## 5 Performance Evaluation
### Simulation Results and Analysis  
**Detection Rate:** First, we measure the detection rate against suppression attack rate, number of malicious nodes and \(N_{spkt}\) in Figure 7. Overall, the detection rate of HED can be maintained above 90%. In Figure 7a, the detection rate of HED increases as the suppression attack rate increases. This is because the malicious node shows more multicasting misbehaviors with increasing suppression attack rate, however, these multicasting misbehaviors can be easily detected within adaptively adjusted observation window. The HED with larger \(N_{spkt}\) achieves higher detection rate than that of the HED with smaller \(N_{spkt}\). Since additional spoof data messages can cause the minimum sequence number \begin{table}
\begin{tabular}{l l} \hline \hline
**Parameter** & **Value** \\ \hline Network Area & 150 \(\times\) 150 m\({}^{2}\) \\ Number of Nodes & 51 \\ Communication Range & 30 m \\ Packet Injection Rate & 0.1 packet/s \\ Packet Size & 40 bytes \\ Radio Data Rate & 250 Kbps \\ Channel Error Rate & 10\% \\ Number of Malicious Nodes & 1 to 5 \\ Suppression Attack Rate & 0.0125 to 0.1 time/s \\ Number of Spoof Data Messages & 10 and 15 \\ Simulation Time & 10,000 s \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Simulation parameters. to increase, the HED can easily compare the significant increment of a sequence number within a time period with the heuristically calculated increment threshold of the sequence number to detect multicasting misbehaviors. As the observation window reduces, a higher detection rate is achieved in comparison to a larger observation window. This is because each node can frequently compare the observed increment of a sequence number with the heuristically calculated increment threshold of sequence numbers to detect any multicasting misbehavior. As shown in Figure 7b, the detection rate of HED is not sensitive to the number of malicious nodes. The HED is a stand-alone approach [18] where the same detection scheme is running on each node but no information is exchanged for detection. Thus, each neighbor node of malicious node can record the multicast operations of malicious node and detect the potential multicasting misbehaviors. However, the detection rate is responsive to the length of the observation window, and a higher detection rate is observed with short observation window. In this instance, the multicast operations of a malicious node can be continuously evaluated, and more multicasting misbehaviors can be detected. **Packet Reception Rate (PRR):** Second, the packet reception rate (PRR) is measured against suppression attack rate, number of malicious nodes, and simulation time in Figure 8, in which the MPL without adversary provides the highest PRR, around 90%, and it is used as the upper bound of PRR. In Figure 8a, as the suppression attack rate varies between 0.0125 and 0.1 time/s, the PRR of MPL under the suppression attack with different number of spoof data messages (\(N_{spkt}\)) significantly decreases from 60% and 43% to approximate 15%. This is because the malicious node multicasts spoof data messages more frequently as the suppression attack rate increases, the minimum sequence number stored in the Seed Set increases more often, and less number of valid data messages from the source node will be accepted. Lower PRR is observed with larger \(N_{spkt}\) = 15 under suppression attack. Since more spoof data messages make the minimum sequence number increase greatly and quickly, more valid data messages from the source node will be rejected. The HED provides lower and higher PRR than that of the MPL with and without the suppression attack, because each node records the multicast operations of neighbor nodes within an adaptively adjusted observation window to detect any anomalous increment of the sequence number. Thus, the multicasting misbehaviors of a malicious node can be easily detected, and quickly isolated from the network. The result is that more data messages can be received. As the \(N_{spkt}\) increases, a lower PRR is observed.