## 5 Protection Against Vampire Attacks in Routing
### Monitoring Information Aggregation Utilizing Bayesian Network  
Based on information collected from the detection mentioned above, it is possible and necessary to calculate \"faith\" about a suspicious node's trustworthiness. Since the suspicious nodes might be part of a carousel attack or stretch attack, or even both (with more than one suspicious behavior), here we introduce a Bayesian learning network to aggregate and further analyze gathered information. A Bayesian network is a probabilistic graphical model representing a set of random variables and their conditional dependencies (represented by conditional probabilities), exhibited by a directed acyclic graph (DAG). Our Bayesian network contributes to modeling a set of nodes in terms of their status (comprised or not) and behaviors. It can be utilized to predict the most likely status of a node based on past observation records of its behaviors. In order to calculate this prediction, one method is the maximum likelihood approach. It is the learning process of the Bayesian network from data collected. These data can be used to estimate a Bayesian network's parameters that can denote the status of the nodes. Note that the datasets do not have to be complete, as we usually obtain incomplete ones from real networks. This approach is based on the likelihood principle, which favors the predictions (or estimates) with maximal likelihood. In other words, it prefers predictions maximizing the probability of observing the collected datasets [47]. Naturally, alternatives are available to this learning process, such as the Bayesian approach or constraint-based approach. They are capable but either require more input or have additional constraints [47]. The practical Bayesian network employed in this paper is illustrated in Figure 4. It is aimed to examine a node's \"health\" status (compromised or not), denoted by variable H. Two symptoms are considered here: one is \"node is part of a route loop\" (denoted by variable L), and another is \"route is part of a stretched route\" (denoted by variable S). These variables are binary, represented by \(T\) (true) or \(F\) (false) for those pre-defined variables H, L and S.  
Figure 4 only shows a visualized structure, the details on learning for information aggregation is given as follows: Table 2 shows an example of incomplete datasets \(\mathcal{D}\) that have three different recorded data cases: \(\textbf{observation}_{1}\), \(\textbf{observation}_{2}\) and \(\textbf{observation}_{3}\). A data case refers to a record of a set of symptoms exhibited by a node, in other words, a record with a certain combination of instantiation (\(h\), \(l\) and \(s\)), where symptom parameters \((h,l,s)=(T,T,T)\) denote that this node has not been compromised and are used to participate in a route loop formulation and a stretched route before, respectively. Furthermore, \((h,l,s)=(F,F,F)\) denote that this node has been compromised and not used to participate in any route loop as well as stretched route before, respectively. The symbol \"?\" here denotes the undetermined values of variables. The goal is to calculate the expected empirical distribution of nodes status H based on the incomplete dataset. Table 3 demonstrates assumptions of some initial estimates based on common sense; for instance, a compromised node is more likely to have participated in the formulation of a route loop or stretched route in the previous routing discovery process. The expected empirical distribution of an incomplete dataset \(\mathcal{D}\) is defined as follows:  
\[F_{\mathcal{D}}(\alpha_{t})\stackrel{{\text{def}}}{{=}}\frac{1}{N_ {ds}}\sum_{\textbf{observation}_{i},\mathbf{c}_{i}=\alpha_{t}}F(\mathbf{c}_{i}|\textbf{ observation}_{i}) \tag{13}\]  
where \(\alpha_{t}\) is an event consists of certain combination of instantiations \((h,l,s)\), \(N_{ds}\) is the size of data set and \(\mathbf{c}_{i}\) are variables with undetermined values of case \(\textbf{observation}_{i}\).