## 3 Sensor Data Security Estimator
### Proposed Security Metrics
#### 3.2.3 Legitimacy Probability of the Intrusion Detection System
Lastly, note that \(P(M-)=1-P(M+)\), _i.e._, \(P(M-)=1-P_{M}\). Therefore, the legitimacy probability of a node for which a global alarm has been generated, \(P_{L}(alarm)\), can be given by the following equation:  
\[P_{L}(alarm)=P(M-|A+)=\frac{P_{FP}(1-P_{M})}{P_{FP}(1-P_{M})+P_{TP}P_{M}} \tag{19}\]  
Substituting the values of \(P_{TP}\) and \(P_{FP}\) by their respective Equations (13) and (14), \(P_{L}(alarm)\) can be directly derived from the respective hit and miss rates of individual neighbors of a suspected node (\(P_{tp}\) and \(P_{fp}\)). Similarly, we have the following equation for the metric \(P_{L}(\
eg alarm)=P(M-|A-)\) by applying [PERSON] theorem:  
\[P_{L}(\
eg alarm)=P(M-|A-)=\frac{P_{TN}(1-P_{M})}{P_{TN}(1-P_{M})+P_{FN}P_{M}} \tag{20}\]Substituting the values of \(P_{TN}\) and \(P_{FN}\) by their respective Equations (15) and (16), the metric \(P_{L}(\
eg alarm)\) can be directly derived from the respective hit and miss rates of individual neighbors of a suspicious node (\(P_{tn}\) and \(P_{fn}\)). **Obtaining Parameters \(m\), \(N\)**, \(P_{tp}\), \(P_{fp}\), \(P_{tn}\), \(P_{fn}\)** and \(P_{M}\). The consensus parameter \(m\) is set up by the network administrator directly in the IDS, which, in turn, can pass it to SDSE. The number of neighbors of a node (\(N\)) can be obtained by SDSE from the routing algorithm of the WSN. The hit rates (\(P_{tp}\) and \(P_{tn}\)) and miss rates (\(P_{fp}\) and \(P_{fn}\)) of individual neighbors can be obtained by means of experiments in a controlled environment in which attacks are known in advance. In fact, these individual rates are usually published by the authors of each intrusion detection system proposed for sensor networks, but they can also be computed by WSN security administrators. The probability that a given node of the network is malicious, \(P_{M}\), can be easily obtained through offline traffic analysis constantly performed by the IDS itself at a central point, such as the approaches proposed in IDSs [25, 26]. We highlight that SDSE obtains parameters \(m\), \(N\) and \(P_{M}\) in execution time, whereas parameters \(P_{tp}\), \(P_{fp}\), \(P_{tn}\) and \(P_{fn}\) are gathered by SDSE from its database. **Practical Importance of \(P_{L}\)**. This metric can be used offline to help security professionals choose the appropriate value for \(m\), according to the amount of neighbors (\(N\)) of the nodes of the network, in order to ensure the desired security level for the network. Furthermore, \(P_{L}\) can be used to evaluate the impact of parameters \(P_{tp}\), \(P_{fn}\), \(P_{tn}\), \(P_{fp}\) and \(P_{M}\) on the security of the sensors. Moreover, this metric can also be used to compare different intrusion detection systems. When used in real time, this metric can inform users about the security of sensors, which varies with the number of neighbors of a node (\(N\)), the consensus parameter \(m\) and the hit and miss rates inherent to the IDS of the network. **Discussion**. The value of the network base rate (\(P_{M}\)) can greatly vary over time, given that detection mechanisms are able to perform counter measures, such as permanently isolating the malicious nodes from the network through cryptographic keys revocation [21, 27, 28] or simply healing (recovering) the malicious nodes. There are several situations in which malicious nodes can be recovered. For example, nodes that behave maliciously due to software failures or software modifications made by an adversary can be turned into legitimate again by application of node reprogramming [29, 30]. Reprogramming can be performed remotely by a network administrator at the base station. Recovery methods in both hardware and software for malicious or faulty sensor nodes can be seen in [31]. **Restrictions**. SDSE is designed to work only with hybrid IDSs, such as the ones proposed in [26, 32, 33], for example. This is required, because only this type of IDS is capable of providing the network base rate (\(P_{M}\)) to SDSE.