A comparative analysis of multi‐criteria decision methods for secure beacon selection in vehicular platoons

Vehicle platoons are a novel transportation technology which not only aims to ensure traffic safety but also create a positive impact on the environment by producing low CO 2$$ {}_2 $$ emissions. Vehicle platoons rely heavily on wireless communication to ensure that vehicles (leader and members) moving at high speed can keep close formation by exchanging beacons containing significant, authentic and accurate information. However, the presence of malicious attackers launching different attacks such as false data injection (FDI) can compromise the security of vehicle platoons by tampering with the beacons. Therefore, to avoid FDI attacks, we relied on multi‐criteria decision methods (MCDM)‐based methods in order to select the optimum beacon to share authentic and accurate information with the member vehicles. In this study, three MCDM methods including weighted sum model, technique for order of preference by similarity to ideal solution and preference ranking organization method for enrichment of evaluations (PROMETHEE‐II) are studied and compared with the aim to enable the platoons to select the optimum beacon for communication. We performed extensive simulations to evaluate the performance of these methods in the presence of three FDI attacker models from four different aspects, that is, safety, stability, environmental, and cyber security. Our results demonstrate that MCDM‐based methods can increase network efficiency, but at the cost of a trade‐off between safety and cyber security.

tasks such as vehicle speed and position. 4Such technologies enable vehicles to operate safely when keeping minimal inter-vehicle distance at both low and high speeds. 2,57][8] Figure 1 shows a simple platoon application on a multi-lane roadway where the green arrows show the leader to all and the blue arrows show the vehicle to vehicle behind communications.
0][11][12] Like all wireless communications, V2V messages between platooning vehicles are vulnerable to cyber attacks, which can modify the behavior of one or more vehicles by injecting malicious beacons.This results in a wide range of cyber attacks on the platoons such as false data injection (FDI), 13 Denial-of-Service (DoS) 14 or Sybil attacks, 7 to name a few.A little tampering with the information in the beacon can lead to significant disruption to platooning vehicles, 15 which often travel at high speeds with minimal inter-vehicle distance. 2DI attacks are high-risk attacks in vehicular platoons as the member vehicles rely highly on the beacons to maintain their positions in autonomous mode.A slight change in one beacon component can destabilize the whole platoon. 5,15,16o avoid the risk of collision, platooning vehicles may disband as the situation is considered unsafe and therefore lose all benefits from platooning for both platooning and non-platooning vehicles. 5,15Current methods of securing platoons from FDI attacks from non-member vehicles heavily rely on public and private key infrastructure.8][19][20][21][22] Here we propose an auxiliary method to help platoons maintain safe driving formations even if the attacker has broken the member-to-member public and private key infrastructure.
Multiple-criteria decision-making (MCDM), also known as multiple-criteria decision analysis, describes various methods used to make decisions in an intelligent manner.4][25][26] MCDM can handle numerical and non-numerical information, even with conflicting criteria, to identify the best choice based on available information.As such, this can be applied to the beacons used by platooning vehicles to prevent false information from being used by platooning vehicles.By comparing the most recent beacon to the last beacon, the leader's beacon and a predicted beacon-before the platoon controller uses the beacon-a false beacon should be ignored before it has the chance to be used by the vehicle and therefore disrupt the platoon.This article compares several MCDM which enable the platoon vehicles to identify and select real beacons from fake beacons when under FDI attacks, thus preventing an attacker from being able to influence the platoon's behavior.To this end, three MCDM methods, namely weighted sum model (WSM), 25 technique for order of preference by similarity to ideal solution (TOPSIS) 27 and preference ranking organization method for enrichment of evaluations (PROMETHEE II) 28 are studied, implemented and compared in order to evaluate the efficiency of the vehicular platoons to select best beacon when under FDI attacks.To this end, this article aims to evaluate each MCDM method from four aspects: safety, stability, environmental, and cyber security.Next, a comparison is provided to understand which MCDM method is able to detect and select true beacons in the presence of FDI attacks.

Article contributions
The major contributions of our study are: 1. To propose a novel method to select true beacons for vehicular platoons using three MCDM (WSM, TOPSIS, and PROMETHEE II) methods in presence of FDI attacks.2. To provide a comparative study for beacon selection using three MCDM methods within vehicular platoons in presence of three FDI attack models.
F I G U R E 1 Simple platoon application on a multi-lane road.

