outliers. The comparison of the actual (real) and anticipated traffic figures at Junction 4 over time is shown in Fig. 6 . The date and time index is represented by the x-axis, which ranges from 0 to about 400, and the number of vehicles is represented by the y-axis, which ranges from about − 4 to 6. When analyzing the highest fluctuation reaches at 200. The figure-7 presents a comparison of three different error metrics (MSE, RMSE, MAE) across four different models or data sets (J1, J2, J3, and J4).At junction-1 MSE and RMSE are relatively close, while MAE is significantly lower. This suggests that the model has some larger errors that contribute more to the squared error than the absolute error. At junction-2 MSE and RMSE are again higher than MAE, with a noticeable difference between MSE and RMSE. This indicates a similar pattern to J1, with larger errors affecting the squared error more. At junction-3 MSE and RMSE are considerably higher than in J1 and J2, and the difference between them is also larger. MAE is still lower but not as significantly as in the other models. This suggests that J3 has larger errors overall compared to the other models. At junction-4 MSE and RMSE are lower than in J3 but higher than in J1 and J2. MAE is again the lowest, but the difference is less pronounced compared to J1 and J2. This suggests that J4 has errors that are intermediate in size compared to the other models. Table-4 Comparison between existing and proposed methods Parameters MAGSAC [ 14 ] GTBNN [ 15 ] HyperGNN MSE 2.56 1.64 0.89 RMSE 1.64 2.85 0.46 MAE 2.65 2.97 0.39 As shown in figure-8, the RMSE values generally exceed the MSE values. This is because RMSE is the square root of MSE. MAE values are consistently lower than both MSE and RMSE, indicating that the average absolute error is smaller than the average squared error. 5. Conclusion Due to the development in the field of ITS, there is a need for updated protocols and standards that fulfil the current requirements. In this context, we proposed a deep-learning framework that efficiently identifies malicious behavior in ITS. Our research has led to promising results in malicious detection within the framework of Intelligent ITS using HyperGNN by achieving less error. These results are not only a testament to the capabilities of deep learning within CPS-based ITS but also point toward a brighter future for road safety and transportation efficiency. By harnessing the power of artificial intelligence, our system can provide real-time monitoring of driver behaviors, thereby enhancing the safety of our roadways. The practical implications of these results are substantial. For future work, we plan to add more real-time datasets and test our model in real-time. Also, in the future, we will include more parameters and data such as vehicle telemetry data, environmental sensors data, etc. Declarations Competing interests The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. Funding No Funding. Author Contribution E. Rajkumar and K. P. Senthilkumar contributed to the system design, algorithm implementation, and data analysis. S. Famila assisted in experimental validation and result interpretation. S. Yazhinian supervised the research work, refined the methodology, and finalized the manuscript. All authors reviewed and approved the final version of the paper. Acknowledgements The authors would like to express their sincere gratitude to all those who contributed to the successful completion of this work through their valuable support and constructive feedback. Data Availability All data generated or analysed during this study are included in this article. References Njoku, J. N., Nwakanma, C. I., Amaizu, G. C. & Kim, D. S. Prospects and challenges of metaverse application in data-driven intelligent transportation systems. IET Intell. Transp. Syst. 17 (1), 1–21 (2023). Figueiredo, L., Jesus, I., Machado, J. T., Ferreira, J. R. & De Carvalho, J. M. Towards the development of intelligent transportation systems, in Proc. IEEE Intell. Transp. Syst. Proc. , pp. 1206–1211. (2001). Wresearch Middle east intelligent transportation systems market size, share & trends analysis, Nov. Accessed: Sep. 2, 2023. [Online]. (2021). Available: https://www.6wresearch.com/industryreport/ uae-intelligent-transportation-system-market-2017-2023- forecast-by-type-verticals-regions-competitive-landscape Qureshi, K. N. & Abdullah, A. H. A survey on intelligent transportation systems. Middle-East J. Sci. Res. 15 (5), 629–642 (2013). Shaheen, S., Finson, R. & Berkeley, U. C. Intelligent transportation systems, Inst. Transp. Stud., Tech. Rep. qt3hh2t4f9, Dec. 2013. [Online]. Available: https://ideas.repec.org/p/cdl/itsrrp/qt3hh2t4f9.html Moel, E. E., Wynn, T. M., Oo, M. Z. & Htaik, N. M. Analysis of intersection traffic light management system in mandalay city, in Proc. Int. Conf. Adv. Inf. Technol. , pp. 170–175 (2020). Yuan, T. et al. Machine learning for next-generation intelligent transportation systems: A survey. Trans Emerg. Telecommun Technol , 33 , 4, (2022). Art. no. e4427. Gangwani, D. & Gangwani, P. Applications of machine learning and artificial intelligence in intelligent transportation system: A review, in Applications of Artificial Intelligence and Machine Learning., Berlin, Germany: Springer, 203–216. (2021). Huang, G. L. et al. Context-aware machine learning for intelligent transportation systems: A survey. IEEE Trans. Intell. Transp. Syst. 24 (1), 17–36 (Jan. 2023). Lv, Z., Zhang, S. & Xiu, W. Solving the security problem of intelligent transportation system with deep learning, IEEE Trans. Intell. Transp. Syst. , vol. 22, no. 7, pp. 4281–4290, Jul. (2021). Nama, M. et al. Machine learning-based traffic scheduling techniques for intelligent transportation system: Opportunities and challenges. Int J. Commun. Syst , 34 , 9, (2021). Art. no. e4814. Guerrero-Ibañez, J., Contreras-Castillo, J. & Zeadally, S. Deep learning support for intelligent transportation systems. Trans Emerg. Telecommun Technol , 32 , 3, (2021). Art. no. e4169. Mohri, M., Rostamizadeh, A. & Talwalkar, A. Foundations of Machine Learning (MIT Press, 2018). Shang, J. et al. Graph-Based Cooperation Multi-Agent Reinforcement Learning for Intelligent Traffic Signal Control. IEEE Internet Things Journal (2025). Gill, K. S., Saxena, S., Sharma, A. & Dhillon, A. GTBNN: game-theoretic and bayesian neural networks to tackle security attacks in intelligent transportation systems. Cluster Computing , 1–21. (2024). Campos, E. M., Hernandez-Ramos, J. L., Vidal, A. G., Baldini, G. & Skarmeta, A. Misbehavior detection in intelligent transportation systems based on federated learning. Internet Things . 25 , 101127 (2024). Almutlaq, S., Derhab, A., Hassan, M. M. & Kaur, K. Two-stage intrusion detection system in intelligent transportation systems using rule extraction methods from deep neural networks. IEEE Trans. Intell. Transp. Syst. 24 (12), 15687–15701 (2022). Gupta, B. B., Gaurav, A., Marín, E. C. & Alhalabi, W. Novel graph-based machine learning technique to secure smart vehicles in intelligent transportation systems. IEEE Trans. Intell. Transp. Syst. 24 (8), 8483–8491 (2022). da Silva, E. S. A., Pedrini, H. & dos Santos, A. L. Applying graph neural networks to support decision making on collective intelligent transportation systems. IEEE Trans. Netw. Serv. Manage. 20 (4), 4085–4096 (2023). Ashfaq, T. et al. An intelligent automated system for detecting malicious vehicles in intelligent transportation systems. Sensors 22 (17), 6318 (2022). Lv, Z., Li, Y., Feng, H. & Lv, H. Deep learning for security in digital twins of cooperative intelligent transportation systems. IEEE Trans. Intell. Transp. Syst. 23 (9), 16666–16675 (2021). Kumar, R. et al. A privacy-preserving-based secure framework using blockchain-enabled deep-learning in cooperative intelligent transport system. IEEE Trans. Intell. Transp. Syst. 23 (9), 16492–16503 (2021). Oseni, A. et al. An explainable deep learning framework for resilient intrusion detection in IoT-enabled transportation networks. IEEE Trans. Intell. Transp. Syst. 24 (1), 1000–1014 (2022). Communications Security Establishment. Government of Canada. Available online: https://www.cse-cst.gc.ca/en (accessed on 2 February 2023). Canadian Institute for Cybersecurity. University of New Brunswick est.1785. Available online: February (2023). https://www.unb.ca/cic/ (accessed on 2. CSE-CIC-IDS2018 on AWS. Canadian Institute for Cybersecurity. Available online: February (2023). https://www.unb.ca/cic/datasets/ids-2018.html (accessed on 2. Registry of Open Data on AWS. A Realistic Cyber Defense Dataset (CSE-CIC-IDS Available online: (2018). https://registry.opendata.aws/cse-cic-ids2018 (accessed on 2 February 2023). Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-7806634","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":541999707,"identity":"f5f92eeb-9cfd-4658-ba38-7c3d1bcef505","order_by":0,"name":"E. RajKumar","email":"","orcid":"","institution":"Kings Engineering College, Sriperumbudur","correspondingAuthor":false,"prefix":"","firstName":"E.","middleName":"","lastName":"RajKumar","suffix":""},{"id":541999708,"identity":"5e824294-22d4-42e1-bb23-5b85d126d283","order_by":1,"name":"K. P. Senthilkumar","email":"","orcid":"","institution":"Kings Engineering College, Sriperumbudur","correspondingAuthor":false,"prefix":"","firstName":"K.","middleName":"P.","lastName":"Senthilkumar","suffix":""},{"id":541999709,"identity":"e4ff4ac7-e641-4df2-97c9-2e547f36d229","order_by":2,"name":"S. Famila","email":"","orcid":"","institution":"Vel Tech Rangarajan Dr.Sagunthala R\u0026D Institute of Science and Technology","correspondingAuthor":false,"prefix":"","firstName":"S.","middleName":"","lastName":"Famila","suffix":""},{"id":541999710,"identity":"971a69ff-128f-43ef-a2da-aa0d49c04915","order_by":3,"name":"S. Yazhinian","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA50lEQVRIie3Ooa7CMBSA4YPpNYTZzgCPcJIlBLdX6QkJMwiegEwVQ4LlMYa5QU6B2c3suY4JpngASCZoAQOiQyL6i7Zp+6UF8Pm+MwEKJAR2qeA5qk9ImN4v44fEhvljgtb7eDjUx2o3jqPy75QdmwaCnxlCtXOQQiVIhaRfTkZMGiFcnRGocJBc7SVpqUYsBFOKgGxeIe0gZaUtiaP1XrBqEOJWwhNhSSeDqSHCvCJbSMj1ndCGDSEddWVRz3MX6ZVJHV71Ig7Mx/4vTb8fLCfb6uogw/xto2uH982XBqnr1Ofz+Xy2G3UHUu/H47SqAAAAAElFTkSuQmCC","orcid":"","institution":"SRM Institute of Science and