## 9 Simulation Results  
In this section, we study the performance of the proposed intrusion detection system against selective routing attacks using GloMoSim simulator [49]. In our simulation scenarios, each malicious node launches a selective routing attack with probability \(P\) for each packet that it receives. To simulate a lossy wireless channel, we assume the Two-Ray path loss propagation model. In this model, the received power \(P_{r}\) is modelled as: \(P_{r}=P_{t}G_{t}\frac{R_{r}^{2}H_{r}^{2}}{D^{4}}\) where: \(P_{t}\) is the transmission power. \(G_{t}\) and \(G_{r}\) are antenna gains of transmitter and receiver respectively. \(h_{t}\) and \(h_{r}\) are the heights of both antennas. \(D\) is the distance between the transmitter and the receiver. The packet reception model is based on the signal to noise ratio (SNR) threshold. When the SNR is larger than a defined threshold, the signal is received without errors. Otherwise, the packet is dropped. The simulation parameters and their values are shown in Table 2. We generate the topology of the network using the NetLogo library [50], as shown in Figure 7. \begin{table}
\begin{tabular}{|l|c|} \hline
**Parameters** & **Values** \\ \hline Number of nodes & 50 \\ Dropping probability & 1, 0.8, 0.5, 0.2, 0.1, 0.05, 0.04, 0.03, 0.02, 0.01 \\ Monitoring period (\(\Delta\)) & 10 s \\ Training period (\(T\)) & 3, 5, 10, 20, 30, 40, 50 \(\times\Delta\) \\ Transmission power (\(P_{t}\)) & 5 dBm \\ \(G_{t}\), \(G_{r}\) & 0 dB \\ \(h_{t}\), \(h_{r}\) & 1.5 m \\ SNR Threshold & 10 db \\ \hline \end{tabular}
\end{table} 
Table 2: Simulation Parameters. Figure 7: Network topology. Each node generates ten packets/second towards the sink, and each monitoring period lasts for 10 s. After a training phase of \(T\) time periods, testing phase lasts for 1800 s. The role of the IDS, which is implemented at each node \(i\), is not just to detect if \(i\)'s neighbor (e.g., node \(j\)) is malicious or not, but also to know whether node \(j\) is malicious during a given time period. The dataset that is produced from the simulation can be found in [51]. We evaluate the performance of the IDS using the following six metrics:  
\[Accuracy=\frac{TP+TN}{TP+TN+FP+FN}\]  
\[Precision=\frac{TP}{TP+FP}\]  
\[Recall=\frac{TP}{TP+FN}\]  
\[F-score=\frac{2(Precision\times Recall)}{Precision+Recall}\]  
\[False\text{\ positive\ rate}=\frac{TP}{TP+FN}\]  
\[False\text{\ negative\ rate}=\frac{FN}{TP+FN}\]  
where \(TP\), \(TN\), \(FP\), and \(FN\) denote the true positives, true negatives, false positives, and false negatives, respectively. Figure 8a shows the values of \(N_{Low}\) that are observed by a given node in the network while monitoring one of its neighbors. At lower training periods, \(N_{Low}=99\) and it stabilizes at 98 starting from \(T=30\). Figure 8b-e show the recall, precision, accuracy, and F-score of the proposed IDS, respectively, as a function of dropping probability. The first observation we can draw from the figure is that the recall is 100% when the dropping probability is higher than 0.05, and it is under 100% when the dropping probability becomes 0.02 and 0.01. This can be explained, as follows: under very low dropping probabilities, the malicious nodes perform at low intensities and their activities become unnoticeable. This happens when it is difficult to distinguish between packet loss due to normal activities and packet drop attack, and we can notice this when the dropping probability becomes very close or less than the normal packet loss, which is, at most, 2% during each time period. The same observation can be made from Figure 8c-e. However, they record lower results compared to recall results due to the effect of false positives. Figure 8f-h show the recall, false negative rate, and false positive rate of the IDS, respectively, as a function of the training period. The results are presented under the following levels of dropping probability \(P=1,0.5,0.1,0.05,0.01\).