Article organization
The rest of the article is organized as follows: Section 2 discusses related work to mitigate FDI attacks in vehicular platoons and the use of MCDM in V2V communications.Section 3 introduces three techniques of MCDM: WSM, TOPSIS, and PROMETHEE-II, and how they are applied to platoons as a security method.Section 4 provides a comprehensive description of the simulation environment used to evaluate the platoon against the three attack models, while Section 5 provides the results of the simulations from four aspects, that is, safety, stability, environmental, and cyber security.Next, Section 6 provides a detailed comparison of these implemented methods and provides suggestions for the best method to be implemented in vehicular platoons to prevent FDI attacks.Finally, Section 7 closes out the article.

RELATED WORK
The world is on the way to introducing vehicles on the roads that are more connected and autonomous to make transportation safer, faster and smarter.However, these wirelessly connected vehicles pose various cyber security issues, which need to be addressed to protect us from various security attacks. 29Public key infrastructure (PKI) is a significant research topic in securing CAV vehicles such as vehicle platoons from malicious attacks. 17,18Extensive research exists in the literature on securely passing keys between vehicles when connecting in an ad-hoc method in vehicular platoons.Li et al. proposed a method which uses quantized fading channel randomness 18 to create keys in a secure mechanism.The proposed method uses multi-path fading to create unique keys for vehicles during communication.The main advantage of this approach is that it prevents an eavesdropper from obtaining the same key due to the fact that the multi-path fading of the channel to the malicious node is different to that of the legitimate member.However, this method requires additional equipment to be mounted on the vehicle, which is the main drawback of this approach.Lai et al., on the other hand proposes a method to rely on adjacent infrastructure such as road side units (RSU's) to facilitate the assignment of a key between vehicles.In this proposed model, vehicles communicate with an RSU 17 to form and join a platoon.Based on the recommendation of the RSU, vehicles can only communicate if they have received keys from the RSU.Using this approach provides two main advantages: it (1) provides significant control to trusted authorities in managing the keys for platooning vehicles, and (2) no additional equipment needs to be mounted on the platooning vehicles to exchange keys.However, the vehicles need to be within the range of the RSU in order to form the platoon and exchange keys, which makes it the major weakness of this approach.Furthermore, RSU's are vulnerable to physical damage and failure as well as cyber-attack, 30 which can create additional problems for vehicles wishing to create or join the platoon.
In addition to PKI, some studies have focused on methods to prevent damaging platoon behavior from disrupting a platoon.Such methods often work by identifying behavior patterns using control algorithms such as the Lyapunov-Krasovskii approach, which could destabilize a platoon, leading to a collision or loss of platoon efficiency. 6hese methods rely on sensor data and information from other platoon members to identify and suppress behaviors considered damaging to the platoon. 6,19Other methods use alternative wireless communication methods, such as visible light communications (VLC) as a secondary communication method proposed by Ucar et al. 20 The main advantage of these methods is that the platoon can be secured from unpredictable behavior without any additional external infrastructure such as RSU's.However, this security approach comes at the cost of an unavoidable delay in detecting and preventing damaging behavior, which is the main drawback of these approaches.
Multi-criteria decision methods (MCDM) have been used in transportation previously in the literature with the aim of addressing routing issues.For instance, MCDM has been used in vehicle ad hoc networks (VANET's) 25 due to (i) their ability to use multiple different attributes to calculate the best possible result, and (ii) their ease of scaling to larger networks. 31SM is proposed to be used in the routing protocol proposed by Elgaroui et al. for its robustness, scalability and simplicity in identifying optimum routes using the received signal strength indication (RSSI). 25The goal of using WSM using RSSI is to create a more effective routing mechanism which can be employed for V2V communications within VANET's.On the other hand, Nandy et al. 28 proposed to use PROMETHEE-II in a group-based communication in VANET's for the selection of a cluster head, which then communicates with the other nodes to exchange information.TOPSIS-based methods have also been used in VANET routing protocols to improve transmission rates and reduce computing times. 26,32Furthermore, these methods can be used to rank and select channels to transmit messages to other vehicles.Moreover, these methods can help to analyse the packets.These aspects play a vital role in ensuring that information is transmitted with minimum possible delay and accurately to all appropriate recipients in a VANET, which ultimately improves the reliability of the network. 26In the study by Arif et al., 26 TOPSIS is compared against other methods including MOORA and SAW.These methods were evaluated for random packet loss and ranked-based channel selection aspects.In doing so, it is identified that using TOPSIS can address a range of societal and environmental issues by improving channel selection within a cognitive radio (CR) Enabled Internet on Vehicle (CR-IoV). 26arious security methods have been proposed using PKI and intrusion detection methods (IDM) to secure vehicular platoons.Moreover, MCDM methods have not been used to secure vehicle platoon communications from attacks.As vehicular platoons have their specific characteristics compared to VANET's due to the fact that platoons are less dynamic and generally transmit more sensitive information.Therefore, implementing traditional security methods from VANET's cannot be employed directly in vehicular platoons.This study fills this gap by providing a comparative study between three MCDM methods (i.e., WSM, TOPSIS, and PROMETHEE-II) for ensuring secure beacon selection in vehicular platoons.Table 1 compares various security solutions in VANET's and vehicular platoons along with their advantages and disadvantages.In the next section, we provide details of the three MCDM methods and its implementation in the vehicular platoons.

