## 3 Proposed Solution
### Recovery from Attacks  
Every sensor node is being examined by agents that execute one of the algorithms for detecting attacks, which reside on nodes in its vicinity and listen to its communication. The agents are trained separately. The system of agents is coupled with a reputation system [18] where each node has its reputation value that basically reflects the level of confidence that others have in it based on its previous behavior. In our proposal, the output of an agent affects the reputation system in such a way that it assigns lower reputation to the nodes where it detects abnormal activities and _vice versa_. We further advocate avoiding any kind of interaction with the low-reputation nodes: to discard any data or request coming from these nodes or to avoid taking them as a routing hop. In this way, compromised nodes remain isolated from the network and have no role in its further performance. After this,additional actions can be performed by the base station, e.g., it can revoke the keys from the compromised nodes, reprogram them, _etc._  
In this work the reputation is calculated in the following way: \(f_{th}\) is taken to be 1 for the following reasons. Considering that the attacks will often result in the creation of new n-grams, it is reasonable to assume that the extracted vector in the presence of attackers will not be a subset of any vector extracted in normal situation, thus the distance will never be lower than 1. We further define two reputation values, _repQE_ and _repMD_ based on the previously defined _QE_ and _MD_ values and afterwards joint reputation rep used for updating overall reputation based on these two values:  
if (QE < 1) { repQE = 1; }  else { repQE = 1 - QE/2; }  if (MD < 1) { repMD = 1; }  else { repMD = 1 - MD/2; }  The value (rep) for updating overall reputation is calculated in the following way:  
if (QE > 1) { rep = repQE; }  else { rep = repMD; } There are two functions for updating the overall reputation of the node, depending whether the current reputation is below or above the established threshold that distinguishes normal and anomalous behavior. If the current reputation is above the threshold and the node starts behaving suspiciously, its reputation will fall quickly. On the other hand, if the reputation is lower than the established threshold, and the node starts behaving properly, it will need to behave properly for some time until it reaches the threshold in order to \"redeem\" itself. The first objective is provided by the function x + log(1.2x). Finally, the reputation is updated in the following way:  
if (last_rep[node] > threshold) {  new_rep[node] = last_rep[node] + rep + log(1.2 * rep); }  else {  new_rep[node] = last_rep[node] + c_limit * (rep + log(1.2 * rep)); } The second objective is provided by the coefficient _c_limit_, which takes values lower than 1 and its purpose is to limit selective behavior of a node by decreasing the reputation growth if the reputation value is below the threshold. Very low values of this coefficient obligate nodes to behave properly most of time. If the final reputation value falls out from the [0, 1] range, it is rounded to 0 if it is lower than 0 or to 1 in the opposite case. The threshold value can be set to the middle of the reputation value range (50 in our case) at the starting point. However, this value depends on many different factors. One of the most important factors is risk, and the threshold value is proportional to it: if the operation in the network (or in some of its parts) is critical, the threshold value should be higher, and _vice versa_. Thus, a process that evaluates risk should be able to update the threshold value. However, if during the testing of temporal coherence, we get normal data different from those that the clustering algorithms saw during the training, it is possible to get high _QE_ value as well. On the other hand, the spatial coherence should not detect any anomalies. Thus, the final reputation will fall only if both spatial and temporal algorithms detect anomalies.