Technology","correspondingAuthor":true,"prefix":"","firstName":"S.","middleName":"","lastName":"Yazhinian","suffix":""}],"badges":[],"createdAt":"2025-10-08 10:08:21","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-7806634/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-7806634/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":95744007,"identity":"0c4323fb-10c7-4a52-9a9a-e33c6626449a","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"docx","order_by":0,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":798330,"visible":true,"origin":"","legend":"","description":"","filename":"intelligenttrasnportationraw.docx","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/cf642e1bdae54450f31e03b5.docx"},{"id":95800253,"identity":"e068b087-edee-4827-9075-5a0ed37d2f9e","added_by":"auto","created_at":"2025-11-13 08:21:59","extension":"json","order_by":1,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":5875,"visible":true,"origin":"","legend":"","description":"","filename":"907929c3f1724e95a53d84c8783a4ccc.json","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/b46c02fed5ed990c38b55248.json"},{"id":95744020,"identity":"4147859b-5906-49a3-a74b-b33d04d3e479","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"xml","order_by":2,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":90232,"visible":true,"origin":"","legend":"","description":"","filename":"907929c3f1724e95a53d84c8783a4ccc1enriched.xml","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/f7632c9b202c0ded1b23790f.xml"},{"id":95744006,"identity":"24a6b7fd-0f08-478e-b8b9-9d4b23fba7f3","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"jpeg","order_by":3,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":132829,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage1.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/65814d05c1c24c5ede9f4856.jpeg"},{"id":95744010,"identity":"4d4766f5-3178-4b88-b2ed-7d41843615aa","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"jpeg","order_by":4,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":131735,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage2.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/6e06d6ea896d006673760f8a.jpeg"},{"id":95801110,"identity":"f92a5c35-db4d-48db-b472-b0c8d07558e7","added_by":"auto","created_at":"2025-11-13 08:24:29","extension":"png","order_by":5,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":54403,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage3.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/d012290370573c06b9ed36e3.png"},{"id":95744009,"identity":"74089fd9-d9b9-43bd-a91a-fb3f95602e43","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"png","order_by":6,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":61988,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage4.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/fe43a009bdf5a37d381b9423.png"},{"id":95744011,"identity":"ba150ffd-8afb-4388-86d4-71479661e1bc","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"png","order_by":7,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":39725,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage5.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/ee510ff5fd5f9bae93ecf2e6.png"},{"id":95801201,"identity":"4974ae34-f1e0-4f7f-b240-1739e26d191f","added_by":"auto","created_at":"2025-11-13 08:24:42","extension":"png","order_by":8,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":67008,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage6.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/f59f4306c2b07afcf8bbbb75.png"},{"id":95801383,"identity":"749cb07c-3c79-41a5-954c-f2db2a49ebfd","added_by":"auto","created_at":"2025-11-13 08:25:15","extension":"png","order_by":9,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":205307,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage7.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/f1c9dc538efbe378b9293d9b.png"},{"id":95801724,"identity":"3dceac44-ace7-4b36-a044-b7712a19ac02","added_by":"auto","created_at":"2025-11-13 08:26:01","extension":"png","order_by":10,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":56521,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage8.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/a9f8dbe3e96498c16c07dabc.png"},{"id":95801776,"identity":"837883ef-8ed6-4e54-a0f7-da1eb8afbc4f","added_by":"auto","created_at":"2025-11-13 08:26:07","extension":"png","order_by":11,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":30031,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage1.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/1da6df8f004326ec86ebe883.png"},{"id":95744014,"identity":"9221c0a1-739f-4a2f-90a3-3ea2e3697615","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"png","order_by":12,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":34616,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage2.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/19deaec97597cc55e5437666.png"},{"id":95744022,"identity":"e348aa7e-240f-4628-b825-975ef7b9e3e0","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"png","order_by":13,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":17672,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage3.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/38c3323a332d16401518d68a.png"},{"id":95744027,"identity":"33839f33-c851-4363-b508-0f1afed3115f","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"png","order_by":14,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":20693,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage4.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/fa0e3fefa7d450f6d87ef3a4.png"},{"id":95801497,"identity":"9eb15362-8779-45cb-8d4e-d6d28dcbc36a","added_by":"auto","created_at":"2025-11-13 08:25:32","extension":"png","order_by":15,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":11547,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage5.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/834cfabb5a9951fa02b3f5f1.png"},{"id":95744026,"identity":"06e3104b-cc3f-494c-9a30-e6cff03b1da9","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"png","order_by":16,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":21169,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage6.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/ad77cef82d74b98d4cf7d6bd.png"},{"id":95744016,"identity":"782d0f96-5099-4b03-881e-a5e831d27e4d","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"png","order_by":17,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":18174,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage7.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/a11c200cfd31f92e42aade2c.png"},{"id":95744024,"identity":"2b467e63-1370-4e43-bc3d-bacda2554bff","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"png","order_by":18,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":12446,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage8.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/168bc3a69b95bca05181b1dc.png"},{"id":95801395,"identity":"9f5fffee-da4f-4d50-8dda-bf7347ef5c1d","added_by":"auto","created_at":"2025-11-13 08:25:18","extension":"xml","order_by":19,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":89067,"visible":true,"origin":"","legend":"","description":"","filename":"907929c3f1724e95a53d84c8783a4ccc1structuring.xml","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/6b91ba50a2e9c1c485333e42.xml"},{"id":95744021,"identity":"c3d09d8f-3dd1-4a0f-bd5e-37df283f1afa","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"html","order_by":20,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":103990,"visible":true,"origin":"","legend":"","description":"","filename":"earlyproof.html","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/df4ca75a6a1ffc5a8bf269b5.html"},{"id":95743998,"identity":"398c4218-93b0-4283-bcf1-19fd7569e01c","added_by":"auto","created_at":"2025-11-12 14:21:28","extension":"jpeg","order_by":1,"title":"Figure 1","display":"","copyAsset":false,"role":"figure","size":132829,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cstrong\u003eBlock diagram of proposed intelligent transportation system\u003c/strong\u003e\u003c/p\u003e","description":"","filename":"image1.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/e8e138abef4ba784b608038a.jpeg"},{"id":95802136,"identity":"cb6bf035-f653-41cc-a210-3a2b51d0a30e","added_by":"auto","created_at":"2025-11-13 08:26:59","extension":"jpeg","order_by":2,"title":"Figure 2","display":"","copyAsset":false,"role":"figure","size":131735,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cstrong\u003eArchitecture of HyperGNN\u003c/strong\u003e\u003c/p\u003e","description":"","filename":"image2.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/1ec5e632bd836e113ecd8635.jpeg"},{"id":95743999,"identity":"6cf6bafb-1cc3-49a9-8ac9-5fe082daebd3","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"png","order_by":3,"title":"Figure 3","display":"","copyAsset":false,"role":"figure","size":54403,"visible":true,"origin":"","legend":"\u003cp\u003eSuspicious prediction on junction-1\u003c/p\u003e","description":"","filename":"image3.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/8dd3d9b3501023aff5e44c1b.png"},{"id":95744001,"identity":"0ddd3288-ddfa-458e-91be-28b007dc0603","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"png","order_by":4,"title":"Figure 4","display":"","copyAsset":false,"role":"figure","size":61988,"visible":true,"origin":"","legend":"\u003cp\u003eSuspicious prediction on junction-2\u003c/p\u003e","description":"","filename":"image4.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/7596f4a761860276dae9c6fb.png"},{"id":95744003,"identity":"dddc33b8-e8bd-47a8-8e02-d4ff9c92246c","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"png","order_by":5,"title":"Figure 5","display":"","copyAsset":false,"role":"figure","size":39725,"visible":true,"origin":"","legend":"\u003cp\u003esuspicious prediction on junction-3\u003c/p\u003e","description":"","filename":"image5.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/869ea015529037bdfe3ba8b7.png"},{"id":95744008,"identity":"a4348b41-000e-4c93-a867-402370c989d1","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"png","order_by":6,"title":"Figure 6","display":"","copyAsset":false,"role":"figure","size":67008,"visible":true,"origin":"","legend":"\u003cp\u003esuspicious prediction on junction-4\u003c/p\u003e","description":"","filename":"image6.