The document describes a method to identify an attacking vehicle using streaming data analytics. Wireless signals from vehicles are collected by multiple road side units and used to calculate the vehicle's position through trilateration. Features like velocity are extracted from the position estimates over time. The features are processed through a streaming analytics pipeline using Apache Kafka and classified with a machine learning model to identify attacking vehicles. The positions and identifiers of attacking vehicles are filtered from the stream and stored.