Cross-layer scheme for detecting large-scale colluding Sybil attack in VANETs

In Vehicular Ad Hoc Networks (VANETs), the roadside units (RSUs) need to know the number of vehicles in their vicinity to be used in traffic management. However, an attacker may launch a Sybil attack by pretending to be multiple simultaneous vehicles. This attack is severe when a vehicle colludes with others to use valid credentials to authenticate the Sybil vehicles. If RSUs are unable to identify such an attack, they will report wrong number of vehicles to the traffic management center, which may result in disseminating wrong traffic instructions to vehicles. In this paper, we propose a cross-layer scheme to enable the RSUs to identify such Sybil vehicles. Since Sybil vehicles do not exist in their claimed locations, our scheme is based on verifying the vehicles´ locations. A challenge packet is sent the vehicle´s claimed location using directional antenna to detect the presence of a vehicle. If the vehicle is at the expected location, it should be able to receive the challenge and send back a valid response packet. In order to reduce the overhead and instead of sending challenge packets to all the vehicles all the time, packets are sent only when there is a suspicion of Sybil attack. We also discuss several Sybil attack alarming techniques. The evaluation results demonstrate that our scheme can achieve high detection rate with low probability of false alarm. Additionally, the scheme requires acceptable communication and computation overhead.