## 3 Proposed Solution
### Feature Extraction and Formation of Model  
Our idea is to find temporal and/or spatial inconsistencies in sensed data in order to detect manipulated data and/or compromised nodes. For this reason, we follow the idea presented in [11, 12], based on extracted n-grams and their frequencies within different time windows. Thus, the vectors used for characterization that allow the deployment of machine learning are composed of the extracted n-grams. For the purpose of illustration, we will give a short example for a sensor that detects presence. Let a sensor give the following output during the time window of size 20: 1 1 1 1 0 0 0 0 0 0 1 1 1 1 1 1 0 0 0 0. If we fix the n-gram size on 3, we extract all the sequences of size 3 each time moving one position forward. In this way we can observe the following sequences and the number of their occurrences within the time window: 111--occurs six times, 110--two, 100--two, 000--six, 001--one, 011--one. Thus, the extracted vector that corresponds to this time window contains the following features: 111--0.33, 110--0.11, 100--0.11, 000--0.33, 001--0.06, 011--0.06. In our model, the sequences are the features and their frequencies are the corresponding feature values. Thus, the sum of the feature values is always equal to 1. In our algorithm this characterization, _i.e._, the extraction of vectors, is performed at predefined moments of time and takes the established amount of previous data, e.g., we can perform the characterization after every 20 time periods based on the previous 40 values.  
In a similar fashion, we form features for spatial characterization. The first step is to establish vicinities of nodes that historically have been giving consistent information. Furthermore, since an agent is supposed to reside on a node, vicinities are established using the nodes whose information can reach the agent. In this way, an n-gram for spatial characterization in a moment of time is made of the sensor outputs from that very moment. For example, if sensors S1, S2, S3 that belong to the same group each give the following output: 1 1 1 0 during four time epochs, we characterize them with the following set of n-grams (each n-gram contains at the first position the value of S1, the value of S2 at the second and the value of S3 at the third at a certain time epoch): 111--occurs three times, 000--occurs once, thus the feature value of each n-gram is: 111--0.75, 000--0.25, _i.e._, the frequencies within the observed period of time.  
We develop the same principle for characterizing routes that a node has been using to send its sensed data to the sink. Each routing hop adds its ID to the message that is further forwarded, so the sink has the information about the routing path together with the message. However, this is not performed with each message in order to avoid the overhead in the communication channel. Yet, considering that one routing path is usually used more than once, it is reasonable to assume that the sink will have all the paths used for routing the data from a certain sensor. As previously mentioned, each sensor has its own model and each feature, _i.e._, n-gram in the model consists of a predefined number of successive hops used in routing information coming from the node. For example, if during the characterization time, the node has used the following paths for routing its data to the sink: A-B-C-S--three times, A-D-E-F-S--two times, A-B-E-F-S--one time (A--the node that is sending the data, B, C,... --other nodes in the network, S--sink), we can characterize the routing with the following n-grams (n = 3): ABC, BCS, ADE, DEF, EFS, ABE and BEF. In all of the routes, the n-gram ABC occurs three times, BCS--three, ADE--two, DEF--two, EFS--three, ABE--one, BEF--one. The total number of n-grams is 15, so dividing the values given above with 15, we get the frequencies of each n-gram which are the values that we assign to our features, _i.e._, n-grams.