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/b3ddfbeb64caba9d50c9cc5f.png"},{"id":95744015,"identity":"b70fc3fe-4f08-4783-8d19-53c21dc8c22a","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"png","order_by":7,"title":"Figure 7","display":"","copyAsset":false,"role":"figure","size":205307,"visible":true,"origin":"","legend":"\u003cp\u003eoverall performance metrics on different junctions\u003c/p\u003e","description":"","filename":"image7.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/a04b7759cdf8c5b778492f75.png"},{"id":95744012,"identity":"b1bb256d-fe8f-4116-8470-d2550d0ce178","added_by":"auto","created_at":"2025-11-12 14:21:29","extension":"png","order_by":8,"title":"Figure 8","display":"","copyAsset":false,"role":"figure","size":56521,"visible":true,"origin":"","legend":"\u003cp\u003eOverall comparative analysis\u003c/p\u003e","description":"","filename":"image8.png","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/3f2ebd63ac891b667f067552.png"},{"id":97250239,"identity":"fd92f2ad-dce5-46c8-a86c-105fe8f5b600","added_by":"auto","created_at":"2025-12-02 13:14:10","extension":"pdf","order_by":0,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1420499,"visible":true,"origin":"","legend":"","description":"","filename":"manuscript.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7806634/v1/319bcf80-0fe3-41e2-a496-3bcbd49f443c.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"A secured IoT-based intelligent transportation system using HyperGraph Neural Networks (HyperGNN) for Suspicious Activity Detection","fulltext":[{"header":"1. Introduction","content":"\u003cp\u003eIntelligent Transport networks (ITS) are essential to current transportation networks, giving many research and development opportunities [\u003cspan citationid=\"CR1\" class=\"CitationRef\"\u003e1\u003c/span\u003e, \u003cspan citationid=\"CR2\" class=\"CitationRef\"\u003e2\u003c/span\u003e]. In 2017, the Middle East ITSs market was worth USD 2.82\u0026nbsp;billion, and it expects to expand 11.6% during the projected period [\u003cspan citationid=\"CR3\" class=\"CitationRef\"\u003e3\u003c/span\u003e]. Drivers and passengers' growing desire for real-time traffic information is driving this industry. Traffic congestion is a major concern for ITS, which prioritizes safety and efficiency in transportation systems. ITS uses sensors, networks, and data analytics to gather real-time data, make smart decisions, and improve traffic management [\u003cspan citationid=\"CR4\" class=\"CitationRef\"\u003e4\u003c/span\u003e]. However, the exponential increase in vehicle numbers on our streets has caused traffic bottlenecks, accidents, transit delays, and environmental damage [\u003cspan citationid=\"CR5\" class=\"CitationRef\"\u003e5\u003c/span\u003e]. Traffic volume grows continuously in ITS. The growth of automobiles outpaced urban infrastructure and administration, causing traffic congestion and road safety issues.\u003c/p\u003e\u003cp\u003eThese delays and congestion are caused by specific factors [\u003cspan citationid=\"CR6\" class=\"CitationRef\"\u003e6\u003c/span\u003e]. ITS's crucial position gives us an incredible potential to improve transportation systems via data-driven decision-making and cutting-edge technologies. Deep Learning (DL) methods harness the potential of complex transportation data in ITS [\u003cspan citationid=\"CR7\" class=\"CitationRef\"\u003e7\u003c/span\u003e]. This allows us to accurately predict traffic patterns, identify and categorize items, and plan innovative, intelligent actions, making travel smooth and efficient[\u003cspan citationid=\"CR8\" class=\"CitationRef\"\u003e8\u003c/span\u003e]. ITS's complexity requires computationally strong algorithms that can handle large datasets, especially in the Big Data age. Machine Learning (ML) techniques for classification, regression, ranking, clustering, and dimensionality reduction are fortunately available [\u003cspan citationid=\"CR9\" class=\"CitationRef\"\u003e9\u003c/span\u003e], [\u003cspan citationid=\"CR10\" class=\"CitationRef\"\u003e10\u003c/span\u003e], [\u003cspan citationid=\"CR11\" class=\"CitationRef\"\u003e11\u003c/span\u003e]. These algorithms adapt to supervised, unsupervised, semi-supervised, online, reinforcement, and active learning. Federated learning (FL) has become essential in this environment [\u003cspan citationid=\"CR12\" class=\"CitationRef\"\u003e12\u003c/span\u003e, \u003cspan citationid=\"CR13\" class=\"CitationRef\"\u003e13\u003c/span\u003e]. With applications in many fields, DL, a subset of ML, is important in ITS. DL algorithms excel at handling large, diversified transportation datasets. Given this, this work's contributions are as follows:\u003c/p\u003e\u003cp\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eITS data includes surveillance video, LiDAR, traffic sensors, and GPS data. Hence, developing a multi-modal feature extraction and fusion framework that utilizes HyperGraph Neural Networks (HyperGNN) to integrate spatial, temporal, and contextual information from various sources.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eComparative evaluation of HyperGNN against existing deep learning and graph-based models to demonstrate improved detection accuracy and robustness.\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/p\u003e"},{"header":"2. Related works","content":"\u003cp\u003eThis survey section provides a comprehensive review of neural network-based security models in ITS, focusing on their applications, challenges, and future directions. It explores various neural architectures, including deep learning, graph-based models, and hybrid techniques, highlighting their effectiveness in securing transportation infrastructure.\u003c/p\u003e\u003cp\u003eIn [\u003cspan citationid=\"CR14\" class=\"CitationRef\"\u003e14\u003c/span\u003e] proposes a multi-agent graph-based soft actor-critic (MAGSAC) approach for traditional traffic signal control (TSC), which combines graph neural networks with the Soft Actor-Critic (SAC) algorithm and extends it to multi-agent environments to address the TSC problem. Specifically, we employ graph-based networks and attention mechanism to expand the receptive domain of agents, enable environmental information to be shared among agents, and utilize the attention mechanism to filter out unimportant information. In [\u003cspan citationid=\"CR15\" class=\"CitationRef\"\u003e15\u003c/span\u003e], game theoretic and bayesian optimized bayesian neural network (GTBNN) increases IDS accuracy in ITS Cloud attack detection. The Game-theoretic Model solves attacker-defender non-cooperation. To optimize and test efficiently, this model is paired with a Bayesian Optimized BNN. In [\u003cspan citationid=\"CR16\" class=\"CitationRef\"\u003e16\u003c/span\u003e], offer a Federated Learning (FL)-based collaborative learning strategy for vehicle misbehavior identification. The reference misbehavior dataset VeReMi is rebalanced using SMOTE-Tomek. The developed IDS system [\u003cspan citationid=\"CR17\" class=\"CitationRef\"\u003e17\u003c/span\u003e] employs deep neural networks to extract rules in two steps. The first and second variations are identical and use DeepRed and HypInv rule extraction in both phases. Heterogeneous version 3 uses HypInv for binary classification and DeepRed for attack classification. In [\u003cspan citationid=\"CR18\" class=\"CitationRef\"\u003e18\u003c/span\u003e], graph-based machine learning approaches are proposed to identify fraudulent users in ITS environments, making network traffic analysis and device detection straightforward. Therefore, graph-based machine learning may identify rogue nodes in ITS environments easily. In [\u003cspan citationid=\"CR19\" class=\"CitationRef\"\u003e19\u003c/span\u003e], offer a VANET topology learning approach that prioritizes anonymization and works with any Graph Learning framework. In [\u003cspan citationid=\"CR20\" class=\"CitationRef\"\u003e20\u003c/span\u003e] divides valid and harmful data into the Integrity (I-chain) and Fraud (F-chain) chains. This multi-chain technique cuts computational power and solves storage. The developed paradigm uses blockchain for privacy, network security, transparency, and immutability. In [\u003cspan citationid=\"CR21\" class=\"CitationRef\"\u003e21\u003c/span\u003e] introduces the DTs technology, improves the DL method, and combines the CNN with SVR. In [\u003cspan citationid=\"CR22\" class=\"CitationRef\"\u003e22\u003c/span\u003e] offered a privacy-preserving safe architecture for C-ITS infrastructure. Blockchain and deep learning modules give two security and privacy levels in the proposed system. C-ITS data is securely sent between AVs\u0026ndash;RSUs\u0026ndash;TCCs via a blockchain module, and a smart contract-based enhanced Proof of Work (ePoW) approach verifies data integrity and mitigates data poisoning threats. Second, a DL module uses LSTM-AE to encode C-ITS data into a new format to avoid inference attacks. In [\u003cspan citationid=\"CR23\" class=\"CitationRef\"\u003e23\u003c/span\u003e] offers an explainable deep learning-based intrusion detection system to increase IoT network DL-based IDS transparency and robustness. The framework uses SHapley Additive exPlanations (SHAP) to explain deep learning-based IDS judgments for professionals who use them to secure IoT networks and create cyber-resilient systems.\u003c/p\u003e"},{"header":"3. Proposed methodology","content":"\u003cp\u003eThe Internet of Things (IoT)-enabled Intelligent Transportation System (ITS) generates massive volumes of heterogeneous data from various interconnected sources, such as traffic cameras, vehicle sensors, GPS devices, roadside units (RSUs), and cloud-based transportation management systems.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eEffectively utilizing this data for suspicious activity detection requires a structured approach, including data collection, preprocessing, threat modeling, and intelligent analysis using HyperGraph Neural Networks (HyperGNNs) as shown in figure-1.