System model
In order to prevent FDI attacks in vehicular platoons, the vehicles need to select the optimum (i.e., genuine) beacon involving two steps: (i) beacon prediction, and (ii) beacon selection, a system model is shown in Figure 2.

F I G U R E 2
A simple diagram outlining the beacon prediction and beacon selection.

Beacon prediction
The predicted beacon system receives three different types of beacons, that is, (i) a previously received beacon, (ii) a current beacon, and (iii) a leader beacon.The first step is taking the clock time in seconds, of the platooning vehicle, rounding it to two significant figures, and subtracting 0.01 to provide an estimated time for when the beacon would have been created; this value is used as the time component of the predicted beacon.The speed component of the predicted beacon is the reported vehicle speed in the leader's beacon.The leader's speed is used as it is the ideal speed of the platoon at any given time to maintain steady-state platooning.Finally, the acceleration and location components of the predicted beacon come from the current beacon.The use of the current beacon information does enable the attacker to be able to influence the predicted beacon; however, in this article's simulations, there is little to no impact on the platoon formation by doing this.Therefore, the leader and previous beacons are not used, as this will negatively impact the platoon's formation.This information is significantly different from the current and would destabilize the platoon if used.

Beacon selection
Once the beacon is predicted, the next step is to select the optimum beacon with highest score.In this article, we utilize MCDM methods in order to identify optimum beacon to be used by the platoon controllers.MCDM calculations produce a numerical value for each choice, representing its preference over the other choices.In this application, the choices are the leader beacon (LB), current beacon (CB), previous beacon (PastB), and predicted beacon (PreB).For the three methods of MCDM presented in this article, the best choice is the one with the highest score.Therefore, the vehicle must compare the MCDM scores to select the most significant one.The vehicles are biased towards the LB and CB in cases where scores are the same.The LB is used when LB is equal to any other beacon, as this will maintain the vehicle's safe positioning in the platoon when using the co-operative adaptive cruise control (CACC) platoon controller.The CB is used when CB is equal to PastB or PreB as using CB is using the most up-to-date information to give maximum accuracy in vehicle positioning as it is possible for multiple values to very rarely equal the PastB or PreB based on the interaction with the MCDM.In addition, there are three other conditions that the beacon must also satisfy in order to be selected to prevent unsafe platooning.The first is that the beacon's time stamp must be less than the current time; this prevents inaccurate time stamps from creating problems for the CACC controller.The next component is that the positive speed must not exceed +10 mps more than the leader's as this helps to maintain platoon stability during acceleration.Finally, according to ENSEMBLE project, acceleration and speed must not be lower than −3.5 mps for normal vehicle deceleration. 33If the best beacon does not align with the above conditions or if no beacon is selected for any reason, the leader's beacon is loaded to maintain the momentary loss of usable beacons.By doing this the vehicle is able to maintain safe platooning even in this worst case scenario.In the next section, we provide details of the three MCDM methods which are implemented within the vehicular platoons.

Multi-criteria decision methods in vehicular platoons
MCDM describes various methods used to make decisions and is used extensively in various disciplines, including industrial internet of things 34 and cyber security. 35MCDM can handle numerical and non-numerical information and often conflicting criteria to identify the best choice based on available information.For example, MCDM methods can improve a platoon's resistance to false beacon information by comparing the new (current) beacon with the last received leader's beacon and a self-made predicted beacon.By using MCDM to compare the received beacons before using them in the platoon controller to filter out potential false beacons, the vehicles will be able to maintain ideal inter-vehicle distance and platoon stability better.In MCDM, the choices are the different options being considered, and the attributes are a common set of characteristics of each choice that may or may not be favorable.MCDM can use the attributes to identify the best possible alternative.When applied to vehicle platoon beacons, the beacon is the choice, and the elements in the beacon are the attributes.The attributes are the elements within a beacon that are responsible for the platoon behavior and are: speed (s), acceleration (a), controller acceleration (ca), X position (XPos), Y position (YPos), and time (t) and summarized in Table 2.
Each attribute also requires a weighting (w) and is calculated using the best-worst method 36 where the weighted sum equals one.The most important and least important components are picked for the best-worst method, and all other components are rated against them.The most important value is the time, and the least important is the controller acceleration and this due to the way that the CACC interprets and uses the components of the beacon in its navigation.Garlichs et al., 37 state that acceleration and speed were the most influential components of a beacon when determining platoon member behavior as these two values control the longitudinal position of a platooning vehicle.When using MCDM time is the most influential, giving strength to the most up-to-date beacon, the speed the second most-weighted attribute.The controller acceleration is not involved directly with vehicle positioning and is used to tell the CACC the target acceleration of the preceding vehicle and is therefore the least influential attribute.When each attribute is normalized, it becomes signless and thus enabling the fair comparison of all attributes.This article considered the following three MCDM methods to select the best beacon for vehicular platoons.

