## 3 Sensor Data Security Estimator
### Proposed Security Metrics
#### 3.2.3 Legitimacy Probability of the Intrusion Detection System
Thus, assuming that each individual neighbor has the same hit and miss rates, we can compute the global true positive rate (\(P_{TP}\)) (_i.e._, \(P(A+|M+)\), the probability that a global alarm is generated for a malicious node), from both the individual true positive rate (\(P_{tp}\)) and the individual false negative rate (\(P_{fn}=1-P_{tp}\)), by using the following equation based on the binomial distribution:  
\[P_{TP}=P(A+|M+)=\sum_{i=m}^{N}\binom{N}{i}(P_{tp})^{i}(1-P_{tp})^{N-i} \tag{13}\]  
Likewise, for the case that a global alarm (\(A+\)) is generated for a suspected node that is actually a legitimate node (\(M-\)), we compute the global false positive rate (\(P_{FP}\)) (_i.e._, \(P(A+|M-)\), the probability that a global alarm is generated for a legitimate node), from both the individual false positive rate (\(P_{fp}\)) and the individual true negative rate (\(P_{tn}=1-P_{fp}\)), by using the following equation based on the binomial distribution:  
\[P_{FP}=P(A+|M-)=\sum_{i=m}^{N}\binom{N}{i}(P_{fp})^{i}(1-P_{fp})^{N-i} \tag{14}\]  
On the other hand, if we take \(j\) as the number of neighbors that do not generate an alarm for a suspicious node, for the case that a global alarm is not generated for a node (\(A-\)), it is necessary that at least \(N-m+1\) neighbors have not generated an alarm for that node, _i.e._, \(N-m+1\leq j\leq N\). Thus, if the node is actually legitimate (\(M-\)), then the \(N-j+1\) neighbors that have not generated an alarm have produced a true negative (TN) outcome, while the \(N-(N-j+1)=j-1\) neighbors, which have generated an alarm, have produced a false positive (FP) outcome. Thus, it is possible to obtain the global true negative rate (\(P_{TN}\)) (_i.e._, \(P(A-|M-)\), the probability that a global alarm is not generatedfor a legitimate node), from both the individual true negative rate (\(P_{tn}\)) and the individual false positive rate (\(P_{fp}=1-P_{tn}\)), by using the following equation based on the binomial distribution:  
\[P_{TN}=P(A-|M-)=\sum_{j=N-m+1}^{N}{N\choose j}(P_{tn})^{j}(1-P_{tn})^{N-j} \tag{15}\]  
Likewise, for the case that a global alarm (\(A-\)) is not generated for a suspected node that is actually a malicious node (\(M+\)), we can compute the global false negative rate (\(P_{FN}\)) (_i.e._, \(P(A-|M+)\), the probability that a global alarm is not generated for a malicious node), from both the individual false negative rate (\(P_{fn}\)) and the individual true positive rate (\(P_{tp}=1-P_{fn}\)), by using the following equation based on the binomial distribution:  
\[P_{FN}=P(A-|M+)=\sum_{j=N-m+1}^{N}{N\choose j}(P_{fn})^{j}(1-P_{fn})^{N-j} \tag{16}\]  
From this information, we can finally proceed to the computation of the legitimacy probability (\(P_{L}\)). **Metric Computation**. As we have seen, due to the miss rates of individual nodes, the global decision of an IDS may be incorrect. Hence, in order to evaluate the security status of a node, SDSE defines the legitimacy probability (\(P_{L}\)), which represents the chance of a node being legitimate, given the global decision of the IDS. Depending on this decision, for a given node, \(P_{L}\) can be given by either \(P_{L}(alarm)=P(M-|A+)\) or by \(P_{L}(\
eg alarm)=P(M-|A-)\), as explained earlier in the definition section of this metric. These two probabilities can be derived by the application of conditional probability, more precisely [PERSON] theorem. Beginning with \(P_{L}(alarm)=P(M-|A+)\), we have:  
\[P(M-|A+)=\frac{P(A+|M-)P(M-)}{P(A+)}\Leftrightarrow \tag{17}\] \[P(M-|A+)=\frac{P(A+|M-)P(M-)}{P(A+|M-)P(M-)+P(A+|M+)P(M+)} \tag{18}\]  
Notice that \(P(A+|M-)\) corresponds to the global false positive rate (\(P_{FP}\), Equation (14)), and \(P(A+|M+)\) corresponds to the global true positive rate (\(P_{TP}\), Equation (13)). On the other hand, \(P(M+)\), also known as the base rate [24], corresponds to the fraction of malicious nodes in the network, _i.e._, the probability that a randomly selected node from the network is malicious (\(P_{M}\)).