\u003c/p\u003e\u003cdiv id=\"Sec4\" class=\"Section2\"\u003e\u003ch2\u003e3.1 Data collection\u003c/h2\u003e\u003cp\u003eThis phase includes data cleaning, validation, outlier removal, aggregate, conversion, and segmentation. The IoT-ITS ecosystem uses these strategies across data sources. ITS applications collect, gather, store, and send data, which is vital to the environment. ITS data demands must be well defined. Background data, configuration data, produced data, daily functional inputs, real-time ITS device and application data, and downstream processing data are needed. As shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig1\" class=\"InternalRef\"\u003e1\u003c/span\u003e, the dispersed edge devices acquire sensory vehicular data and briefly store it in resource-constrained edge devices before transmitting it to the data processing phase.\u003c/p\u003e\u003c/div\u003e\u003cdiv id=\"Sec5\" class=\"Section2\"\u003e\u003ch2\u003e3.2 Preprocessing of data\u003c/h2\u003e\u003cp\u003eThe data processing component briefly processed vehicle data to compile the data. This component checks sensor data for accuracy before moving on to the next step. Sensor data is gathered for each vehicle throughout time. Next, feature extraction is performed on each vehicle's data. The extraction of important characteristics is critical to sensor data processing. Many sensors provide complicated, non-linear data. Sensor signals with varied frequencies may be observed due to traffic changes, making them unpredictable. The IoT sensors send moving signals. Thus, the signal's massive array is divided into \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:N\\)\u003c/span\u003e\u003c/span\u003e windows, each with a predefined \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:S\\)\u003c/span\u003e\u003c/span\u003e-size feature extraction window. The proposed method retrieves the following characteristics from windows. The correlation between \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{X}_{1}\\)\u003c/span\u003e\u003c/span\u003e and \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{X}_{2}\\)\u003c/span\u003e\u003c/span\u003e is computed by adopting,\u003cdiv id=\"Equ1\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ1\" name=\"EquationSource\"\u003e\n$$\\:\\varvec{C}\\varvec{O}\\left({X}_{1},{X}_{2}\\right)=\\frac{\\sum\\:_{r=1}^{m}({X}_{1}-{\\mu\\:}_{{X}_{1}})({X}_{2}-{\\mu\\:}_{{X}_{2}})}{\\sqrt{\\sum\\:_{r=1}^{m}\\left({X}_{1}-{\\mu\\:}_{{X}_{1}}\\right).\\:}\\:\\sqrt{\\sum\\:_{r=1}^{m}\\left({X}_{2}-{\\mu\\:}_{{X}_{2}}\\right).\\:}}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e1\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003ewhere the mean values of \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{X}_{1}\\)\u003c/span\u003e\u003c/span\u003e and \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{X}_{2}\\)\u003c/span\u003e\u003c/span\u003e signal is performed as \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{\\mu\\:}_{{X}_{1}}=\\sum\\:_{m=1}^{m}{X}_{1}\\)\u003c/span\u003e\u003c/span\u003e and \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{\\mu\\:}_{{X}_{2}}=\\sum\\:_{m=1}^{m}{X}_{2}\\)\u003c/span\u003e\u003c/span\u003e. The output value of \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:CO({X}_{1},{X}_{2})ϵ(+1,-1)\\)\u003c/span\u003e\u003c/span\u003e suggests similarity between \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{X}_{1}\\)\u003c/span\u003e\u003c/span\u003e and \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{X}_{2}\\)\u003c/span\u003e\u003c/span\u003e, whereas a near 1 signifies uniqueness. The signal's characteristics are determined by evaluating a five-second timeframe. The multiple sensor signals determine the mean, minimum, maximum, and standard deviation.\u003c/p\u003e\u003c/div\u003e\u003cdiv id=\"Sec6\" class=\"Section2\"\u003e\u003ch2\u003e3.3 Attack and threat model\u003c/h2\u003e\u003cp\u003e\u003cdiv class=\"BlockQuote\"\u003e\u003cp\u003eAn attack in an ITS environment can be modeled as a function:\u003c/p\u003e\u003c/div\u003e\u003cdiv id=\"Equ2\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ2\" name=\"EquationSource\"\u003e\n$$\\:A:(N,E,T,S)\\to\\:R$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e2\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003e\u003cdiv class=\"BlockQuote\"\u003e\u003cp\u003eWhere, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:N\\)\u003c/span\u003e\u003c/span\u003e is the set of network nodes (vehicles, roadside units (RSUs), cloud servers, IoT devices), \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:E\\)\u003c/span\u003e\u003c/span\u003e is the set of edges. \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:T\\)\u003c/span\u003e\u003c/span\u003e refers the time dimension, capturing real-time traffic and security data, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:S\\)\u003c/span\u003e\u003c/span\u003e represents the security state of the system (normal, suspicious, compromised)., \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:R\\)\u003c/span\u003e\u003c/span\u003e represents the risk level or severity score of a detected attack. The risk function can be defined as:\u003c/p\u003e\u003c/div\u003e\u003cdiv id=\"Equ3\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ3\" name=\"EquationSource\"\u003e\n$$\\:R=\\sum\\:_{i=1}^{n}{w}_{i}.{f}_{i}(N,E,T,S)$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e3\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003eWhere, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{f}_{i}\\)\u003c/span\u003e\u003c/span\u003e represents different security parameters (e.g., network anomalies, traffic pattern deviations, unauthorized access attempts). \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{w}_{i}\\)\u003c/span\u003e\u003c/span\u003e represents the weight assigned to each security parameter, indicating its significance. DoS attacks flood the ITS network, overwhelming resources and preventing normal operations. The impact of a DoS attack can be measured as:\u003cdiv id=\"Equ4\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ4\" name=\"EquationSource\"\u003e\n$$\\:{\\gamma\\:}_{DOS}=\\frac{{P}_{malicious}}{{P}_{total}}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e4\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003eWhere \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{P}_{malicious}\\)\u003c/span\u003e\u003c/span\u003e represents identified malicious packets, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{P}_{total}\\)\u003c/span\u003e\u003c/span\u003e represents network packets, and \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{\\gamma\\:}_{DOS}\\:\\)\u003c/span\u003e\u003c/span\u003eexceeds a threshold, an alarm is issued. Under the physical threat, Vehicles that do not match registered IDs or expected behavior patterns are flagged. The probability of unauthorized access is modeled as:\u003cdiv id=\"Equ5\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ5\" name=\"EquationSource\"\u003e\n$$\\:{P}_{unauth}=\\frac{{N}_{unr}}{{N}_{total}}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e5\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003eWhere, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{N}_{unr}\\)\u003c/span\u003e\u003c/span\u003e is the number of unregistered vehicles detected, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{N}_{total}\\)\u003c/span\u003e\u003c/span\u003e is the total number of vehicles in the area. \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{P}_{unauth}\u0026gt;{\\tau\\:}_{access}\\)\u003c/span\u003e\u003c/span\u003e an alert is triggered.\u003c/p\u003e\u003c/div\u003e\u003cdiv id=\"Sec7\" class=\"Section2\"\u003e\u003ch2\u003e3.4 Intelligent Hyper Graph Neural Network\u003c/h2\u003e\u003cp\u003eA hypergraph is a development of the notion of a basic graph, more especially in terms of edge as provided in figure-2.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eHyperedges may have any number of nodes in a hypergraph. This permits direct depiction of higher-order interactions and improves complicated relationship expression. In a hypergraph \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:G(V,E)\\)\u003c/span\u003e\u003c/span\u003e, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:V=\\{{v}_{1},{v}_{2},\\dots\\:{v}_{n}\\}\\)\u003c/span\u003e\u003c/span\u003e represents nodes while \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:E=\\{{e}_{1},{e}_{2},\\dots\\:{e}_{m}\\}\\)\u003c/span\u003e\u003c/span\u003e represents hyperedges. Each hyperedge e in E has several nodes. The incidence matrix \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:H\\in\\:{R}^{\\left|V\\right|.\\left|E\\right|}\\)\u003c/span\u003e\u003c/span\u003e is defined as \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:H\\left(v,e\\right)=1\\)\u003c/span\u003e\u003c/span\u003e if \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:v\\in\\:e\\)\u003c/span\u003e\u003c/span\u003e and 0 otherwise. The degree matrices for nodes and hyperedges are \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{D}_{V}\\)\u003c/span\u003e\u003c/span\u003e and \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{D}_{E}\\)\u003c/span\u003e\u003c/span\u003e. The model labels nodes using the hypergraph incidence matrix \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:H\\)\u003c/span\u003e\u003c/span\u003e and node feature \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:X\\)\u003c/span\u003e\u003c/span\u003e. The formal formulation of the lth convolution layer is constructed using the developed information propagation technique. The aggregation of node information in a hyperedge is represented as \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{H}^{T}{X}^{\\left(l\\right)}\\)\u003c/span\u003e\u003c/span\u003e, and the standardization technique is \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{D}_{e}^{1/2}{H}^{T}{D}_{v}^{-1/2}{X}^{\\left(l\\right)}\\)\u003c/span\u003e\u003c/span\u003e. The node information is then added to the hyperedge's current information to update the hyperedge embeddings. The influence of the node information is then controlled by adding a hyperparameter α, which can be written as follows.