Detecting Unknown Cyberattacks on Traffic Management Center in C-ITS

Cooperative Intelligent Transport Systems (C-ITS) improve road safety and traffic efficiency by enabling real-time data exchange among vehicles, infrastructure, and other road users. Given the critical role of the Traffic Management Center (TMC) in orchestrating this ecosystem, its network infrastructure must be resilient to cyber threats. While prior studies have primarily focused on securing vehicles and roadside units, the detection of unknown cyberattacks targeting the TMC remains largely unexplored, and few studies have utilized real-world datasets for this purpose. This article presents a C-ITS demonstration project deployed in South Korea and proposes Flow Identification for C-ITS (FIC), a lightweight anomaly detection method designed to identify previously unseen cyberattacks on the TMC. FIC compresses large volumes of benign network flows into a compact set of prototype flows. Since unknown attacks are unlikely to conform to these prototypes, abnormal flows can be efficiently detected through simple membership testing - eliminating the need for computationally intensive machine learning models. Experimental results on realworld TMC traffic data demonstrate that FIC effectively detects cyberattack attempts with high accuracy and minimal computational overhead.