# DDTMS: Dirichlet-Distribution-Based Trust Management Scheme in Internet of Things
## 4 Simulations and Analysis
### Node Interaction Based on Dirichlet Distribution
With the restoration of normal interaction, after nearly 1000 rounds, the trust value slowly increased to 70% of the trust value before the attack. It can be found that the trust value control of the malicious node that launched the attack is relatively rational as described above. (3) There is the trust value change of each node in a single cluster. It is assumed that there are five sensor nodes and one cluster head node in the cluster. The connectivity state and behavioral  
Figure 4: Trust value changes for interaction between a normal node and a malicious node. Figure 3: Trust value change for interaction between normal nodes. interaction of these five sensor nodes are shown in the matrix below. The matrix consists of five sensor nodes, where nodes 1-4 are normal nodes, node 5 is a malicious node. Non-zero means that data is reachable (connected) between nodes, 1 means normal interaction, 2 means abnormal interaction. \[\Phi=\left[ \begin{array}{ccccc}0&1&0&1&0\\ 1&0&1&0&2\\ 0&1&0&0&2\\ 1&0&0&0&2\\ 0&1&1&1&0\end{array} \right] \tag{12}\]  
where, in simulating the environment, we initially set with a total of 600 rounds of interaction, 200 interactions per round. The interaction type is as shown in Equation (12). The node sends the calculated trust value of other nodes to the cluster head, and the cluster head performs unified summary statistics to obtain the trust value change of each cluster member as shown in Figure 5.  
As shown in Figure 5, the cluster head node obtains the comprehensive statistics based on the collected nodes in the cluster. The cluster head node is more consistent for the evaluation of the four normal nodes, and the stability is between 0.8 and 0.9. When the malicious node launches attacks on three normal nodes in 100 th rounds, according to the trust value received by the cluster head, the trust value of the malicious node--that is, the black curve in the Figure 5--drops rapidly.Because the trust value and the average level have a huge gap, it is quickly detected as a malicious node, which largely guarantees the security of the IoT. In terms of the indirect trust, DDTMS deployedthe third-party recommendation. In [PERSON] et al. (2018) [PERSON], et al. constructed a test messages to evaluate the trustworthiness of those suspicious nodes, more specifically, the test messages were'bogus'consultation requests to make difficult to be distinguished from real consultation requests. The content of test messages varies depending on the type of the intrusion. The testing node had known before hand the true diagnosis result of the test message and uses the received feedback to derive a trust value for the other nodes. For three behaviors--success, failure, and uncertainty--we introduce the corresponding behaviors will be weighted <\(w_{s}\), \(w_{f}\), \(w_{u}\)> to limit the measurement of each behavior by custom. Similarly, in DDTM, a penalty factor was defined to decrease the trust value of malicious node. In DTMS-IoT, the third-party recommendations were considered unless direct observations were not credible. Except without the third-party recommendation, in DDOA, the system control center first trained the initial reputation levels of the local agents based on the collected historical observations, and persistently observed and evaluated these local agents' behaviors. [PERSON] and [PERSON] used LOF algorithm to detect the abnormal behavior of nodes. This algorithm did not  
Figure 5: Trust value changes for interaction between nodes in a cluster. forcibly define the anomaly as having a binary characteristic. Instead, it specified a local anomaly factor for each data, and used the local anomaly factor to represent the degree of abnormality of the data. The local anomaly factor became larger, it was considered to be more likely to be abnormal; otherwise, the probability of an abnormality was small. The LOF algorithm only needed one parameter \(k\), which is a natural number, which was the minimum number of points used to define its neighbor nodes for a given datum.