3.2.1
Weighted sum model WSM is a simple but effective MCDM method which can be used to evaluate alternatives and can be easily scaled to suit the number of choices and criteria being compared.WSM works as each criterion is assigned weight before adding all criteria together for a single choice to give an overall score called the WSM score.The largest WSM score is the best choice.The first step is to take all four beacons, LB, CB, PastB, and PreB in order to create Table 3 using the real data values.The next step is to normalize the values which is done in two ways.First, if the attribute is more beneficial when greater than zero, it is called a benefit attribute.Equation (1) shows how to normalize a beacon component (such as speed (s)).

Platoon beacon characteristics Details Acronym
Beacon If the attribute is more beneficial when equal to zero, then it is a cost attribute which is calculated using Equation (2) using time (t) as an example. ( In both Equations ( 1) and ( 2), x ij is the normalized attribute value, and X is the real value of the attribute.For platoon beacons, the cost attributes are s, a, and ca as they improve braking performance, while XPos, YPos, and t are classified as benefit attributes.XPos and YPos are benefit attributes as they ensure improvement in the stability of the platoon.Time is also a beneficial attribute to give greater influence to the most recent beacon.After normalizing each attribute, the next step is multiplying the attribute weighting by the normalized attribute value where w is the weighting of the attribute.Finally, each attribute in each beacon is added to produce the WSM score.Table 4 provides an example of calculating WSM score for all the choices.CB will be selected from this example as it achieved the highest WSM score.

3.2.2
Technique for order of preference by similarity to ideal solution Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS) was originally developed by Ching-Lai Hwang, and Kwangsun Yoon in 1981. 38The concept of TOPSIS is that the chosen alternative should have the shortest geometric distance to the positive ideal solution and be furthest from the negative ideal solution.To achieve this, an ideal best and an ideal worst are selected for each attribute for each choice.As such, each choice compares attributes with each other, with the best becoming the ideal best and the worst becoming the ideal worst.TOPSIS starts by creating Table 3.The next step is to normalize the TOPSIS values using Equation (3).For each attribute (X), the normalization equation is the same regardless of if the attribute is a cost or benefit.Next, the normalized attributes are multiplied by the attribute weighting w.
This step involves the best and worst for each attribute to be identified.The ideal best is the most advantageous attribute, for the example in Table 5 for a the ideal best value is 0.058 (LB a ).The ideal worst is the least advantageous, for example in Table 5 for a the ideal worst value is 0.004 (CB a and PreB a ).Table 5 shows this step implemented using the example.The ideal best and worst are needed to be able to calculate the ideal best Euclidean distance (S + i ) and the ideal worst Euclidean distance (S − i ).The equation for the ideal best Euclidean distance is shown in Equation ( 4) where V ij is the weighted normalized value, and V + j is the ideal best attribute.
The equation for the ideal worst Euclidean distance is shown in Equation ( 5) where V ij is the weighted normalized value, and V − j is the ideal worst attribute.
With the Euclidian distances calculated using Equations ( 4) and ( 5) for each beacon.Finally calculating the performance score (P i ).The largest performance score is the best beacon to be used for the CACC, and in this example, would be the leader beacon.

