Congestion-context-aware spatiotemporal detection of malicious flooding in vehicular communication networks

Background and Objectives: Malicious flooding in vehicular communication networks (VCNs) is difficult to detect reliably because benign congestion-driven transmission surges can resemble attack behaviour. Existing detection studies like threshold-based, and conventional machine-learning approaches, often rely on flat traffic indicators such as rate, delay, or packet-level attributes, and therefore do not adequately capture the spatiotemporal and congestion context in which vehicular communication occurs. To address this, this work presents a congestion-context-aware framework that treats flooding in VCNs as a contextual anomaly problem rather than a raw rate-threshold problem. Methods: The proposed framework combines spatiotemporal clustering, localized contextual baselines, session formation, and receiver-window formation to represent communication behaviour in a way that better reflects vehicular dynamics. Based on this framework, an enriched flooding dataset is constructed that incorporates spatial, temporal, contextual, and hierarchical representations needed to distinguish benign congestion from malicious flooding. The resulting data are then used to evaluate detection performance across multiple attack intensities, environments, and standard machine-learning classifiers. Results: The results show that the proposed context-aware representations consistently improve flooding detection across environments and attack intensities. Among the evaluated classifiers, contextual Gradient Boosting achieves the strongest overall performance, delivering consistently high accuracy and F1-scores across the tested settings. To quantify the contribution of context, an ablation study was conducted in which contextual features were removed and the performance difference was assessed using a two-tailed McNemar test. The results show that contextual models significantly outperform their non-contextual counterparts, with session-level improvements yielding extremely small p -values, often below 10 − 100 , and corresponding RX-level gains also reaching statistical significance in several settings, for example p = 0.0094 in the metropolitan high-intensity case. Conclusions: These findings show that effective flooding detection in VCNs depends not simply on applying a classifier to flat traffic records, but on representing communication behaviour within its surrounding congestion and mobility context. More broadly, the study shows that flooding in VCNs is better treated as a contextual anomaly problem than as a raw rate-threshold problem, and that the proposed congestion-context-aware framework provides a more suitable basis for distinguishing benign communication surges from malicious flooding behaviour.