\u003cdiv id=\"Equ6\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ6\" name=\"EquationSource\"\u003e\n$$\\:{Y}^{(l,1)}=\\alpha\\:{D}_{e}^{1/2}{H}^{T}{D}_{v}^{-1/2}{X}^{\\left(l\\right)}+{Y}^{\\left(l\\right)}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e6\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003eSelf-attention further automates weight coefficient learning for each node in information aggregation:\u003cdiv id=\"Equ7\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ7\" name=\"EquationSource\"\u003e\n$$\\:{e}^{ij}={\\left({W}_{Q}^{T}{x}_{i}\\right)}^{T}\\left({W}_{K}^{T}{y}_{j}\\right)$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e7\u003c/div\u003e\u003c/div\u003e\u003cdiv id=\"Equ8\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ8\" name=\"EquationSource\"\u003e\n$$\\:{\\propto\\:}_{ij}=\\frac{exp\\left({e}^{ij}\\right)}{{\\sum\\:}_{{v}_{k}ϵ{N}_{{e}_{i}}}exp\\left({e}_{kj}\\right)}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e8\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003eWhere \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{W}_{Q}\\)\u003c/span\u003e\u003c/span\u003e and \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{W}_{K}\\)\u003c/span\u003e\u003c/span\u003e are parameter matrices. The attention coefficients between node \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{v}_{i}\\)\u003c/span\u003e\u003c/span\u003e and hyperedge \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{e}_{j}\\)\u003c/span\u003e\u003c/span\u003e are given to the related element of the hypergraph incidence matrix \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:H\\)\u003c/span\u003e\u003c/span\u003e, resulting in \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{H}^{att}=\\{{h}_{ij}^{att}={\\propto\\:}_{ij},if{h}_{ij}\\ne\\:0,{h}_{ij}ϵH\\}\\)\u003c/span\u003e\u003c/span\u003e. The output step is\u003cdiv id=\"Equ9\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ9\" name=\"EquationSource\"\u003e\n$$\\:{Y}^{(l,1)}=\\sigma\\:\\left(\\left({\\alpha\\:}_{1}{D}_{e}^{-\\frac{1}{2}}{\\left(hor\\left({H}^{att}\\right)\\right)}^{T}{D}_{V}^{-1/2}{X}^{\\left(l\\right)}+{Y}^{\\left(l\\right)}\\right){\\theta\\:}_{1}^{\\left(l\\right)}\\right)$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e9\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003eWhere \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{Y}^{\\left(l\\right)}\\:\\)\u003c/span\u003e\u003c/span\u003erepresents the \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:l\\)\u003c/span\u003e\u003c/span\u003e th layer hyperedge embeddings, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{X}^{\\left(l\\right)}\\)\u003c/span\u003e\u003c/span\u003e represents the \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:l\\)\u003c/span\u003e\u003c/span\u003e th layer node embeddings, and \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\sigma\\:\\)\u003c/span\u003e\u003c/span\u003e represents the non-linear activation function. The hyperedge outlier removal function is \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:hor\\left(.\\right)\\:\\)\u003c/span\u003e\u003c/span\u003eand the learnable parameter matrix is \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{\\theta\\:}_{1}^{\\left(l\\right)}\\)\u003c/span\u003e\u003c/span\u003e. The stage output \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{Y}^{(l,1)}\\)\u003c/span\u003e\u003c/span\u003e updates the hyperedge features in the edge-to-edge stage. Since the HE-graph is a simple graph with edge weights, we use a GCN with self-loop to learn the graph structure and upgrade hyperedge embeddings \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{Y}^{(l+1)}\\)\u003c/span\u003e\u003c/span\u003e for information transmission. The output is,\u003cdiv id=\"Equ10\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ10\" name=\"EquationSource\"\u003e\n$$\\:{Y}^{(l+1)}=\\sigma\\:\\left({D}_{e}^{-\\frac{1}{2}}({H}^{T}H+1){D}_{e}^{-1/2}{Y}^{(l,1)}{\\theta\\:}_{2}^{\\left(l\\right)}\\right)$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e10\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003eWhere \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{Y}^{(l,1)}\\)\u003c/span\u003e\u003c/span\u003e represents hyperedge embeddings with aggregated node information, while \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\sigma\\:\\)\u003c/span\u003e\u003c/span\u003e is a non-linear activation function \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:I\\)\u003c/span\u003e\u003c/span\u003e is the identity matrix, while \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{\\theta\\:}_{2}^{\\left(l\\right)}\\)\u003c/span\u003e\u003c/span\u003e is the trainable parameter matrix. Using mean aggregation, hyperedge data may be written as \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{D}_{v}^{-1/2}H{D}_{e}^{-1/2}{Y}^{(l+1)}\\)\u003c/span\u003e\u003c/span\u003e. By combining aggregated node data with a hyperparameter \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\beta\\:\\)\u003c/span\u003e\u003c/span\u003e, the output stage may be described as\u003cdiv id=\"Equ11\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ11\" name=\"EquationSource\"\u003e\n$$\\:{X}^{(l+1)}=\\beta\\:{D}_{v}^{-1/2}H{D}_{e}^{-1/2}{Y}^{(l+1)}+{X}^{\\left(l\\right)}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e11\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003eintroducing attention method to calculate weight updates of the incidence matrix H and improving the hypergraph structure with hyperedge outlier elimination mechanism, information transmission from hyperedges to nodes may be stated as\u003cdiv id=\"Equ12\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ12\" name=\"EquationSource\"\u003e\n$$\\:{e}_{ij}^{{\\prime\\:}}={\\left({{W}^{{\\prime\\:}}}_{Q}^{T}{x}_{i}\\right)}^{T}\\left({W{\\prime\\:}}_{K}^{T}{y}_{j}\\right)$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e12\u003c/div\u003e\u003c/div\u003e\u003cdiv id=\"Equ13\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ13\" name=\"EquationSource\"\u003e\n$$\\:{\\propto\\:}_{ij}^{{\\prime\\:}}=\\frac{exp\\left({e}_{ij}^{{\\prime\\:}}\\right)}{\\sum\\:_{{v}_{k}ϵ{N}_{{v}_{i}}}exp\\left({e}_{ik}^{{\\prime\\:}}\\right)}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e13\u003c/div\u003e\u003c/div\u003e\u003cdiv id=\"Equ14\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ14\" name=\"EquationSource\"\u003e\n$$\\:{X}^{(l+1)}=\\sigma\\:\\left(\\left(\\beta\\:{D}_{v}^{-\\frac{1}{2}}hor\\left({H}^{at{t}^{{\\prime\\:}}}\\right){D}_{e}^{-\\frac{1}{2}}{Y}^{\\left(l+1\\right)}+{X}^{\\left(l\\right)}\\right){\\theta\\:}_{3}^{\\left(l\\right)}\\right)$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e14\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003eHere, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\beta\\:\\)\u003c/span\u003e\u003c/span\u003e is a hyperparameter, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{W}_{Q}^{{\\prime\\:}},{W}_{K}^{{\\prime\\:}},{\\theta\\:}_{3}^{\\left(l\\right)}\\)\u003c/span\u003e\u003c/span\u003e are learnable matrices, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{H}^{at{t}^{{\\prime\\:}}}\\)\u003c/span\u003e\u003c/span\u003e is the attention score incidence matrix, and \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:hor\\left(.\\right)\\:\\)\u003c/span\u003e\u003c/span\u003eis the hyperedge outlier removal function. The \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:l\\)\u003c/span\u003e\u003c/span\u003e hypergraph convolution layer is built as follows,\u003cdiv id=\"Equ15\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ15\" name=\"EquationSource\"\u003e\n$$\\:{Y}^{\\left(0\\right)}={D}_{e}^{-1}{H}^{T}{X}^{\\left(0\\right)}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e15\u003c/div\u003e\u003c/div\u003e\u003cdiv id=\"Equ16\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ16\" name=\"EquationSource\"\u003e\n$$\\:{Y}^{\\left(l\\right)}=\\sigma\\:\\left(\\left(\\alpha\\:{D}_{e}^{-\\frac{1}{2}}{\\left({H}^{att}\\right)}^{T}{D}_{v}^{-1/2}{X}^{\\left(l\\right)}+{Y}^{\\left(l\\right)}\\right){\\theta\\:}_{1}^{\\left(l\\right)}\\right)$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e16\u003c/div\u003e\u003c/div\u003e\u003cdiv id=\"Equ17\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ17\" name=\"EquationSource\"\u003e\n$$\\:{Y}^{(l+1)}=\\sigma\\:\\left({D}_{e}^{-\\frac{1}{2}}({H}^{T}H+I){D}_{e}^{-\\frac{1}{2}}{Y}^{\\left(l\\right)}{\\theta\\:}_{2}^{\\left(l\\right)}\\right)$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e17\u003c/div\u003e\u003c/div\u003e\u003cdiv id=\"Equ18\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ18\" name=\"EquationSource\"\u003e\n$$\\:{X}^{(l+1)}=\\sigma\\:\\left(\\left(\\beta\\:{D}_{v}^{-\\frac{1}{2}}{\\left({H}^{att{\\prime\\:}}\\right)}^{T}{D}_{v}^{-1/2}{Y}^{(l+1)}+{X}^{\\left(l\\right)}\\right){\\theta\\:}_{3}^{\\left(l\\right)}\\right)$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e18\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003eIf the dataset lacks starting hyperedge features and the model only gets initial node characteristics \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{X}^{\\left(0\\right)}\\)\u003c/span\u003e\u003c/span\u003e, the average of node features inside each hyperedge must be calculated to create \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{Y}^{\\left(0\\right)}\\)\u003c/span\u003e\u003c/span\u003e using Eq.\u0026nbsp;(\u003cspan refid=\"Equ15\" class=\"InternalRef\"\u003e15\u003c/span\u003e). If we eliminate the beginning stage and examine a convolution layer without self-loops, Eq.\u0026nbsp;(\u003cspan refid=\"Equ16\" class=\"InternalRef\"\u003e16\u003c/span\u003e) may be multiplied to represent (18),\u003cdiv id=\"Equa\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equa\" name=\"EquationSource\"\u003e\n$$\\:{X}^{\\left(l+1\\right)}=\\sigma\\:\\left(\\beta\\:\\alpha\\:{D}_{V}^{-1/2}H{D}_{e}^{-1}{H}^{T}{D}_{V}^{-1/2}{X}^{\\left(l\\right)}{\\theta\\:}^{\\left(l\\right)}\\right)$$\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003ewhich represents a hypergraph convolution layer. Therefore, the hypergraph convolution in HyperGNN helps to identify the suspicious activity\u003c/p\u003e\u003c/div\u003e"},{"header":"4. Performance analysis","content":"\u003cp\u003e\u003cb\u003eDataset description-\u003c/b\u003e In 2018, CIC [\u003cspan citationid=\"CR25\" class=\"CitationRef\"\u003e25\u003c/span\u003e] and CSE [\u003cspan citationid=\"CR24\" class=\"CitationRef\"\u003e24\u003c/span\u003e] developed a collaborative initiative called the CSE-CIC-IDS2018 dataset. On Amazon Web Services (AWS), the dataset may be downloaded [\u003cspan citationid=\"CR26\" class=\"CitationRef\"\u003e26\u003c/span\u003e, \u003cspan citationid=\"CR27\" class=\"CitationRef\"\u003e27\u003c/span\u003e]. The collection includes more than 16.2\u0026nbsp;million samples in 10 CSV files, each of which represents ten days of the network traffic that was recorded. Additionally, the CICFlowMeter program retrieved over 80 characteristics. Table\u0026nbsp;1 lists the six main forms of intrusion assaults that are included in this dataset: distributed denial of service (DDoS), denial of service (DoS), brute force, bot, infiltration, and online attacks.