Two-Tier Anomaly Detection for V2I Alerting on IoT Vehicle Counts: A Kuwait Corridor Benchmark

Abstract

Highlights What are the main findings? Across ten injection seeds, a training-free CUSUM control chart was the most accurate detector of injected traffic-count anomalies (mean F1 = 0.945, perfect precision on every seed), ahead of Isolation Forest and an LSTM autoencoder. In simulation calibrated to the observed traffic, a sub-second edge detector met the 13.5 s vehicle-to-infrastructure (V2I) alerting budget for traffic surges (median 6.8 s at peak rates, robust to signal-cycle platooning), while flow-cutoff detection required roughly 21 s. What are the implications of the main findings? Lightweight, training-free detectors are a practical, competitive alternative to datahungry deep-learning models for low-resource roadside hardware. For timely V2I alerts, the limiting factor is how quickly an anomaly can be detected, not how quickly the alert can be transmitted. Abstract Anomaly detection in vehicular networks focuses on cybersecurity, leaving physical traffic-flow anomalies at urban intersections underserved by IoT sensing. This paper benchmarks anomaly detection on five days of hourly vehicle counts from four consecutive signalized intersections in Kuwait City, with a vehicle-to-infrastructure (V2I) latency feasibility analysis. Anomalies are synthetically injected because verified incident labels are unavailable; scores reflect detectability under the injection protocol rather than validated incident detection. Across ten injection seeds, CUSUM is the most accurate (mean F1 0.945, perfect precision on every seed), Isolation Forest attains the highest recall (0.955), and the LSTM-AE reaches F1 0.347; on misaligned anomaly classes, the margin narrows, and the LSTM-AE matches CUSUM on gradual drift. A corridor rule localizes detected corridor anomalies (9/9, conditional on detection). Hourly aggregation alone imposes an expected 1800 s detection delay, over 130 times the 13.5 s V2I budget at 80 km/h. A sub-second Tier-1 edge detector, evaluated in traffic-calibrated simulation, detects surges within budget (median 6.8 to 9.1 s, robust to signal-cycle platooning), whereas flow-cutoff detection requires roughly 21 s and overnight hours remain a blind spot. Results support a two-tier edge-cloud design and provide, to our knowledge, the first such benchmark on real Gulf-region corridor count data.