Preference ranking organization method for enrichment of evaluations
Preference ranking organization method for enrichment of evaluations (PROMETHEE) works to present the choice that best fits the goal.As such, this behavior could make it advantageous for use in securing vehicle platoons beacons against FDI attacks.The first step is to construct a decision matrix shown in Table 3.For each attribute the maximum (max(x ij )) value and the minimum (min(x ij )) value are identified.Then the decision matrix needs to be normalized for beneficial attributes as shown in Equation ( 7) and cost attributes in Equation (8).Where R + ij is the normalized benefit value, R − ij is the normalized cost value and x ij is the initial value, producing Table 6.The next step is to calculate the evaluative differences of ith alternative concerning all other alternatives.Each message and its attributes are subtracted from another message to give a − b, which is the evaluative differences of ith alternative concerning all other alternatives.The first four rows are shown algebraically in Table 7.The matrix is filled when all choices are compared directly against each other, as shown in Table 8.Once the matrix is created, the next step is to calculate the preference function, P j (a, b), which can be calculated using Equations ( 9) and (10).Where R aj is the resulting difference between two attributes shown in Table 8.All values equal to or less than zero be changed to zero and all values greater than zero unchanged.The following step is to calculate the aggregated preference function (a, b) according to Equation (11) where w is the weights as used before.
The aggregated preference functions for each comparison are then used to create a new matrix as shown in Table 9 with the worked example shown in Equation (13).
The next step is to calculate the entering and leaving flow.The alternative's entering (negative) flow is the average of each column, and the leaving (positive) flow for the alternative is the average of each row.Equation ( 12) is an example of how the entering flow is calculated using the LB and Equation ( 13) is an example for how the leaving flow is calculated using LB.Where E LB is the entering flow for the LB and L LB is the leaving flow for the LB, the other beacons are calculated the same way.
The final step is to calculate the net outranking flow (P i ) for each alternative, which is achieved by subtracting the entering flow from the leaving flow for each alternative Equation (14).
where E is the entering flow and L is the leaving flow resulting in Table 10.The best beacon identified by PROMETHEE II using this example is the predicted beacon (PreB) to be used by the CACC.

SIMULATION SETUP
In order to compare the effectiveness of each MCDM method at preventing FDI attacks on vehicle platoons, the open source simulator called plexe is used. 39Plexe is a platooning extension to the Veins 40 simulation environment built using OMNET++ network simulator 41 and integrated with SUMO. 42With Veins handling the vehicle nodes and their behavior, OMNET++ simulates the wireless communications network while SUMO provides road network information and another graphical user interface.The platoon is simulated in a map of (650 × 250) km where all vehicles operate on a multi-lane road at maximum speed of 80 kph.In this study, single platoon consisting of eight vehicles is modeled with one leader and seven member vehicles.Moreover, once the platoon is completed, human-driven attacker vehicles are introduced in the network which perform FDI attacks.The platoons are attacked several times where the number of attackers or victim vehicles increases which is done to show the full impact of the FDI attacks on the platoon for each MCDM.Further simulation parameters are listed in Table 11.

Platoon model
The platoon model used makes several assumptions about the platooning vehicles.First, the leader vehicle always gives accurate information in its beacon, and the attacker cannot pretend to be the leader.All platooning vehicles use CACC as described in the California path project 43 as the platoon controller.The platoon is formed, and no vehicles are joining or leaving the platoon during the simulation.There are no faulty sensors or other equipment on the platooning vehicles.
All member vehicles use MCDM to select the beacon sent to their platoon controller from the platoon network.

Attacker model
The attacker models are discussed in detail here, along with their assumptions.The first assumption is that the attacker cannot spoof the leader's messages but can spoof any platoon member.The attacker can create beacons that are recognizable to the platoon and that the attacker has broken PKI for the member vehicles.The attacker, however, is not a member of the platoon.The attacker always targets as close to the leader as possible, giving the most opportunity to destabilize the  platoon.Finally, the beacon injected in by the attacker will have a vehicle speed of 0.5 mps more than the platoon's speed.
There are three attack models that are considered; single attacker multiple victims, multiple attackers multiple victims, and multiple attackers single victim.

Single attacker multiple victims
In this attack model, a single attacker attacks the platoon as shown in Figure 3A.The attacker will switch between each vehicle it is attacking to avoid detection.When the simulation is run, the attacker will attack between 1 and 6 of the platooning member vehicles.Six is the maximum number the attacker can attack as, at this point, there are no more member vehicles it can attack.This attack aims to lower the chances of being identified by spoofing the ID of multiple different member vehicles and not concentrating on a single vehicle.As such, the defensive method used by the platoon must react very quickly to prevent the attacker from negatively impacting the platoon.

Multiple attackers multiple victims
For the multiple attackers attacking multiple vehicles shown in Figure 3B, the attackers work co-operatively to attack multiple members simultaneously, where each attacker focuses on a single member that only it attacks.There are between one and six attackers.This is due to there being only six member vehicles that can be attacked.This attack aims to compromise member-to-member communications in the platoon between multiple members simultaneously.To overcome this, the defense method used must be able to prevent the fake beacons from being injected into the platoon network by the attackers without obstructing the use of the true beacons.

Multiple attackers single victim
The third attack model is where multiple vehicles work co-operatively to attack a single platoon member and is shown in Figure 3C.As before, there are between one and six attackers attacking the platoon.Six is the maximum number of attackers first to keep uniformity with the other two attack models but also that the overall behavioral patterns are also clearly shown.In this attack, the attackers put all their effort into attacking a single vehicle; therefore, any defense method needs to be strong and robust to prevent it from being overwhelmed in such attacks.