\u003c/p\u003e\u003cp\u003e\u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"No\" id=\"Taba\" border=\"1\"\u003e\u003ccolgroup cols=\"5\"\u003e\u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e\u003cdiv align=\"left\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e\u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e\u003cdiv align=\"left\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e\u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c5\" colnum=\"5\"\u003e\u003c/div\u003e\u003cthead\u003e\u003ctr\u003e\u003cth align=\"left\" colname=\"c1\"\u003e\u003cp\u003eDay\u003c/p\u003e\u003c/th\u003e\u003cth align=\"left\" colname=\"c2\"\u003e\u003cp\u003eJunction point\u003c/p\u003e\u003c/th\u003e\u003cth align=\"left\" colname=\"c3\"\u003e\u003cp\u003eFeatures\u003c/p\u003e\u003c/th\u003e\u003cth align=\"left\" colname=\"c4\"\u003e\u003cp\u003eType of attack\u003c/p\u003e\u003c/th\u003e\u003cth align=\"left\" colname=\"c5\"\u003e\u003cp\u003ecount\u003c/p\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003e1\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eJunction-1\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e\u003cp\u003e80\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eBenign\u003c/p\u003e\u003cp\u003eFTP-Bruteforce\u003c/p\u003e\u003cp\u003eSSH-bruteforce\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c5\"\u003e\u003cp\u003e667,534\u003c/p\u003e\u003cp\u003e126,842\u003c/p\u003e\u003cp\u003e187,632\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003e2\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eJunction-2\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e\u003cp\u003e80\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eBenign\u003c/p\u003e\u003cp\u003eDoS attack-golden eye\u003c/p\u003e\u003cp\u003eDoS attack-slowloris\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c5\"\u003e\u003cp\u003e995,364\u003c/p\u003e\u003cp\u003e56,368\u003c/p\u003e\u003cp\u003e41,794\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003e3\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eJunction-3\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e\u003cp\u003e84\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eBenign\u003c/p\u003e\u003cp\u003eDoS attack-hulk\u003c/p\u003e\u003cp\u003eDoS attack-slow HTTPtest\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c5\"\u003e\u003cp\u003e456,827\u003c/p\u003e\u003cp\u003e438,128\u003c/p\u003e\u003cp\u003e563,597\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003e4\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eJunction-4\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e\u003cp\u003e83\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eBenign\u003c/p\u003e\u003cp\u003eDoS attack-LOIC-HTTP\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c5\"\u003e\u003cp\u003e7,346,961\u003c/p\u003e\u003cp\u003e537,340\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/colgroup\u003e\u003c/table\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003eExperimental setup - We obtained simulated results using NS-3 (version 3.30.1) on Ubuntu 20.04.2 LTS in order to assess HyperGNN's performance. The quantitative measurements of MSE, RMSE and MAE are used to assess performance. During the simulations, we looked at several network designs with randomly placed car nodes in a square form linked by roads that were one kilometer long and had two lanes in each direction. The performance of the network is examined by varying the network loads, which include different packet sizes, the number of concurrent connections, and various environmental settings, such as mobility speed, node count, and more. The simulation parameters are shown in Table\u0026nbsp;2.\u003c/p\u003e\u003cp\u003eTable-2 Simulation Parameters\u003c/p\u003e\u003cp\u003e\u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"No\" id=\"Tabb\" border=\"1\"\u003e\u003ccolgroup cols=\"2\"\u003e\u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e\u003cdiv align=\"left\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e\u003cthead\u003e\u003ctr\u003e\u003cth align=\"left\" colname=\"c1\"\u003e\u003cp\u003ePARAMETER TYPE\u003c/p\u003e\u003c/th\u003e\u003cth align=\"left\" colname=\"c2\"\u003e\u003cp\u003eVALUE\u003c/p\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eSimulator\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003ens-3.30.1\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eTraffic Simulator\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eSUMO 1.7.0\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eintrusion\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eDoS attack\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eNumber of junctions\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003e4\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eNumber of vehicles\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003e5\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eTransmission speed\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003e1634 Kbps\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eTransmission power\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003e7.4db\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/colgroup\u003e\u003c/table\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eMean Square Error (MSE)\u003c/strong\u003e\u003cp\u003eThe Mean squared error model predicts true perception vs perception esteem. By not expelling the needed variable and using data to fit the model, the predictive power is preserved. Formulation of MSE\u003c/p\u003e\u003c/p\u003e\u003cp\u003e\u003cdiv id=\"Equ19\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ19\" name=\"EquationSource\"\u003e\n$$\\:MSE=\\sum\\:_{k=1}^{n}({q}_{k}-{{q{\\prime\\:}}_{k})}^{2}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e21\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003eWhere, in (21) \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{q}_{k}\\)\u003c/span\u003e\u003c/span\u003e represents the total faults discovered at execution time \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{t}_{k}\\)\u003c/span\u003e\u003c/span\u003e using real data, whereas \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{q{\\prime\\:}}_{k}\\)\u003c/span\u003e\u003c/span\u003e predicts the inconsistencies and perceptions in the software failure dataset.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eMAE\u003c/strong\u003e\u003cp\u003eThe model's efficiency is determined using MAE after receiving the data. The model's efficiency should reduce error parameters. Below are the parameter formulas\u003c/p\u003e\u003c/p\u003e\u003cp\u003e\u003cdiv id=\"Equ20\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ20\" name=\"EquationSource\"\u003e\n$$\\:MAE=\\frac{1}{N}\\sum\\:_{k=1}^{N}\\left|{e}_{k}\\right|$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e22\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003eWhere, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{e}_{k}\\)\u003c/span\u003e\u003c/span\u003e - error factor.\u003c/p\u003e\u003cp\u003e\u003cb\u003eRMSE: It\u003c/b\u003e is a commonly used metric to measure the differences between predicted and actual values in regression tasks. It is calculated as\u003cdiv id=\"Equ21\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ21\" name=\"EquationSource\"\u003e\n$$\\:RMSE=\\sqrt{\\frac{1}{n}}\\sum\\:_{i=1}^{n}{\\left({y}_{i}-{{y}^{{\\prime\\:}}}_{i}\\right)}^{2}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e23\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003eTable-3 Analysis of proposed HyperGNN error on various junctions\u003c/p\u003e\u003cp\u003e\u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"No\" id=\"Tabc\" border=\"1\"\u003e\u003ccolgroup cols=\"4\"\u003e\u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e\u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e\u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e\u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e\u003cthead\u003e\u003ctr\u003e\u003cth align=\"left\" colname=\"c1\"\u003e\u003cp\u003eJunction\u003c/p\u003e\u003c/th\u003e\u003cth align=\"left\" colname=\"c2\"\u003e\u003cp\u003eMSE\u003c/p\u003e\u003c/th\u003e\u003cth align=\"left\" colname=\"c3\"\u003e\u003cp\u003eRMSE\u003c/p\u003e\u003c/th\u003e\u003cth align=\"left\" colname=\"c4\"\u003e\u003cp\u003eMAE\u003c/p\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eJ1\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e\u003cp\u003e0.467\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e\u003cp\u003e0.342\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e\u003cp\u003e0.128\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eJ2\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e\u003cp\u003e0.371\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e\u003cp\u003e0.279\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e\u003cp\u003e0.635\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eJ3\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e\u003cp\u003e0.451\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e\u003cp\u003e0.524\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e\u003cp\u003e1.582\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eJ4\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e\u003cp\u003e0.902\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e\u003cp\u003e1.568\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e\u003cp\u003e0.42\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/colgroup\u003e\u003c/table\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eFigure \u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003e shows a comparison between the actual (real) and expected number of vehicles at Junction 1 over time. The x-axis shows the datetime index, while the y-axis depicts the number of cars, which ranges between \u0026minus;\u0026thinsp;2 and 2. The light pink line reflects the actual values, whilst the darker line indicates the expected values. The projected numbers closely track the real values, suggesting that the model accurately captures traffic patterns.