Misbehavior detection in Vehicle-to-Everything (V2X) networks is a second line of defense against insider falsification attacks that cryptographic mechanisms alone cannot address. Existing learning-based Misbehavior Detection Schemes (MDSs) are supervised, requiring labeled attack samples at training time, thus failing to counter unseen falsification attacks. We present PAMPOS, a causal transformer-decoder trained on benign VeReMi++ trajectories to learn normal mobility patterns. At inference time, misbehavior is identified as a deviation from the model's next-step kinematic predictions using a top-K normalized anomaly scoring mechanism that localizes falsification to specific kinematic features, without requiring attack-labeled training data. We evaluate PAMPOS across all 19 attack types in VeReMi++ under rush-hour and afternoon scenarios, achieving Area Under the Curve (AUC) values of up to 0.98 and F1-scores of up to 0.95 for most attack categories.

翻译：车联网（V2X）中的异常行为检测是针对内部伪造攻击的第二道防线，此类攻击无法仅通过密码机制解决。现有基于学习的异常行为检测方案（MDSs）依赖监督学习，在训练时需要标注的攻击样本，因而无法应对未知的伪造攻击。本文提出PAMPOS——一个在良性VeReMi++轨迹上训练的因果Transformer解码器，用于学习正常移动模式。在推理阶段，通过基于Top-K归一化的异常评分机制，将异常行为识别为模型下一步运动学预测的偏离，从而将伪造行为定位到特定运动学特征上，且无需攻击标签的训练数据。我们在VeReMi++数据集所有19种攻击类型下，分别在高峰时段和下午时段场景进行评估，结果表明：对于大多数攻击类别，曲线下面积（AUC）最高可达0.98，F1分数最高可达0.95。