## 3 Sensor Data Security Estimator
### Proposed Security Metrics
#### 3.2.3 Legitimacy Probability of the Intrusion Detection System  
**Metric Definition**. SDSE defines legitimacy probability (\(P_{L}\)) as the chance of a node being legitimate (that is, not malicious), given the result of the evaluation of the security status of that node performed by the IDS. IDS's evaluation of a given node can have two possible results: (1) the node is identified as malicious and an alarm is raised (\(A+\)); or (2) the node is identified as legitimate and no alarm is raised (\(A-\)). In turn, a node can have two possible states: (I) malicious (\(M+\)); or (II) legitimate (\(M-\)). Thus, depending on the outcome of the IDS, \(P_{L}\) can be computed by one of the two following ways:  
* \(P_{L}(alarm)=P(M-|A+)\): the probability that a node is legitimate (\(M-\)), given that the IDS has raised an alarm (\(A+\)) for that node or;
* \(P_{L}(\
egalarm)=P(M-|A-)\): the probability that a node is legitimate (\(M-\)), given that the IDS has not raised an alarm (\(A-\)) for that node. **Features and Vulnerabilities of Intrusion Detection Systems**. Intrusion detection systems analyze network traffic in order to identify malicious activity. Whenever an attack is identified, the IDS raises an alarm to inform the base station. In fact, given the distributed nature of sensor networks, it is interesting that the intrusion detection process is performed by the network nodes themselves, in a distributed and cooperative manner. Such an approach allows the IDS (as a whole) to deal with malicious nodes that try to either hide from detection or raise false intrusion alerts. More specifically, in a distributed, cooperative detection approach, each node monitors its neighborhood, looking for suspicious behavior. Once a suspicious activity is detected, a collaborative process in which neighboring nodes exchange information about the suspected node is started. In this collaborative process, each neighbor node must indicate whether they consider the suspected node as malicious or not. This indication is normally performed via the generation of individual alarms, _i.e._, in order to indicate that a suspected node is malicious, a neighbor will raise an alarm (\(a+\)) for that node. On the other hand, in order to indicate that a suspected node is not malicious, a neighbor will not raise any alarm (\(a-\)) for that node. At the end of the collaborative process, a suspected node is classified by the IDS as truly malicious when at least \(m\) (consensus parameter) of its \(N\) neighbors has raised an alarm (\(a+\)) for it. If this is the case, the IDS generates a global alarm (\(A+\)) for the suspected node and sends it to the base station, so that the appropriate counter measures can be taken. However, intrusion detection systems are subject to errors in the detection process and can, therefore, either incorrectly accuse legitimate nodes of being malicious or mistakenly classify malicious nodes as legitimate. Given the two possible states of a node, malicious (\(M+\)) or legitimate (\(M-\)), the two possible outcomes of each individual neighbor, alarm (\(a+\)) or no alarm (\(a-\)), can be classified into one of the four following cases:  
1. True positive (TP): alarm properly generated for a malicious node;
2. False positive (FP): alarm wrongly generated for a legitimate node;
3. False negative (FN): alarm wrongly not generated for a malicious node;
4. True negative (TN): alarm properly not generated for a legitimate node. As the evaluation is initially performed individually by each neighbor, one can run some experiments in order to compute the amount of hits and misses performed by each neighbor. This can be done in a controlled environment in which the attacks are known beforehand. In such experiments, several attacks are performed on the sensor network, and the outcomes of the evaluations performed by each individual neighbor are then classified into one of the four possible cases mentioned (TP, FP, FN, TN). From these values, we can compute the miss and hit rates of each neighbor.