\u003c/p\u003e\u003cp\u003eHowever, some deviations are visible, particularly around data points near 200, 800, and other peaks, where the model underestimates or overestimates vehicle count. Despite these variations, the overall trend alignment suggests that the model provides a reasonable approximation of actual traffic flow.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe figure-4 illustrates the comparison between actual (true) and predicted traffic values at Junction 2 over time. The x-axis shows the datetime index, which ranges from 0 to around 1400, and the y-axis depicts the number of vehicles, which ranges from \u0026minus;\u0026thinsp;4 to 4. The genuine values are shown by a light blue line, while the anticipated values are represented by a darker line. The projected values closely mirror the genuine values, representing the overall traffic pattern with periodic peaks and troughs. Noticeable spikes in traffic are observed at regular intervals (around 200, 400, 600, etc.), suggesting a cyclic pattern in vehicle flow. The model appears to perform well in predicting the trend, although some deviations occur at peak points where the true values exceed 3 or drop below \u0026minus;\u0026thinsp;3. Despite these fluctuations, the overall alignment between the curves indicates that the model effectively estimates traffic variations at Junction 2.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe actual (real) and anticipated traffic levels at Junction 3 over time are shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig5\" class=\"InternalRef\"\u003e5\u003c/span\u003e. The y-axis shows the number of vehicles, which ranges from around \u0026minus;\u0026thinsp;6 to 12, and the x-axis shows the date time index, which ranges from 0 to about 1400. The anticipated values are shown by a deeper line, while the real values are represented by a light purple line. The projected values capture the overall trend with little variations, nearly matching the genuine values. Unlike Junctions 1 and 2, the traffic fluctuations at Junction 3 appear relatively stable, with only occasional spikes, particularly after the 1000th time index. These sudden increases and decreases in traffic, seen in the true values, are not entirely mirrored by the predicted values, indicating potential model limitations in handling sudden variations. However, for the most part, the predictions correlate closely with the actual numbers, indicating that the model works well in forecasting general traffic flow while suffering somewhat with extreme outliers.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe comparison of the actual (real) and anticipated traffic figures at Junction 4 over time is shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig6\" class=\"InternalRef\"\u003e6\u003c/span\u003e. The date and time index is represented by the x-axis, which ranges from 0 to about 400, and the number of vehicles is represented by the y-axis, which ranges from about \u0026minus;\u0026thinsp;4 to 6. When analyzing the highest fluctuation reaches at 200.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe figure-7 presents a comparison of three different error metrics (MSE, RMSE, MAE) across four different models or data sets (J1, J2, J3, and J4).At junction-1 MSE and RMSE are relatively close, while MAE is significantly lower. This suggests that the model has some larger errors that contribute more to the squared error than the absolute error. At junction-2 MSE and RMSE are again higher than MAE, with a noticeable difference between MSE and RMSE. This indicates a similar pattern to J1, with larger errors affecting the squared error more. At junction-3 MSE and RMSE are considerably higher than in J1 and J2, and the difference between them is also larger. MAE is still lower but not as significantly as in the other models. This suggests that J3 has larger errors overall compared to the other models. At junction-4 MSE and RMSE are lower than in J3 but higher than in J1 and J2. MAE is again the lowest, but the difference is less pronounced compared to J1 and J2. This suggests that J4 has errors that are intermediate in size compared to the other models.\u003c/p\u003e\u003cp\u003eTable-4 Comparison between existing and proposed methods\u003c/p\u003e\u003cp\u003e\u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"No\" id=\"Tabd\" border=\"1\"\u003e\u003ccolgroup cols=\"4\"\u003e\u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e\u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e\u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e\u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e\u003cthead\u003e\u003ctr\u003e\u003cth align=\"left\" colname=\"c1\"\u003e\u003cp\u003eParameters\u003c/p\u003e\u003c/th\u003e\u003cth align=\"left\" colname=\"c2\"\u003e\u003cp\u003eMAGSAC [\u003cspan citationid=\"CR14\" class=\"CitationRef\"\u003e14\u003c/span\u003e]\u003c/p\u003e\u003c/th\u003e\u003cth align=\"left\" colname=\"c3\"\u003e\u003cp\u003eGTBNN [\u003cspan citationid=\"CR15\" class=\"CitationRef\"\u003e15\u003c/span\u003e]\u003c/p\u003e\u003c/th\u003e\u003cth align=\"left\" colname=\"c4\"\u003e\u003cp\u003eHyperGNN\u003c/p\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eMSE\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e\u003cp\u003e2.56\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e\u003cp\u003e1.64\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e\u003cp\u003e0.89\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eRMSE\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e\u003cp\u003e1.64\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e\u003cp\u003e2.85\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e\u003cp\u003e0.46\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eMAE\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e\u003cp\u003e2.65\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e\u003cp\u003e2.97\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e\u003cp\u003e0.39\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/colgroup\u003e\u003c/table\u003e\u003c/div\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eAs shown in figure-8, the RMSE values generally exceed the MSE values. This is because RMSE is the square root of MSE. MAE values are consistently lower than both MSE and RMSE, indicating that the average absolute error is smaller than the average squared error.\u003c/p\u003e"},{"header":"5. Conclusion","content":"\u003cp\u003eDue to the development in the field of ITS, there is a need for updated protocols and standards that fulfil the current requirements. In this context, we proposed a deep-learning framework that efficiently identifies malicious behavior in ITS. Our research has led to promising results in malicious detection within the framework of Intelligent ITS using HyperGNN by achieving less error. These results are not only a testament to the capabilities of deep learning within CPS-based ITS but also point toward a brighter future for road safety and transportation efficiency. By harnessing the power of artificial intelligence, our system can provide real-time monitoring of driver behaviors, thereby enhancing the safety of our roadways. The practical implications of these results are substantial. For future work, we plan to add more real-time datasets and test our model in real-time. Also, in the future, we will include more parameters and data such as vehicle telemetry data, environmental sensors data, etc.\u003c/p\u003e"},{"header":"Declarations","content":"\u003cp\u003e\u003ch2\u003eCompeting interests\u003c/h2\u003e\u003cp\u003eThe authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.\u003c/p\u003e\u003c/p\u003e\u003ch2\u003eFunding\u003c/h2\u003e\u003cp\u003eNo Funding.\u003c/p\u003e\u003ch2\u003eAuthor Contribution\u003c/h2\u003e\u003cp\u003eE. Rajkumar and K. P. Senthilkumar contributed to the system design, algorithm implementation, and data analysis. S. Famila assisted in experimental validation and result interpretation. S. Yazhinian supervised the research work, refined the methodology, and finalized the manuscript. All authors reviewed and approved the final version of the paper.\u003c/p\u003e\u003ch2\u003eAcknowledgements\u003c/h2\u003e\u003cp\u003eThe authors would like to express their sincere gratitude to all those who contributed to the successful completion of this work through their valuable support and constructive feedback.\u003c/p\u003e\u003ch2\u003eData Availability\u003c/h2\u003e\u003cp\u003eAll data generated or analysed during this study are included in this article.\u003c/p\u003e"},{"header":"References","content":"\u003col\u003e\u003cli\u003e\u003cspan\u003eNjoku, J. N., Nwakanma, C. I., Amaizu, G. C. \u0026amp; Kim, D. S. Prospects and challenges of metaverse application in data-driven intelligent transportation systems. \u003cem\u003eIET Intell. Transp. Syst.\u003c/em\u003e \u003cb\u003e17\u003c/b\u003e (1), 1\u0026ndash;21 (2023).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eFigueiredo, L., Jesus, I., Machado, J. T., Ferreira, J. R. \u0026amp; De Carvalho, J. M. Towards the development of intelligent transportation systems, in \u003cem\u003eProc. IEEE Intell. Transp. Syst. Proc.\u003c/em\u003e, pp. 1206\u0026ndash;1211. (2001).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eWresearch Middle east intelligent transportation systems market size, share \u0026amp; trends analysis, Nov. Accessed: Sep. 2, 2023. [Online]. (2021). Available: \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://www.6wresearch.com/industryreport/ uae-intelligent-transportation-system-market-2017-2023- forecast-by-type-verticals-regions-competitive-landscape\u003c/span\u003e\u003cspan address=\"https://www.6wresearch.com/industryreport/ uae-intelligent-transportation-system-market-2017-2023- forecast-by-type-verticals-regions-competitive-landscape\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eQureshi, K. N. \u0026amp; Abdullah, A. H. A survey on intelligent transportation systems. \u003cem\u003eMiddle-East J. Sci. Res.