Securing Vehicular Ad Hoc Networks via Digital Twin-Driven Anomaly Detection and Graph Reinforcement Learning

Vehicular Ad Hoc Networks (VANETs) support critical safety and coordination functions in Intelligent Transportation Systems by enabling vehicles to exchange real-time information. Applications like collision avoidance, cooperative awareness, and traffic optimization depend on reliable Vehicle-to-Vehicle (V2V) communication. However, VANETs remain vulnerable to security threats such as blackhole attacks, message falsification, and data injection due to their dynamic topology and limited interaction durations. While machine learning-based approaches have been applied to anomaly detection in VANETs, most rely on static features or vehicle-level trust, and lack post-detection control strategies. This paper proposes a real-time VANET security framework implemented within a Digital Twin (DT) environment that mirrors the network operation. The framework integrates time-series-based anomaly detection with post-detection mitigation using Graph Reinforcement Learning (GRL). A transfer-learned temporal model, pre-trained on large public data and fine-tuned on simulation outputs, classifies V2V messages based on dynamic behavioral patterns. While a GRL agent observes the evolving communication graph and learns to prune or preserve links to reduce the impact of malicious or misclassified messages. Unlike existing approaches, the system directly addresses false positives and false negatives by learning corrective control policies over time. We implement this framework using OMNeT++, SUMO, and Veins, and evaluate its performance across several road topologies and attack scenarios. Results show improved resilience and reliability compared to detection-only baselines. An ablation study further highlights the value of GRL in enhancing system performance under challenging conditions, achieving a 3.2% improvement in F1-score over a state-of-the-art anomaly detection baseline.