TRUST-V: A Prior-Guided Spatio-Temporal Graph Learning Framework for Cross-Layer Misbehavior Detection in Vehicular Safety Communications

Vehicular safety communications rely on authenticated basic safety messages (BSMs); however, cryptographic authentication cannot prevent compromised insiders from disseminating correctly signed yet malicious information. Existing misbehavior detection systems often rely on individual-message or isolated kinematic analysis, limiting their ability to identify plausible falsifications, identity-based attacks, and coordinated multi-vehicle attacks. In this paper, we propose TRUST-V, a prior-guided spatio-temporal graph learning framework for cross-layer V2X misbehavior detection. TRUST-V first applies physical plausibility, freshness, and transmission-rate checks to remove readily identifiable violations and derive vehicle-level behavioral evidence (Stage 1). It then constructs dynamic interaction graphs in which spatial, mobility, and communication consistency priors explicitly guide graph attention while temporal dependencies are captured through recurrent modeling (Stage 2). Independent multi-label heads enable unified detection of attack classes related to false BSMs, denial-of-service, Sybil-based identity churning, coordinated multi-vehicle misbehavior, replay, identity cloning, and the overlapping behaviors of these attacks. We further develop a high-resolution Network Simulator 3 (NS-3)-generated dataset comprising 830,706 BSM records spanning benign, individual, stealthy, identity-based, compound, and coordinated attack scenarios. Evaluations demonstrate that Stage 1 removes 39.73% of the raw BSM workload while the Stage 2 graph-based analysis identifies most relational behaviors. Experimental results show an overall micro-F1 score of 93.16%, with F1-scores of 93.20%, 97.44%, 93.19%, 88.30%, 98.90%, and 96.94% for False-BSM, DoS, Sybil, Coordinated, Replay, and Identity-Clone attacks, respectively. On a Raspberry Pi 5, the complete online pipeline requires approximately 8.63 ms per 100-ms observation window under the evaluated workload, demonstrating the feasibility of combining physical knowledge with spatio-temporal relational learning for low-latency V2X misbehavior detection.