## 3 Countermeasure to Suppression Attack
### HED: Heuristic-Based Detection Scheme
For example, as shown in Figure 2b, suppose a malicious node (\(n_{m}\)) multicasts a series of spoof data messages with continuous sequence numbers in range of \(s_{min}\) to \(s_{new}\) within a time period between \(t_{begin}\) and \(t_{end}\), denoted by \({}^{*}pkt[s_{min},s_{new}]\), to its neighbor nodes. When a legitimate node (e.g., \(n_{a}\)) receives \({}^{*}pkt[s_{min},s_{new}]\), it updates the corresponding entry in the \(MT\), \(MT_{a}[m].fs=s_{min}\), \(MT_{a}[m].t_{fp}=t_{begin}\), \(MT_{a}[m].ls=s_{new}\), and \(MT_{a}[m].t_{lp}=t_{end}\). In this example, we implicitly assume that the time period of multicast operations, (\(t_{end}-t_{begin}\)), is within the observation window \(\omega\). However, our approach is not dependent on this assumption and (\(t_{end}-t_{begin}\)) is not required to be within \(\omega\). Second, we modify the Seed Set (\(SS\)) and introduce an additional component: increment rate of the minimum sequence number within observation window. Thus, the Seed Set \(SS\) consists of four components: identifier of source node (\(nid\)), minimum sequence number that the node is willing to receive (\(s_{min}\)), lifetime of the Seed Set entry (\(t_{life}\)), and increment rate of the minimum sequence number within observation window (\(R_{inc}\)). Here, the \(R_{inc}\) in Seed Set brings only an extra 2 bytes of overhead in the memory. \(R_{inc}\) indicates how much the minimum sequence number has increased per second, and it is updated by the low pass filter with a filter gain constant \(\alpha\),  
\[R_{inc}=\alpha\cdot R_{inc}+(1-\alpha)\cdot R_{rec}^{k}. \tag{1}\]  
The basic idea of Equation (1) is that \(R_{inc}\) is calculated with the currently observed increment rate of the minimum sequence number within observation window and historical statistics of increment rate of the minimum sequence number. Here, a historical statistics of increment rate of the minimum sequence number is represented by \(R_{rec}^{k}\), which is the most recently calculated increment rate of minimum sequence number, and it can be expressed as,  
\[R_{rec}^{k}=\frac{ls^{k}-fs^{k}}{t_{lp}^{k}-t_{fp}^{k}}. \tag{2}\]  
The basic idea of Equation (2) is to divide the increment of sequence number (\(ls^{k}-fs^{k}\)) by the elapsed time period (\(t_{lp}^{k}-t_{fp}^{k}\)) within \(k^{th}\) observation window. Thus, the increment rate of the minimum sequence number \(R_{inc}\) can be expressed as,  
\[R_{inc}=\alpha\cdot R_{inc}+(1-\alpha)\cdot\frac{ls^{k}-fs^{k}}{t_{lp}^{k}-t_{ fp}^{k}}. \tag{3}\]  
Here, \(\alpha\) is a system parameter and its changes (\(\alpha\in[0.2,0.8]\)) and impacts on the increment rate \(R_{inc}\) are also observed in Section 5. Third, at the end of each observation window, each node examines its multicast trace table with an increment rate of the minimum sequence number in the Seed Set to detect any anomalous increment of sequence numbers that was caused by potential multicasting misbehaviors. If the recent increment of sequence numbers within observation window is larger than the heuristically calculated increment threshold of sequence numbers, the corresponding multicast operations are suspected as a multicasting misbehavior and the number of detected multicasting misbehaviors (\(c_{mis}\)) of suspected node is increased by one. Additionally, the observation window of the suspected node is reduced by half, \(\frac{\omega}{2}\). When the \(c_{mis}\) reaches a threshold value \(\varphi\), the node broadcasts an _Isolate_ packet to its all one-hop neighbor nodes to prevent neighbor nodes from accepting any message from the suspected node. In Figure 4, for example, a malicious node (\(n_{m}\)) multicasts a series of spoof data messages with continuous sequence numbers \({}^{*}\)_pkt\([s_{min},s_{new}]\)_ within a time period between \(t_{begin}\) and \(t_{end}\) to a legitimate node (\(n_{a}\)).