# A Novel Anomaly Behavior Detection Scheme for Mobile Ad Hoc Networks
## 4 Proposed Scheme  
To isolate or detect outliers in MANETs, the cluster zones are observed. Here, \"Re\" is the region chosen for observation during the period from the initial time (T) to the termination time (Tt) in one span. Moreover, \(TW=(T\!i\), \(T\!i\)) is the chosen window. \(T\!i^{-day}_{W}\in\{(T\!i^{\!t}_{i},T\!i^{\!t}_{i}),\,(T\!i^{\!t}_{i},T\!i^{ \!t}_{i}),\,(T\!i^{\!t}_{i},T\!i^{\!t}_{i}),\,\ldots,\,(T\!i^{\!t}_{i},T\!i^{ \!t}_{i})\}\) are the total window sets chosen to observe on the nth day. In the same way, \(T\!i^{-month}_{W}\) and \(T\!i^{\!y-year}_{W}\) are the chosen observed windows during the xth month and yth year, respectively. In the proposed model, unsafe outlier levels escalate with an increase in time and performance. The outliers' steps followed are:  
1. _Calculate the probability of finding a node in a region \"Re\"_ The probability of node \"N\({}_{\text{m}}\)\" existing in a regular region \"Re\" for the period of \(T_{Frame}\in\left\{T\!i^{-day}_{W},T\!i^{-month}_{W},T\!i^{y-year}_{W}\right\}\) in the static slot of \(T_{W}\) per \(T_{Frame}\) is computed as: \[P_{S}^{AVG}=(\mathbf{1}/(T_{Frame}-\mathbf{1})\sum_{v=\mathbf{1},v=w}^{W}P_{S}( \mathbf{N}_{m_{v}}\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\! \!\!\!\!\!\!\!\!\!  
\[V=\sum_{k=0}^{n}\frac{\left(RR_{k}-Avg\right)^{2}}{n} \tag{5}\]  
\[STDEV=\sqrt{V} \tag{6}\]  
Standard deviation (STDEV) is calculated using Equation (6). For instance, nodes X1, X2, X3, and X4 broadcast 10, 10, 20, and 100 request packets per second, respectively. X4 is a malicious node. The computed average (Avg), Variance (V), and STDEV are 35, 1425, and 38, respectively. An outlier has an anomaly score lower than a specific threshold. Algorithms 1-3 are used to calculate the threshold value and for the identification of anomalous node behavior, while Algorithm 4 is used for cluster head selection and identifying outliers by using a threshold value. Algorithm 1 works for the IDLE link and describes the variation in the threshold for a local event. The anomaly score (\(\textbf{{Current}}_{Anomaly}-\textbf{{Last}}_{Anomaly}\)) is matched with the STDDEV anomaly score value of nodes in the network. ```
1. if (\((\textbf{{Current}}_{Anomaly}-\textbf{{Last}}_{Anomaly})<STDEV_{Network}\))
2. \(\textbf{{Current}}_{Threshold}=STDEV_{\textbf{{UPTO}}}\_{\textbf{{CURRENT}}}\_ {\textbf{{Anomaly}}}\)
3. \(\textbf{{Last}}_{Anomaly}=\textbf{{Current}}_{Anomaly}\);
```  
**Algorithm 1**Threshold limit for a local event if a link is IDLE  
Algorithm 2 considers the QoS parameters (such as link capacity, bandwidth, throughput, packet delivery, end-to-end delay, and energy consumption) in threshold limit calculation. High throughput, link capacity, and bandwidth, as well as lower end-to-end delay and energy consumption, are adequate for a robust network. Algorithm 3 explains the scenario where the anomaly score's threshold limit is calculated when packet loss or drop is high. In a high-packet-loss or -drop scenario, the value of the anomaly's score varies exponentially until the packet loss or drop is beyond a threshold. The threshold value of packet loss or drop is the average value of the network's packet loss or drop. ```
1. If ((packet loss or drop) > QoS_negative_threshold)
2. While((packet loss ) < QoS_negative_threshold)
3. Set t=0
4. If (t=0)
5. \(\textbf{{Last}}_{Anomaly}=\textbf{{Current}}_{Anomaly}\)
6. \(\textbf{{Else}}\)
7. \(\textbf{{Last}}_{Anomaly}=2^{\textbf{{*}}}\textbf{{Last}}_{Anomaly}\)
8. Else
9. No change in \(\textbf{{Last}}_{Anomaly}\)
```  
**Algorithm 4** explains the scenario of identifying the outliers and the selection of cluster heads. The node with the highest energy is selected as a cluster head, and a threshold value is used to identify outliers. This information about the outlier and a node is communicated to the cluster head, as well as to neighbor nodes, in order to avoid communication through the victim node. By doing so, this energy is preserved for nodes at different levels, ensuring the optimization of resources.