BAHARLOUEI, HAMIDEH2026-02-262026-02-262026-02-20https://hdl.handle.net/10222/85822This thesis investigates advanced methods for anomaly and intrusion detection in Vehicular Ad-hoc Networks (VANETs). It presents a combination of simulation-based experiments and machine learning approaches to detect and mitigate cyber-attacks in real-time vehicle communication systems. The research includes co-authored studies that develop practical frameworks for evaluating VANET security, providing insights into both host-based and network-level malicious behavior detection. The work aims to enhance the reliability, safety, and security of intelligent transportation systems by proposing methods that balance detection accuracy, real-time performance, and system scalability.Vehicular Ad Hoc Networks (VANETs) and Unmanned Aerial Vehicle (UAV) net- works are increasingly used in intelligent transportation systems and autonomous aerial missions. Due to their decentralized and wireless communication nature, these networks are vulnerable to cyberattacks such as Distributed Denial of Service (DDoS), spoofing, and message tampering. This thesis presents ADVENT (Attack/Anomaly Detection in VANETs), a distributed malicious behaviour detection framework de- signed to detect attack onset and identify malicious nodes in real time in both VANET and UAV environments, while preserving data privacy through federated learning. ADVENT integrates statistical analysis with supervised machine learning in a feder- ated learning architecture to support decentralized detection of malicious behaviours. The framework is evaluated under multiple attack scenarios and mobility models. A key methodological contribution is the design and integration of Adaptive Time Slicing (ATS) and Detection Threshold (DT) mechanisms within the malicious node detection (MND) component. These parameters can be tuned to accommodate dif- ferent network characteristics, including topology, node density, and communication dynamics. The ATS mechanism improves temporal detection resolution and mitigates the impact of transient misbehaviours by analyzing fine-grained behavioural snap- shots and aggregating evidence over time. This enhances the robustness of malicious node identification while reducing false positives and missed detections. ADVENT is evaluated using public and simulated datasets, including a custom VANET simu- lation (FourCities), the VeReMi-Extension dataset, a simulated UAV dataset, and a public cyber-physical UAV dataset. Its generalization capability is further examined using unseen attack types not included during training. Results show that ADVENT consistently achieves high F1 scores, low false positive rates, and timely attack onset detection across different network environments. By validating the framework in both ground-based and aerial vehicular networks, this thesis demonstrates the potential of federated learning–based approaches to provide scalable and privacy-aware security mechanisms for future intelligent transportation infrastructures.en-USVehicukar Adhoc NetworksMalicious Node DetectionAttack Onset DetectionFederated LearningMalicious Beghaviour detection SystemSupervised LearningUnseen Attack DetectionUAVs