## 4 Active Detection
### Detection of Suspicious Routes  
Once active detection is triggered in the network, route records (nodes identities are involved, such as nodes number) of future incoming data packets are stored in a buffer at observation points. This information is recorded in a fixed-sized data buffer operating in FIFO (first-in-first-out) manner, as shown in Figure 3. Information associated with the first packet will be the first to be removed once the buffer is full.  
Figure 3: Format of data buffer.  
Figure 2: Process of trilateration.  
Ideally, an observation point intends to acquire transmission records from every node in the network at least once, which means all possible routes have been tested. We can keep as many records as possible if the data buffer is large enough, and records from every node can be obtained at the end of the day. However, in practice, the storage available for data buffer is limited. Under the assumption that sufficient records are likely to be acquired, the data buffer's size is preferably as small as possible.  
In order to determine the minimum necessary buffer size, the following event is defined: Every node in the network has transmitted data to an observation point at least once. Suppose after \(k_{t}\) transmissions are exercised (meaning \(k_{t}\) transmission records are stored in the buffer), this event is satisfied at the probability of \(P_{e}\); thus, the probability of its complementary event (transmission from a specific node has never been recorded) is no more than \((1-P_{e})\):  
\[\left(\frac{M-1}{M}\right)^{k_{t}}\leq 1-P_{e} \tag{10}\]  
where \(M\) is the number of nodes in the network, and \(\frac{M-1}{M}\) is the probability that the transmission record of any specific node has not been acquired (under the assumption that the probability of any node in the network communicating with observation point is identical); hence, \(k_{t}\) has to satisfy the following.  
\[k_{t}\leq\frac{\log(1-P_{e})}{\log\left(\frac{M-1}{M}\right)} \tag{11}\]  
Therefore, the minimum necessary size of the buffer is \(\left\lceil\frac{\log 0.01}{\log\left(\frac{M-1}{M}\right)}\right\rceil\), where \(\left\lceil\ \ \right\rceil\) refers to ceiling function. Take an example, assume \(P_{e}=0.99\), nodes number is \(M=50\) and the minimum necessary data buffer size is supposed to be \(\left\lceil\frac{\log 0.01}{\log\left(\frac{\log 0.01}{\log\left(\frac{\log 0.01}{ \log\left(\frac{\log 0.01}{\log\left(\frac{\log 0.01}{\log\left(\frac{\log 0.01}{\log 0.01}\right)} \right)}\right)}}\right\rceil=228\).  
Inspired by the route rebuilding concept proposed by author of [46], suppose all information of suspicious routes found in buffer is denoted by \(B_{1},B_{2},...,B_{N_{b}}\), where \(N_{b}\) refers to the total number of detected suspicious routes. Therefore, a comprehensive vector \(\mathcal{B}\) can be constructed as follows:  
\[\mathcal{B}=\left[B_{1},B_{2},...,B_{N_{b}}\right] \tag{12}\]  
any specific row in \(\mathcal{B}\) is further defined as \(B_{V}=\{V_{m}:1\leq m\leq|B_{V}|\}\) ( \(|\) refers to the number of elements in this set), where \(V_{m}\) represents each node on route \(B_{V}\) and \(V\) is an integer that satisfies \(1\leq V\leq N_{b}\).  
It is worth noting that records in the data buffer are not static. As data transmissions are occurring, the data buffer constantly updates itself. Thus, \(\mathcal{B}\), extracted from the data buffer, is a \"live\" vector and renews itself actively as time goes by.