Online-Tuned Fuzzy Pre-Filtering with an Attention BiLSTM for Misbehavior Detection in Vehicular Named Data Networking

Vehicular Named Data Networking (VNDN) inherits the broadcast-oriented forwarding of NDN, which exposes safety messages to position-falsification attacks. Existing detectors rely either on static fuzzy thresholds, which drift as traffic patterns change, or on opaque deep models, which are accurate but uninterpretable to safety auditors. We propose a two-stage detector that combines an Adaptive Fuzzy Membership Tuning (AFMT) pre-filter with an attention-augmented bidirectional LSTM. AFMT is a Mamdani fuzzy classifier whose triangular membership-function parameters are updated online by gradient descent on a prediction-error feedback signal from the downstream BiLSTM, replacing offline-fixed thresholds. The BiLSTM consumes the fuzzy suspicion score as an extra feature and produces interpretable per-time-step attention weights aligned with attack onsets. On a simulator-synthesized VNDN benchmark following the five canonical VeReMi attack types, the detector attains F1-scores between 0.955 and 0.979 (macro-average 0.964), ties the strongest baselines on the hardest Random-Offset attack while achieving the highest ROC-AUC of all models (0.984), and runs in 0.44 ms per sample on a CPU. On a live OMNeT++/Veins/SUMO testbed running the five attacks on the LuST scenario, the detector attains an F1 value of 0.986. A leave-one-feature-out study shows that detection does not hinge on the Kalman plausibility feature, and on the real public VeReMi v1.0 dataset the architecture transfers to four of the five attack types at an F1 near 1.0, while the Constant Offset stays invisible to kinematics-only features, and this quantifies the value of the named-data-plane features. Every number reported here is measured from the running detector.