# A Protocol Layer Trust-Based Intrusion Detection Scheme for Wireless Sensor Networks
## 3 System Model
### Calculation of MAC Layer Trust  
Next we calculate the MAC layer trust. There are variety of attacks initiated at this layer whose main objective is to get the priority of channel access. A malicious node can select a small back-off time, choose a small size of contention window (CW), or wait for shorter interval than distributed inter-frame spacing (DIFS), aiming to gain significant advantage in the contention of channel over the unmalicious nodes. Therefore, the interval time between two consecutive successful transmissions of malicious node, which we define as idle time, will be less than that of the unmalicious node. The malicious node can also scramble the frames sent by other nodes in order to obtain the priority of channel access. As a result, the average number of retransmissions of the malicious node will be less than that of the unmalicious node. As described above, we choose two important parameters, the idle time and number of retransmissions, as the trust metrics at the MAC layer. Thus, at the MAC layer, the node \(\mathrm{i}\) evaluates the trust value of node \(\mathrm{j}\) as:  
\[\mathrm{T_{ij}^{MAC}(t)}=\mathrm{p_{1}}\mathrm{T_{ij}^{idle\_time}(t)+\mathrm{ p_{2}}\mathrm{T_{ij}^{num\_ret}(t)}}, \tag{5}\]  
where \(\mathrm{p_{1}}\), \(\mathrm{p_{2}}\) are the weight values associated with the two trust components, \(\mathrm{p_{1}}\in[0,1]\), \(\mathrm{p_{2}}\in[0,1]\), and \(\mathrm{p_{1}}+\mathrm{p_{2}}=1\). The exact values of \(\mathrm{p_{1}}\) and \(\mathrm{p_{2}}\) depend on the requirements of the detection system under implementation. In order to calculate \(\mathrm{T_{ij}^{idle\_time}(t)}\), the monitoring node \(\mathrm{i}\) can obtain the idle time \(\mathrm{x_{k}}\) (\(\mathrm{k}\) means the \(\mathrm{k}\)-th transmission of the monitored node) according to Request To Send (RTS)/Clear To Send (CTS) access in Distributed Coordination Function (DCF) mode, and \(\mathrm{x_{k}}\) can be calculated by:  
\[\mathrm{x_{k}}=\mathrm{t_{k}}-\mathrm{t_{k-1}}-\mathrm{t_{SIFS}}-\mathrm{t_{ ACK}}, \tag{6}\]  
where \(\mathrm{t_{k}}\) denotes the time of the \(\mathrm{k}\)-th RTS packet reception, \(\mathrm{t_{k-1}}\) is the end time point of the reception of the previous data segment, \(\mathrm{t_{SIFS}}\) is the duration of the Short Inter-Frame Spacing (SIFS) frame, and \(\mathrm{t_{ACK}}\) is the duration of Acknowledgement (ACK) frame, as illustrated in Figure 2.  
For an unmalicious node, \(x_{k}=t_{DIFS}+b_{k}\), where \(t_{DIFS}\) is the duration of DIFS frame, and \(b_{k}\) is the random back-off time. A malicious node is trying to decrease the idle time by manipulating the back-off time and DIFS period. Therefore, the monitoring node can detect these misbehaviors by calculating the deviation of the idle time. We can obtain the average idle time of the CH, according to:  
\[\overline{x}=t_{DIFS}+\overline{b}=t_{DIFS}+\frac{1}{u}\sum_{k=1}^{u}b_{k}, \tag{7}\]  
where \(u\) denotes the number of successful transmissions by the CH during the observation period of \(\Delta t\). We then calculate the deviation of the idle time:  
\[D_{\text{idle\_time}}(t)=\frac{1}{m}\sum_{k=1}^{m}(x_{k}-\overline{x}), \tag{8}\]  
where \(m\) is the observed number of successful transmissions of the monitored node. Therefore, the relative deviation of the idle time can be expressed as:  
\[RD_{\text{idle\_time}}(t)=\frac{|D_{\text{idle\_time}}(t)|}{\overline{x}} \tag{9}\]  
and the idle time trust is calculated by:  
\[T_{\overline{ij}}^{\text{idle\_time}}(t)=\left\{ \begin{array}{rl}1-RD_{ \text{idle\_time}}(t),&\text{if }\sum_{k=1}^{m}(x_{k}-\overline{x})<0\\ 1,&\text{else}\end{array} \right.. \tag{10}\]  
It means that the trust value of the monitored node will decrease if its idle time is less than the average idle time. In order to calculate the number of retransmissions trust \(T_{\overline{ij}}^{\text{num\_retr}}(t)\), we first calculate the deviation of the number of retransmissions of the monitored node \(j\).