Behavior‐Aware Machine Learning Framework for Geolocation Integrity Verification in <scp>VANET</scp> Environments

ABSTRACT Vehicular Ad Hoc Networks (VANETs) depend primarily on accurate location data to enable connected driving and traffic safety. However, these systems still struggle with spoofing, falsification, and malicious behavior‐based impacts. In a highly dynamic vehicular environment, even minor disturbances in reported positions can crash the entire network and lead to incorrect safety decisions. Existing intrusion detection systems (IDSs) commonly rely on single‐sensor thresholds and computationally intensive models. Such threshold‐based models fail to detect hidden attacks and are not suitable for resource‐constrained environments. This study is the first to suggest the usage of a load‐free model to meet future VANET demand. Motivated by the need for continuous trajectory monitoring, low‐latency decision‐making, and behavior‐aware detection, this work introduces a lightweight, effective geolocation integrity framework for real‐time VANET operations. A feather‐inspired (quill) model that combines the strength of advanced lightweight modules. Recent studies highlight the requirement for behavior‐aware security techniques to detect signal anomalies in vehicle movement patterns. However, most existing solutions either lack temporal behavioral modeling or suffer from high computational load. To avoid these challenges, we suggest using our QuillNet model in real‐time VANET environments. The novelty of the QuillNet depends on its unified integration of noise reduction, temporal behavioral learning, and lightweight classification within a single pipeline. The main aim of QuillNet is to detect multiple spoofing and false‐location signals by maintaining low computational cost for resource‐constrained vehicular platforms. QuillNet integrates the strengths of a tiny denoising autoencoder (T‐DAE), a long‐term‐short‐term autoencoder (LSTM‐AE), and a lightweight, float‐efficient Light Gradient Boosting Machine (LightGBM) classifier for real‐time attack detection. This hybrid design is effective against both sudden falsification and slow drift attacks. The model is evaluated on the publicly available “VANET Malicious Nodes dataset,” combined with synthetic geolocation‐spoofing attacks. Through comprehensive experiments and comparative analysis, the proposed model demonstrates its efficiency, achieving 98.8% overall detection accuracy with an average detection latency of 0.18–1.5 s.