# A Protocol Layer Trust-Based Intrusion Detection Scheme for Wireless Sensor Networks
## 3 System Model
### Calculation of Network Layer Trust  
Attacks at the network layer aim to disrupt the network routing, and acquire or control the data flows. A malicious node can make itself a part of a routing path by advertising bogus routing messages, such as a good Link Quality Indicator (LQI) or a small hop count. It can also initiate sinkhole or selective forwarding attack and result in dropping all or part of forwarding packets. Therefore, we choose route metric and packet forwarding rate as trust metrics to evaluate the network layer trust. The network layer trust is described as:  
\[T_{ij}^{NET}(t)=q_{1}T_{ij}^{route\_metric}(t)+q_{2}T_{ij}^{PFR}(t), \tag{13}\]  
where \(q_{1}\in[0,1]\), \(q_{2}\in[0,1]\) are weight values and \(q_{1}+q_{2}=1\). The exact values of \(q_{1}\) and \(q_{2}\) depend on the requirements of the detection system under implementation. There are different route metrics for routing protocols in WSNs. For example, in the MintRoute protocol, it uses link estimates as routing metric and includes the LQI within its route update packet [39]. In the TinyAODV (Tiny Ad-hoc On-Demand Vector) protocol, the routing metric is the number of hop count and includes the hop count in Route Reply (RREP) packet [40]. A malicious node can make its neighbors change their current parents and choose it as their new one by advertising an attractive LQI for itself in the route update packet or giving a small value of hop count in RREP packet. We then take LQI and hop count as basis to calculate the route metric trust. We can calculate the deviation of LQI by comparing the actual LQI value with the advertised one. When a monitoring node receives a route update packet from a monitored node, it can calculate the actual LQI value according to \(LQI_{k}^{\prime}=255\times\left(RSSI_{k}+81\right)/91\)[41], where k denotes the k-th route update packet that it received and \(RSSI_{k}\) represents the received signal strength indicator of the k-th route update packet. The monitoring node can obtain the advertised LQI from the route update packet which is denoted by \(LQI_{k}\). Then the average deviation of LQI is calculated by:  
\[D_{LQI}(t)=\frac{1}{m}\sum_{k=1}^{m}\left(LQI_{k}(t-\Delta t,\ t)-LQI_{k}^{ \prime}(t-\Delta t,\ t)\right), \tag{14}\]  
where m denotes the number of route update packets that the monitoring node has received during the time period of \(\Delta t\). Therefore, the LQI trust that node \(i\) evaluates toward node \(j\) can be described as:  
\[T_{ij}^{LQI}(t)=\left\{ \begin{array}{rl}1-\frac{D_{LQI}(t)}{LQI_{max}},& \text{if }\sum_{k=1}^{m}\left(LQI_{k}-LQI_{k}^{\prime}\right)>0\\ 1,&\text{else}\end{array} \right., \tag{15}\]  
where \(LQI_{max}\) equals to 255 in MintRoute protocol [39]. This formula means that the trust degree of the monitored node will decrease if the advertised LQI value is larger than the actual one. If the route metric is hop count, the monitoring node can also evaluate the trust degree of the monitored node by calculating the deviation of hop count. The monitoring node can calculate the average hop count toward destination node according to the RREP packets it has received during the time period of \(\Delta t\). The average hop count is described as \(\overline{\text{hop\_count}}=\frac{1}{n}\sum_{k=1}^{n}hop\_count_{k}\), where n denotes the number of received RREP packets during the observation time and \(hop\_count_{k}\) is the value of hop count to the destination node, which is included in the k-th RREP packet. We can also adopt the method in [42]. Each node builds a node neighbor database which contains the ID of the neighboring node and the hop count to the CH for each node. Thus, we can also calculate the average hop count by \(\overline{\text{hop\_count}}=\frac{1}{n}\sum_{k=1}^{n}\text{hop\_count}_{k}\), where n denotes the number of neighboring nodes.