## 6 System Architecture
Registering devices: The device discoverer is responsible for registering a newly discovered node that wants to become part of the CPS network. It gathers pertinent data about the new node, such as its exact location, identification information (such as MAC address and node ID), and additional characteristics. Authenticating devices: The device discoverer verifies the legitimacy of each node's request through authentication procedures before having registered it. This is an essential step in preventing malicious or unauthorized devices from pairing with the network. Updating BRGTL: Following a successful device registration and authentication, the device discoverer modifies the global trust list that the blockchain-based trust-management system keeps up-to-date. To monitor its actions and contributions to the network, the details of the new node are added to the list, along with any available trust metrics. Tracking node activity: The device discoverer continuously monitors the CPS network for any node activity, including nodes entering and leaving the network. Monitoring node status: The device discoverer regularly checks the status of registered nodes to ensure their proper functioning and responsiveness. Handling departure of nodes: The device discoverer deletes a node from the list of active nodes and modifies its status in the BRGTL when it departs the CPS network. Detecting malicious nodes: An important function of the device discoverer is to identify potentially malicious nodes in the network by constantly tracking node behavior and activity. The trust analyzer receives reports of any odd or unusual behavior for additional analysis and suitable action. Logging: Every node activity, such as fresh node registrations, exits, and any unusual behaviors found, is recorded by the device discoverer. Integration with other modules: The device discoverer exchanges data regarding node actions and trust status with the other elements of the framework, including the trust analyzer and calculator and the eliminator. It offers vital information for processes related to threat prevention and trust-based decision making. By functioning as a comprehensive node activity tracker and coordinator, the device discoverer module enhances the overall security and management of the CPS network. Its ability to identify and respond to new node entries and departures contributes to the dynamic and adaptive nature of the framework in detecting and mitigating blackhole and greyhole attacks. Trust Parameter Accumulator: The trust parameter accumulator operates in the fog layer to collect and aggregate trust parameters received from the device layer. Its primary function is to gather all relevant trust-related data from the device layer (root node) and combine them for further processing by the trust analyzer and calculator module. The processed trust parameters are also forwarded to the blockchain ledger updater module. The trust parameter accumulator module acts as a vital intermediary between the device layer and the trust analysis components at the fog layer. By efficiently collecting, aggregating, and pre-processing the trust parameters, it enables accurate and timely evaluation of node behavior. Trust Analyzer and Calculator: At the fog layer, fog servers with strong computational capability are set up. On the basis of the received parameters, the trust calculator executes Gini index-based logic and calculates the Gini value, which determines whether the node's behavior is malicious or normal. If the Gini value is \(>\)0.5, then the behavior is attributed to an attack, and if the Gini value is \(<\)0.5, then the node is treated as a normal node. However, it is noteworthy that for critical/sensitive requirements, only nodes with lower Gini values, preferably closer to zero, would be allowed to form the DODAG. It is possible to tell the difference between nodes with a regular distribution pattern and those with malicious intent by looking at their distribution patterns.