\u003c/em\u003e \u003cb\u003e15\u003c/b\u003e (5), 629\u0026ndash;642 (2013).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eShaheen, S., Finson, R. \u0026amp; Berkeley, U. C. Intelligent transportation systems, Inst. Transp. Stud., Tech. Rep. qt3hh2t4f9, Dec. 2013. [Online]. Available: \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://ideas.repec.org/p/cdl/itsrrp/qt3hh2t4f9.html\u003c/span\u003e\u003cspan address=\"https://ideas.repec.org/p/cdl/itsrrp/qt3hh2t4f9.html\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eMoel, E. E., Wynn, T. M., Oo, M. Z. \u0026amp; Htaik, N. M. Analysis of intersection traffic light management system in mandalay city, in \u003cem\u003eProc. Int. Conf. Adv. Inf. Technol.\u003c/em\u003e, pp. 170\u0026ndash;175 (2020).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eYuan, T. et al. Machine learning for next-generation intelligent transportation systems: A survey. \u003cem\u003eTrans Emerg. Telecommun Technol\u003c/em\u003e, \u003cb\u003e33\u003c/b\u003e, 4, (2022). Art. no. e4427.\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eGangwani, D. \u0026amp; Gangwani, P. Applications of machine learning and artificial intelligence in intelligent transportation system: A review, in Applications of Artificial Intelligence and Machine Learning., Berlin, Germany: Springer, 203\u0026ndash;216. (2021).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eHuang, G. L. et al. Context-aware machine learning for intelligent transportation systems: A survey. \u003cem\u003eIEEE Trans. Intell. Transp. Syst.\u003c/em\u003e \u003cb\u003e24\u003c/b\u003e (1), 17\u0026ndash;36 (Jan. 2023).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eLv, Z., Zhang, S. \u0026amp; Xiu, W. Solving the security problem of intelligent transportation system with deep learning, \u003cem\u003eIEEE Trans. Intell. Transp. Syst.\u003c/em\u003e, vol. 22, no. 7, pp. 4281\u0026ndash;4290, Jul. (2021).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eNama, M. et al. Machine learning-based traffic scheduling techniques for intelligent transportation system: Opportunities and challenges. \u003cem\u003eInt J. Commun. Syst\u003c/em\u003e, \u003cb\u003e34\u003c/b\u003e, 9, (2021). Art. no. e4814.\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eGuerrero-Iba\u0026ntilde;ez, J., Contreras-Castillo, J. \u0026amp; Zeadally, S. Deep learning support for intelligent transportation systems. \u003cem\u003eTrans Emerg. Telecommun Technol\u003c/em\u003e, \u003cb\u003e32\u003c/b\u003e, 3, (2021). Art. no. e4169.\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eMohri, M., Rostamizadeh, A. \u0026amp; Talwalkar, A. \u003cem\u003eFoundations of Machine Learning\u003c/em\u003e (MIT Press, 2018).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eShang, J. et al. Graph-Based Cooperation Multi-Agent Reinforcement Learning for Intelligent Traffic Signal Control. \u003cem\u003eIEEE Internet Things Journal\u003c/em\u003e (2025).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eGill, K. S., Saxena, S., Sharma, A. \u0026amp; Dhillon, A. GTBNN: game-theoretic and bayesian neural networks to tackle security attacks in intelligent transportation systems. \u003cem\u003eCluster Computing\u003c/em\u003e, 1\u0026ndash;21. (2024).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eCampos, E. M., Hernandez-Ramos, J. L., Vidal, A. G., Baldini, G. \u0026amp; Skarmeta, A. Misbehavior detection in intelligent transportation systems based on federated learning. \u003cem\u003eInternet Things\u003c/em\u003e. \u003cb\u003e25\u003c/b\u003e, 101127 (2024).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eAlmutlaq, S., Derhab, A., Hassan, M. M. \u0026amp; Kaur, K. Two-stage intrusion detection system in intelligent transportation systems using rule extraction methods from deep neural networks. \u003cem\u003eIEEE Trans. Intell. Transp. Syst.\u003c/em\u003e \u003cb\u003e24\u003c/b\u003e (12), 15687\u0026ndash;15701 (2022).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eGupta, B. B., Gaurav, A., Mar\u0026iacute;n, E. C. \u0026amp; Alhalabi, W. Novel graph-based machine learning technique to secure smart vehicles in intelligent transportation systems. \u003cem\u003eIEEE Trans. Intell. Transp. Syst.\u003c/em\u003e \u003cb\u003e24\u003c/b\u003e (8), 8483\u0026ndash;8491 (2022).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eda Silva, E. S. A., Pedrini, H. \u0026amp; dos Santos, A. L. Applying graph neural networks to support decision making on collective intelligent transportation systems. \u003cem\u003eIEEE Trans. Netw. Serv. Manage.\u003c/em\u003e \u003cb\u003e20\u003c/b\u003e (4), 4085\u0026ndash;4096 (2023).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eAshfaq, T. et al. An intelligent automated system for detecting malicious vehicles in intelligent transportation systems. \u003cem\u003eSensors\u003c/em\u003e \u003cb\u003e22\u003c/b\u003e (17), 6318 (2022).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eLv, Z., Li, Y., Feng, H. \u0026amp; Lv, H. Deep learning for security in digital twins of cooperative intelligent transportation systems. \u003cem\u003eIEEE Trans. Intell. Transp. Syst.\u003c/em\u003e \u003cb\u003e23\u003c/b\u003e (9), 16666\u0026ndash;16675 (2021).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eKumar, R. et al. A privacy-preserving-based secure framework using blockchain-enabled deep-learning in cooperative intelligent transport system. \u003cem\u003eIEEE Trans. Intell. Transp. Syst.\u003c/em\u003e \u003cb\u003e23\u003c/b\u003e (9), 16492\u0026ndash;16503 (2021).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eOseni, A. et al. An explainable deep learning framework for resilient intrusion detection in IoT-enabled transportation networks. \u003cem\u003eIEEE Trans. Intell. Transp. Syst.\u003c/em\u003e \u003cb\u003e24\u003c/b\u003e (1), 1000\u0026ndash;1014 (2022).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eCommunications Security Establishment. Government of Canada. Available online: \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://www.cse-cst.gc.ca/en\u003c/span\u003e\u003cspan address=\"https://www.cse-cst.gc.ca/en\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e (accessed on 2 February 2023).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eCanadian Institute for Cybersecurity. University of New Brunswick est.1785. Available online: February (2023). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://www.unb.ca/cic/\u003c/span\u003e\u003cspan address=\"https://www.unb.ca/cic/\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e (accessed on 2.\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eCSE-CIC-IDS2018 on AWS. Canadian Institute for Cybersecurity. Available online: February (2023). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://www.unb.ca/cic/datasets/ids-2018.html\u003c/span\u003e\u003cspan address=\"https://www.unb.ca/cic/datasets/ids-2018.html\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e (accessed on 2.\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eRegistry of Open Data on AWS. A Realistic Cyber Defense Dataset (CSE-CIC-IDS Available online: (2018). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://registry.opendata.aws/cse-cic-ids2018\u003c/span\u003e\u003cspan address=\"https://registry.opendata.aws/cse-cic-ids2018\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e (accessed on 2 February 2023).\u003c/span\u003e\u003c/li\u003e\u003c/ol\u003e"}],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":true,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":false,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":false,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Intelligent Transportation System (ITS), security, traffic monitoring, Graph Neural Network, Smart vehicle","lastPublishedDoi":"10.21203/rs.3.rs-7806634/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-7806634/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eThe rapid advancement of the Internet of Things (IoT) has revolutionized Intelligent Transportation Systems (ITS), enabling real-time traffic monitoring, predictive analytics, and enhanced security. However, the increasing connectivity and data exchange in ITS pose significant security risks, including unauthorized access and suspicious activities. This paper proposes a secured IoT-based Intelligent Transportation System (ITS) utilizing HyperGraph Neural Networks (HyperGNN) for suspicious activity detection. HyperGNN is leveraged to model complex, multi-relationship data within transportation networks, capturing intricate interactions among vehicles, infrastructure, and external entities. By employing spatial and spectral hypergraph learning, the system effectively detects anomalies and malicious activities, such as unauthorized vehicle movement, cyber intrusions, and traffic violations. This security mechanism is integrated into the IoT framework to enhance real-time threat detection and mitigate potential cyber threats. Extensive simulations and real-world datasets validate the proposed approach, demonstrating superior detection accuracy, robustness, and efficiency compared to conventional GNN-based methods. The proposed HyperGNN-driven ITS enhances security, optimizes traffic management, and ensures a resilient and intelligent urban mobility system. The proposed HyperGNN achieves, 0.89 of MSE, 0.46 of RMSE and 0.39 of MAE\u003c/p\u003e","manuscriptTitle":"A secured IoT-based intelligent transportation system using HyperGraph Neural Networks (HyperGNN) for Suspicious Activity Detection","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-11-12 14:21:24","doi":"10.21203/rs.3.rs-7806634/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"4ad024b3-a8c2-475c-a468-7ef2de07b19b","owner":[],"postedDate":"November 12th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[{"id":57663532,"name":"Physical sciences/Engineering"},{"id":57663533,"name":"Physical sciences/Mathematics and computing"}],"tags":[],"updatedAt":"2025-12-02T09:23:54+00:00","versionOfRecord":[],"versionCreatedAt":"2025-11-12 14:21:24","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-7806634","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-7806634","identity":"rs-7806634","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}