## 3 Immune Game-Based Abnormal Node Detection Algorithm
### Detailed System Model and Problem Formulation
#### 3.2.2 Node Game Model
In order to reduce energy consumption caused by various data packets sent by nodes during network initialization, device switching of the regional node is carried out only when the remaining energy of regional nodes is lower than the threshold. We use this as a preparation for node recovery [24]. Game considerations between participants \(S\) and \(R\): node \(S\) can be normal or abnormal, represented by \(\theta_{s}=0\) and \(\theta_{s}=1\), respectively. When \(\theta_{s}=0\), the action of \(R\) is \(a_{s}(\theta_{s}=0)\), and when \(\theta_{s}=1\), it is \(a_{s}(\theta_{s}=1)\). \(A_{s}=\left\{a_{s}\right|\ Abnormal,\ \ Normal\ \ \big{\}}\) an action set of \(S\). _Abnormal_ indicates that the node is abnormal and may affect other nodes. _Normal_ means that the node is able to communicate normally. _Detect_ shows that the system is detecting abnormalities. _Idle_ indicates that the system is idle and can be used for recovery. \(A_{R}=\left\{a_{R}\right|\ Detect,\ \ Idle\ \ \big{\}}\) is an action set of \(R\). \(P\) is the probability of node failure, and \(1\)-\(p\) is the probability that the node is healthy. Let \(G\) represent the benefits of nodes, using node energy consumption \(E\) as a cost. When the abnormal node is confirmed, the node yield is \(G_{A}\) and the node energy consumption is \(E_{A}\). When a node selects a normal action, the node packet can be forwarded smoothly. In this way, the node will benefit \(G_{C}\) from the mobile network with a good communication guarantee, and the node energy consumption will be \(E_{C}\). The abnormal node selects the normal action, i.e., waiting for recovery and earning \(G_{B}\). However, in the cooperative process, receiving and forwarding packets consumes the energy of the sensor node, defined as \(E_{B}\). When the abnormal detection agent selects the object action, it gains \(G_{D}\) because it successfully detects the failed node, and the abnormal detection agent must pay the corresponding cost for the energy consumption, expressed as \(E_{D}\). The detection and false-positive rates also exist in the abnormal detection agent, and are represented by \(\alpha\) and \(\beta\), respectively. A false positive is a normal node identified as failed in normal communication, which will cause loss to the abnormal detection agent \(L_{F}\). Matrices (I) and (II) are the node utility matrices, which express the utility benefit of the node. Matrix (I) is the utility benefit of the failed node, and Matrix (II) is the loss of the node. \[\begin{array}{l}U_{S},U_{R}\\[E_{u_{g}}(Idle)=-p\cdot G_{A}+(1-p)\cdot 0=-p\cdot G_{A}. \tag{15}\]  
The expected benefits of fault and cooperation for the failure node \(\theta_{s}=1\) are, respectively,  
\[E_{u_{g}}(Abnormal)=\delta_{k}\cdot p\cdot(\theta_{s}=1|(1-\alpha)\cdot G_{A}- \alpha G_{D}-E_{A})+(1-\delta_{k})\cdot p\cdot(\theta_{s}=1|G_{A}-E_{A}) \tag{16}\]  
\[E_{u_{g}}(Normal)=\delta_{k}\cdot p\cdot(\theta_{s}=1|(G_{C}-E_{C}))+(1-\delta _{k})\cdot(1-p\cdot(\theta_{s}=1|(G_{C}-E_{C}+\lambda G_{C}\varnothing)), \tag{17}\]  
where \(\delta_{k}\) is the probability that the normal detection agent \(R\) will take action \(\varnothing\). The user can reduce the proportion of losses by detecting the abnormal node and recovering it. The weight of the environment is \(\lambda\). It is used when the number of node failures exceeds the threshold.