SPADE

SPaT Attack Detection and Evaluation dataset

Requirements

• Java 17
• Maven 4.0.0
• Eclipse MOSAIC 25.2
• SUMO 1.28.0
• Python 3 with pyproj

Ensure Eclipse MOSAIC folder is placed next to the SPADE project folder as shown

├── SPADE
│   ...
│   ├── application
│   ├── scenarios
│   │   ├── 2lane3way
│   │   ├── 2lane3way-test
│   │   └── ...
│   ├── README.md
│   └── run_spade.sh
├── eclipse-mosaic-25.2
│   ...
│   └── mosaic.sh

MOSAIC scenarios are each within their respective folders under scenarios/. Java application code is contained within the application folder. run_spade.sh discovers scenario folders in scenarios/ by their scenario_config.json and mapping/mapping_config.json files. Folders whose names end in -test use TEST_SEEDS; other folders use SEEDS.

Execution

1. Execute permissions chmod +x ./run_spade.sh

2. Build and distribute application jar ./run_spade.sh build

3. Generation script dry run DRY_RUN=1 ./run_spade.sh

4. Run a smoke test with one low-density run per scenario and attack/benign class, using the first seed: ./run_spade.sh test

5. Run the full dataset generation ./run_spade.sh

6. Clean up script metadata files ./run_spade.sh clean

Processing Generated Data

After generating runs under data/, convert their application CSV logs into SPADE records with:

python3 process_spade.py

By default, the script reads data/ and writes per-vehicle JSON files to processed/spade_records/. Use --input and --output to change these paths.

• Records are generated at 10 Hz with vehicle, perception, and received-message data.
• Vehicle, traffic-light, and intersection/RSU identifiers are replaced with deterministic pseudonyms scoped to each run. Reprocessing the same run produces the same identifiers, while identifiers differ across runs; references in CAM, shared-perception, SPaT, and MAP data stay consistent.
• The latest CAM and shared-perception snapshot per transmitting vehicle is retained for 2 seconds; older snapshots are removed. Override this with --message-ttl-seconds.
• Vehicle CSV logging starts within 100 m of the nearest MAP intersection and continues until the vehicle has passed it and is more than 100 m away.
• Attack schedules emit one attack tick in every five-second block with a randomized run phase; the processor checks for a 20% attack split (default tolerance: 5 percentage points).
• Replay, Sybil, and Impersonation use standalone RSUs; other attacks replace the traffic-light app.
• Received attack messages are labeled individually; attack intervals are also recorded.