RESULTS
The results are presented from four distinct aspects, including safety, stability, environmental, and cyber security.

Safety
Given that vehicles in a platoon travel at high speed with minimal inter-vehicle spacing between them, any change to the inter-vehicle distance presents a potential safety problem.Therefore maintaining the ideal inter-vehicle distance is vital to the safety of the platoon and other road users.Figure 4 shows the average inter-vehicle distance maintained by platoon members for three different MCDM methods.The gray line represents the average mean inter-vehicle distance between the vehicles in the platoon for each MCDM method and under each attack model.The average mean inter-vehicle distance of all vehicles in the platoon is ideal.With only PROMETHEE II seeing a slight increase in average inter-vehicle distance, it is negligible at less than 0.02 m.The average maximum and minimum inter-vehicle distances are where WSM and TOPSIS are better than PROMETHEE II as they both have an average maximum inter-vehicle of 0.15 m as a minimum of just less than the ideal but are always less than 0.06 m, while.PROMETHEE II sees the minimum inter-vehicle distance reduced by over 0.5 m and a maximum of more than 0.98 m for single attacker multiple victims attack scenarios and over 1 m for multiple attackers multiple victims and multiple attacker single victim.
When looking directly at the inter-vehicle distances shown in Figures 5-7, the similarity and advantages of WSM and TOPSIS over PROMETHEE II become obvious.The WSM and TOPSIS produce identical inter-vehicle distance traces at the ideal inter-vehicle distance almost throughout apart from an initial slight increase after the vehicles start as the vehicles start slightly closer together than the ideal.While the use of PROMETHEE II overall is better than if there is no MCDM used, there is a significant amount of destabilization initially.During the multiple attacker single victim attack method, it cannot return all vehicles to the ideal inter-vehicle distance.When five attackers are attacking a single target vehicle, then the directly attacked vehicle, vehicle two, will brake significantly at around 7 s, increasing its inter-vehicle distance dramatically.Vehicle three does not respond quickly enough to this and sees it close its inter-vehicle distance between it and vehicle close dramatically to 6.06 m, which has the potential to cause the vehicles to collide if the attack is more severe or there is sudden braking.The similarity in behavior shown by WSM and TOPSIS is because of the similarity in their methods that enable both to suppress the FDI attacks in all three attack methods.This is backed up as the inter-vehicle distance trace for each vehicle is very close to the ideal.To achieve this behavior, most, if not all, of the false beacons need to be ignored and not used by the CACC controller.PROMETHEE II, on the other hand, is calculated very differently and, as such, produces very different results.While able to average the inter-vehicle distance to 15 m, it is not as stable as TOPSIS and WSM.This is highlighted in Figure 7C, where the attack heavily impacts the platoon.Therefore it can be inferred that PROMETHEE II cannot prevent false beacons from being sent to the CACC controller; in addition, it prevents some true beacons from being used.

Stability
The stability of the platoon is indicated by the speed of each vehicle in the platoon.Under ideal conditions, a platoon's speed should be constant.If the leader makes any speed adjustments, the platoon should respond accordingly and immediately while maintaining the ideal inter-vehicle distance.Figure 8 shows the average mean speed of each vehicle in the platoon in gray, and the average maximum and minimum speeds.The average mean vehicle speed for all three MCDM methods is the same and ideal at 22.222 mps (80 kmph).The maximum and minimum speeds for both WSM and TOPSIS are ideal at 22.222 mps (80 kmph).PROMETHEE II, however, has significant variations in the maximum and minimum vehicle speeds.The average minimum vehicle speed drops to 21.59 mps, which is a significant drop in speed; however, it is not long-term.The maximum vehicle speed is 23.32 mps.The maximum speed is more than what is seen in WSM and TOPSIS, which suggests that PROMETHEE II is less stable than WSM and TOPSIS.
To get a better understanding of how the vehicle's speed is impacted when under FDI attack for the three MCDM methods, Figures 9-11 are used.Looking at the vehicle speeds in more detail, Figures 9A,B-11A,B show near-ideal vehicle speeds achieved via WSM and TOPSIS.Initially the start speed of the vehicles is a slightly slower than the ideal.The recovery is, however, smooth without any sudden changes in speed.This ideal behavior was expected due to the smooth and ideal inter-vehicle distance.
However, for PROMETHEE II results, the platoon is notably unstable when under FDI attack as depicted in Figures 9C-11C respectively.The method cannot hold the ideal vehicle speed for any vehicle after member vehicle one.The most disrupted vehicle is vehicle two, and the least is vehicle seven.Vehicle two sees its vehicle speed decrease to 65.89 kmph, which is a significant drop from the ideal speed of 80 kmph.Although brief, it is significantly destabilizing on the platoon with all following vehicles also needing to brake sharply to avoid collisions with the vehicle in front.After this period of braking, there an extended period of acceleration to 85.46 kmph on vehicle two before the speed returns to the ideal; however, unlike the WSM and TOPSIS vehicles, speed never returns to ideal when attacked by multiple attackers on a single member.While under attack by a single attacker or where there are multiple attackers attacking multiple members, the initial change in speed is small with the MCDM able to recover to the ideal.However when multiple attackers attack a single vehicle the disruption is significant and the member vehicles are unable to return to an ideal platooning speed.
WSM and TOPSIS methods again perform identically as they can prevent the FDI attacks from disrupting the platoon formation.Again the similarity in performance is because both methods are similar and will perform similarly.As for PROMETHEE II, it again struggled to maintain the ideal vehicle speed.In addition, PROMETHEE II cannot prevent the false beacons from being used by the CACC and rejecting some of the true beacons as fake, which is what causes PROMETHEE II to be unable to maintain the platoon formation.

