## 3 General Concept and Passive Detection  
The general idea of our proposed resource-conserving protection against energy draining (RCPED) protocol to prevent vampire attacks is illustrated in Figure 1. It is composed of a passive detection phase (for more details, see Sections 3.1 and 3.2) and active detection phase (further addressed in Section 4).  
This solution is designed to be cost-effective (e.g., more energy-efficient). Therefore, it would not make sense to enable the active detection of malicious nodes at the very beginning. Instead, only passive detection with less cost of resources is operating first. The passive detection integrates with the existing routing process to continually monitor the network and sense abnormal signs without additional actions. Similar to other on-demand solutions, active detection would not be triggered until abnormal network behavior is recorded by passive detection. Once active detection is enabled, it tries to trace back to the nodes that are likely to participate in vampire attack attempts. The rest of the network nodes are notified afterward to stop suspicious nodes from participating in future data communications.  
The approximate energy cost of transmitting a data packet in between any specific node and a stationary observation point, denoted by \(E(M)\), has a functional relationship with the number of nodes (denoted by \(M\)) in the network [30]. Once the exact function showing the relationship between \(E(M)\) and \(M\) is determined, we can estimate the expected average transmission cost linked to a specific node density in a normal case. Please note that the term \"normal case\" here refers to the condition when no attacks are occurring in the network.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Papers** & **Main Topic** & **Comments** \\ \hline \multirow{3}{*}{[15]} & \multirow{3}{*}{Resource depletion attacks} & Introduction to resource depletion attacks, such as denial of service (DoS) attacks and forced authentication attacks. \\ \cline{2-3}  & & DoS attacks threatening WSNs & General studies on DoS attacks. \\ \hline \multirow{3}{*}{[19]} & \multirow{3}{*}{Reduction in quality (RoQ) attacks} & General studies on RoQ attacks, a downgraded version of distributed DoS attacks. \\ \cline{2-3}  & & Can offer protection against RoQ attacks. However, most of them can only be applied on transport layer and not in the routing layer. \\ \hline \multirow{3}{*}{[23, 24, 25, 26, 27, 28, 29]} & \multirow{3}{*}{Power-draining attacks} & General discussions on power-draining attacks. This is a subcategory of resource depletion attacks. \\ \cline{2-3}  & & General discussions on vampire attacks. This is an instance of power-draining attacks. \\ \hline \multirow{3}{*}{[13]} & \multirow{3}{*}{Vampire attacks} & Both are clean-slate secure sensor network routing protocol that can offer protection against vampire attacks. However, they rely heavily on cryptographic methods and may incur extra energy costs. \\ \cline{2-3}  & & Both are clean-slate secure sensor network routing protocol that can offer protection against vampire attacks. However, they rely heavily on cryptographic methods and may incur extra energy costs. \\ \hline \hline \end{tabular}
\end{table}
Table 1: Summary of Related Works.  
On condition that the estimations mentioned above are accomplished, the transmission cost of incoming packets at the observation point can be determined by continuously monitoring data communications in the network. If the average of these tracked costs is significantly higher than that of the estimations in the \"normal case,\" an attack is probably occurring. This process is called passive detection since it is performed without interfering with the normal operation of the network. Passive detection is an instance of anomaly detection [31] to detect sensors' suspicious behavior. Consequently, there are two issues to be addressed: (1) how to define the \"normal case\"; and (2) how to define an abnormal deviation. Details are provided below.