## 2 Related Work  
### Intrusion Detection Schemes for Selective Routing Attacks  
The selective routing attack has been widely studied in the literature. In order to counter the selective routing attack, [PERSON] et al. [28] suggested sending the same packet on a set of disjoint paths. However, this method shows poor security resilience if there is at least one compromised node along each disjoint path. It also incurs high communication overhead and high energy consumption when the number of paths increases. In [11], each node counts the number of packets not forwarded by its downstream node. If this number exceeds a given threshold, then an alarm is raised. In [10], each node counts the number of packets not forwarded by its neighbor node within a time window; if the majority of monitoring nodes produce an alarm regarding the same node, the latter will be considered to be malicious. This method incurs a communication cost of \(O(N)\), where \(N\) is the number of nodes in the network. In [23], each node calculates the received power rate and the arrival packet rate of its upstream neighbor. [PERSON] et al. [12] proposed an intrusion detection system based on collaboration between neighbor nodes. They built a profile of the monitored node that consists of two features: (i) packet dropping rate, defined as: the number of packets sent to a certain node during a predefined period of time but not forwarded by that node and (ii) packet forwarding rate, defined as the number of packets received from its neighbors and consequently forwarded to its parent node during a predefined period of time. Each measured profile is then broadcast to its neighbors. In this way, the monitoring node can have different records on the same monitored node and can select the most accurate one. The main drawback is that it is not explained how accurate records are selected and how it is possible to detect unfair records provided by dishonest nodes. [PERSON] et al. [13; 17] proposed a scheme that chooses some nodes as checkpoints along the path. When a checkpoint node receives a packet, it sends an acknowledgment (ACK) packet to the source node via its upstream neighbor. If any intermediate node does not receive enough ACK packets from its downstream neighbor during a time period, then it suspects that the packets have been dropped by a downstream malicious node. In addition, each node uses a one-way hash key chain to ensure the authenticity of packets. The problem with this scheme is that it consumes considerable energy on sending acknowledgement packets and it does not seem suitable for resource-constrained WSNs. If \(L\) is the average path length, then there is a need to forward \(O(|CHK|L)\) ACK packets for each data packet, where \(|CHK|\) is the number of checkpoint nodes along a path. If \(L\) is proportional to \(\sqrt{N}\) and \(m\) data packets are generated during each time period, then the overall message complexity of this scheme for \(N\) nodes is \(O(|CHK|\times m\times N^{\frac{3}{2}})/\text{time period}\). In addition, it might detect the existence of malicious activities but cannot identify exactly which node is malicious. [PERSON] and [PERSON] (2016) proposed a cluster-based scheme in order to detect selective routing attack using a heterogeneous WSN consisting of a few high-end sensor nodes (H-sensors or cluster heads) and a large number of Low-end sensor nodes (L-sensors). The detection procedure is as follows: each monitoring node passively listens to its downstream node. If the latter drops a packet, then the monitoring node (L-sensor) will include the ID of the dropper node in a packet and send it to the cluster head via another route. Based on the reports, the cluster head performs the sequential probability ratio test, which calculates the percentage of dropped packets in all forwarding packets, to check whether the L-sensor is compromised or not.