Environmental
A reduced CO 2 output of platooning vehicles is one of the major benefits of platooning and, as such, should be maintained under FDI attack.Figure 12 shows the average output of CO 2 for the platoons under each attacker model and each MCDM method.The WSM and TOPSIS platoon average CO 2 outputs of 3192.5 g per vehicle over the 1000 s of the simulation time or 3.193 g/s per vehicle.However, the PROMETHEE II CO 2 average outputs are slightly higher at between 3194 and 3194.5 g or 3.194-3.195g/s per vehicle.This difference is very small; however over longer periods the total difference in CO 2 output will become significant.

F I G U R E 14
The average F1 score for each platoon.
platooning, which results in regular acceleration and breaking.This instability will cause the vehicle to consume more fuel, thus resulting in a higher CO 2 output.WSM and TOPSIS both have very similar CO 2 outputs as the vehicle speed and inter-vehicle distance is the same.In the simulations performed, only vehicle speed and inter-vehicle distance affect the CO 2 output of the vehicle.PROMETHEE II, on the other hand, sees significant disruption to both inter-vehicle speed and vehicle speed, which is reflected in the amount of CO 2 produced by each platoon member.Vehicles that were, on average, more impacted by the attacks, like vehicle three (the first attack-able vehicle) and seven, saw significantly higher CO 2 outputs compared to other member vehicles.

Cyber security
The F1 score is used in cyber security to represent the accuracy of the security method to prevent attacks. 44,45Here the F1 score relates to how likely the MCDM will correctly identify a true beacon and send it to the CACC.The average F1 score of the platoon for each attacker model and MCDM method is shown in Figure 14.The F1 score is a percentage; therefore, the greater the score, the better the overall accuracy of the MCDM method at correctly identifying the true beacons from the false ones.First TOPSIS outperforms WSM and PROMETHEE II with an average score of 98% against all three attacker models.PROMETHEE II shows some promise here, able to outcompete WSM for the attack models single attacker multiple victims and multiple attackers multiple victims with an F1 score of 72% and 80% respectively, compared to WSM's 70% and 71%.Finally, for multiple attacker single victim, WSM obtains an F1 score of 71% compared to PROMETHEE II 69%.Looking at the average F1 score for each vehicle that is vulnerable to attack from the attack models effectiveness of each MCDM method is shown in Figure 15A-C.TOPSIS is extremely capable here, with an F1 score ranging from 99% to 97% under all attack methods.On the other hand, PROMETHEE II is surprising as it can out-compete WSM on vehicle four, five, six, seven and eight.The WSM is very effective at 82% to 91% for the third vehicle; it performs poorly on all other vehicles.All other vehicles are unable to match this performance and so pull down the average F1 score for the whole platoon.PROMETHEE II, on the other hand, outperforms WSM for all other vehicles with F1 scores ranging from 89% to 67% whereas WSM sees its F1 score range between 68% and 66%.WSM and TOPSIS can maintain ideal performance regarding vehicle safety, stability and environmental impact, but when looking at the F1 score, WSM performs poorly.This means that while the WSM can maintain the platoon during the FDI attack, it is not very effective at correctly identifying beacons from member vehicles compared to the fake ones.With around a third of the beacons received by the WSM being mis-identified.With all other vehicles unable to match the first attacked vehicle's performance and, as such, pulling the average F1 score down for the whole platoon.While PROMETHEE II is less capable of maintaining safety and security compared to WSM, it is better overall at identifying real beacons in all members; however, it is less able to identify false beacons correctly, and this is why WSM outperforms it for safety and security.

