## 5 Results and Analysis for Sybil/Bogus Prevention Algorithms
### Bogus & Sybil Enhanced Behavior Processing & Footprint (B&SEBP&F) Algorithm
 } & \multirow{3}{*}{**Crossing No 0**} & \multirow{3}{*}{**Crossing No 1**} \\  & & & & & & & & \\ \hline
1 & 1 & 18.73 & 32.90 & 10 & 1 & 0.0901 & 3 & 2 \\ \hline
2 & 2 & 3.062 & 35.65 & 10 & 5 & 0.33 & 7 & 7 \\ \hline
3 & 1 & 3.24 & 34.65 & 10 &  
The number of attackers varied from 20 up to 100. The time needed to identify the first attacker decreased significantly up to 78%. In Figure 13, a different scenario, one in which there are no regular users on the road, is presented. Even without having victim nodes, the time needed to identify the first attacker decreased, due to the implemented method, which focuses on the node behavior. Finally, Figure 14 shows the situation when there is up the equal number of regular users and attackers. The time needed to identify the first attacker was satisfactory. Figure 11: Results from experiments no. 4, 5, 6, and 7 (experiments can be found in Tables 3–7); the graph presents different scenario when the number of users increased significantly as well as number of attackers; the ratios between the attackers and users were 1.96%, 9.05%, 33%, and 50%. Figure 10: Results from experiments no. 1, 2, and 3 (experiments can be found in Tables 3–7). Figure 14: Results from experiments no. 16, 17, 18, and 19 (experiments can be found in Tables 3–7); the graph presents the situation when there are equal numbers of regular users and attackers. Figure 12: Results from experiments no. 8, 9, 10, and 11 (experiments can be found in Tables 3–7); according to Figure 11 the same number of users were involved—100; the number of attackers varied from 20 up to 100. Figure 13: Results from experiments no. 12, 13, 14, and 15 (experiments can be found in Tables 3–7); the graph presents a different scenario in which there are no regular users on the road. Part of the results obtained from [19; 32; 34; 37; 40; 41; 43; 45; 46] were coupled into a single table and compared with the algorithm implemented by the authors (Table 8 and Figure 15). The results obtained by other authors varied from 30 up to 140 ms in case of high network load. However, some of the authors obtained significantly worse results, even with the small attacker-victim ratio. The average ratio between normal drivers and attackers varied from 5% up to 100%; the average ratio oscillated about 30%. In the case of the RABTM method, the ratio varies between 5% and 33%. In comparison to the method presented in the fourth chapter, the number of false positives was the same. However, the results obtained via the B&SEBP&F algorithm was three times better than the mentioned algorithm. In the case of the DMV method, the results obtained are similar to the one acquired by the created algorithm. The motion trajectories similarity algorithm mentioned the test cases when number of attackers reached number of victim nodes. In those scenarios, the B&SEBP&F algorithm gave significantly better results, having a detection time that was three times better. However, the number of false positives was larger than that in methods mentioned by other authors. RSUs cooperation reached results two times worse than those of the presented approach. For 90% of presented experiments, the number of false positives was nearly 0 or detected as about 1 false positive. After several tests were conducted, the following assumptions were deduced:  
* In cases where the number of ordinary vehicles was lower than the number of attackers, the time of detection of the first attacker decreased significantly. * The time of detection of the first attacker lengthened only in the cases of experiments 12-14, where the number of attackers was higher than the number of ordinary vehicles. * The time of detecting all attackers was reduced by approximately one-third. * The speed of cars affects the outcome of experiments.