## 4 Experimental Evaluation  
### Simulation Environment  
The proposed approach has been tested on a simulator of sensor networks developed by our research group and designed using the C++ programming language. We have decided to design a simulator mainly because there is no available testbed for security applications in sensor networks. Attacking recorded data from a testbed does not significantly differ from the simulation. What's more, the available testbeds for wireless sensor networks contain a relatively small number of sensors (100 at most), in which case the data obtained from our simulator are more complex (simply because there are more sensors). For these reasons, we believe that until a testbed for security applications in WSNs appears, a simulator is a better choice for testing security applications. We further evaluated two well-known WSN simulators, ns-2 [21] and Castalia [22] over Omnet\({}^{++}\)[23]. Yet, we eventually decided to implement our own simulator, TRSSim. This simulator implements only the basic functionality of the communication layers, rather than implementing all layers in detail, which anyhow is not very important for our application. This significantly reduces the total simulation time, which was our main reason for implementing the simulator. In the following we will describe the characteristics of the simulator that are pertinent for understanding the results of this work. The experiments, however, do not rely on any TRSSim-specific data or constraint and they can be replicated easily with other simulators.  
The network is organized as clusters of close sensors where each group has its cluster head, as is often done in real networks in order to reduce computational overhead and energy consumption. Cluster heads are the only sensors that can participate in the communication between different clusters and also in routing. The mobility model is random-based, _i.e._, nodes can move randomly in any direction towards a random destination, with the restriction of the maximal distance between the current position and the destination. The maximal distance in our case is 20% of the distance between the current node position and the base station in order to avoid the situation where the node ends up at the position of the base station.  
In this work we will present the results based on the Sybil attacks [10], where the malicious node pretends to have multiple IDs, either false, _i.e._, fabricated, or impersonated from other legitimate nodes, _i.e._, stolen IDs. Added malicious nodes send random values that may or may not coincide with the values sent by the original good nodes. Since in this work we are dealing with unknown attacks, clustering algorithms are trained with data that have no trace of attacks. The performance of the approach when attacks are present during the training can be found in our previous work [11, 14, 16]. Thus, we can say that the attack is unknown to the algorithm. In our work both Sybil nodes and the compromised nodes whose IDs have been stolen are treated as malicious. Although the compromised nodes do not perform any malicious activity, we believe they should remain isolated until the security response system deals with the attack, e.g., until the base station changes their ID.  
The proposed algorithm has been tested on the presented simulated sensor network that contains 40 sensor nodes that can be placed in 100 different positions. The network simulates a sensor network for detecting presence in the area of application. The groups for spatial characterization are formed in the following way: close sensors that should give the same output are placed in the same group.  
The duration of the experiment is 1000 time ticks. One time tick in simulator is the period of time required to perform the necessary operations in the network, and it is equivalent to a sampling period, or time epoch in sensor networks. In the following we will present results in different scenarios varying the attack strength.