DISCUSSION
Results show that all three MCDM methods can maintain safe, stable, secure platoons with minimum environmental impact with varying degrees of success.TOPSIS outperforms the rest of the MCDM methods as it consistently performed well for all the aspects.WSM on the other hand match TOPSIS performance from safety, stability, and environmental aspect; however, it fails to accurately identify true beacons from false beacons, which is highlighted clearly by low F1 score.PROMETHEE II is a very different method of MCDM and, as such, performs differently overall.While it was better than WSM in terms of cyber security, the F1 scores are still very low overall.The PROMETHEE II method also performed poorly in safety and stability compared to WSM and TOPSIS as it was unable to maintain ideal platooning when under attack, with the inter-vehicle dropping to as low as 6 m, which put the vehicles at significant risk of collision.
For its robust and reliable performance under the attack models outlined in this article, it is TOPSIS that is the most promising method of MCDM to select beacons to be used in vehicle platooning to prevent FDI attacks.This conclusion is from the above-presented simulation work where the TOPSIS maintained a platoon of eight vehicles under various FDI attacks from between one and six attackers coordinating their attacks on the platoon.As a result, it was able to maintain ideal inter-vehicle distance and speed as well as keep down its CO 2 emissions.Not only that, but it was also extremely effective at correctly identifying the true beacon when under attack, which is important in a security method.

CONCLUSION
Attacks on vehicle platoons are a real threat and potentially cause significant disruption.In this article, we proposed using MCDM, specifically WSM, TOPSIS, and PROMETHEE II, which can significantly reduce the impact of an attack on a platoon, by assessing the input beacon and comparing the beacon's information to past and predicted messages.Thus, by selecting the beacon that the platoon member calculates to be safe to use, MCDM can dampen the effects of the attacker on the platoon, as shown by the simulation results.Furthermore, this article shows that TOPSIS is the best at improving safety in a platoon by maintaining a consistent inter-vehicle distance and speed when under an attack; it is also able to maintain cyber security by identifying and removing all beacons not from a member vehicle.
In future, we will integrate MCDM with other intruder detection methods such as trust to ensure secure propagation of information in presence of attacker within the vehicular platoons.

TA B L E 8
Example showing the evaluative differences of ith alternative concerning all other alternatives (a − b) and then the preference function (R aj ).

3
The attack scenarios used to test MCDM as a security method in platoons.(A) Single attacker attacking multiple platoon members.(B) Multiple attackers attacking multiple member.(C) Multiple attackers attacking a single member.

F I G U R E 4 F I G U R E 5
The average maximum, minimum inter-vehicle distance and average over all inter-vehicle distance.Single attacker, multiple victims: The inter-vehicle distance of each vehicle when a single attacker attacks four members using (A) WSM, (B) TOPSIS, and (C) PROMETHEE II.

6 7
Multiple attackers, multiple victims: The inter-vehicle distance of each vehicle when three attackers attack three platooning vehicles using (A) WSM, (B) TOPSIS, and (C) PROMETHEE II.Multiple attackers, single victim: The inter-vehicle distance of each vehicle when five attackers attack a single platooning vehicle using (A) WSM, (B) TOPSIS, and (C) PROMETHEE II.
Figure 13A-C show the average CO 2 output of each vehicle in the platoon with each attacker model applied.The WSM and TOPSIS again perform identically, with both able to keep all vehicles to the same CO 2 output.PROMETHEE II, however, only has vehicle one (the leader vehicle) outputting the same amount of CO 2 as seen in WSM and TOPSIS.All other vehicles output more CO 2 .The most significant contributor is vehicle three during the attack scenario multiple attackers single victim.When multiple attackers are attacking a single vehicle, vehicle three sees the most significant CO 2 output as it is the directly attacked vehicle and as shown by Figures 7C and 11C.The vehicle cannot hold steady state F I G U R E 12 The average CO 2 output of each platoon.

13
The average CO 2 output of each vehicle in the platoon when using (A) WSM, (B) TOPSIS, and (C) PROMETHEE II.
Average F1 score of each vehicle in the platoon when using (A) WSM, (B) TOPSIS, and (C) PROMETHEE II.

TA B L E 1 FDI attack prevention methods, their advantages and disadvantages. Article Year FDI prevention method PKI IDM Block chain MCDM Advantages Disadvantages
Beacon attributes table.
Example of WSM for selecting, all values are normalized.TOPSIS complete table, all values are normalized.
Note: Unit before normalization: s (mps), a (mps 2 ), ca (mps 2 ), XPos (m), YPos (m), and t (s).TA B L E 5 PROMETHEE II example after normalizing the values.Example of the first four rows for calculating the evaluative differences of ith alternative concerning all other alternatives.
TA B L E 6 Example of aggregated preference function matrix.The entering and leaving flows for the example as well as the net outranking frow.
TA B L E 9