## 4 Analysis of the Proposed Countermeasure  
In this section, we analyze the HED in terms of average miss detection rate. When multiple spoof data messages are frequently lost because of the bad channel quality, however, a series of spoof data messages may not cause the increment of sequence numbers to be larger than the heuristically calculated increment threshold of sequence numbers, resulting in miss detection. In Figure 4, a malicious node \(n_{m}\) multicasts a series of spoof data messages with continuous sequence numbers \(``pkt[s_{min},s_{new}]\) within a time period between \(t_{begin}\) and \(t_{end}\) to a legitimate node \(n_{a}\). Due to the bad channel quality, multiple spoof data messages can be lost during the transmission from \(n_{m}\) to \(n_{a}\). Then, \(n_{a}\) may observe an increment of sequence numbers to be smaller than the heuristically calculated increment threshold, which results in a miss detection. In this analysis, we assume that the bad channel quality in terms of channel error primarily causes packet loss, and the channel error rate (\(r_{cer}\)) is set to 10%.  
Figure 5: The pseudo code of MPL protocol and the proposed HED scheme.  
Let \(P_{miss}\) be the average miss detection rate observed in the observation window, which can be expressed as  
\[P_{miss}=1-\sum_{i=0}^{N_{atk}}P_{det}^{i}\cdot P_{atk}^{i} \tag{4}\]  
where  
\[P_{atk}^{i}=\binom{i}{N_{atk}}\cdot R_{atk}^{i}\cdot(1-R_{atk})^{N_{atk}-i} \tag{5}\]  
\[P_{det}^{i}=\sum_{N_{lat}=0}^{N_{spf}^{i}-th_{seq}}\binom{N_{lat}}{N_{spf}^{i} }\cdot r_{cer}^{N_{lat}}\cdot(1-r_{cer})^{N_{spf}^{i}-N_{lat}} \tag{6}\]  
\[N_{spf}^{i}=N_{spkt}\cdot i \tag{7}\]  
Here, \(N_{atk}\) is the total number of times that the malicious node decides whether to perform suppression attack and broadcast a series of spoof data messages, \(R_{atk}\) is the suppression attack rate, and \(N_{lst}\) is the number of spoof data messages that get lost during transmission due to bad channel quality, \(N_{spkt}\) is the number of spoof data messages broadcasted by malicious node in each attack, and \(th_{seq}\) is the heuristically calculated increment threshold of sequence numbers. \(N_{spf}^{i}\) is the number of spoof data messages broadcasted by malicious node during the \(i\) number of suppression attacks. \(P_{atk}^{i}\) is the probability that the malicious node performs the \(i\) number of suppression attacks during the observation window. \(P_{det}^{i}\) is the detection rate of the \(i\) number of suppression attacks.  
In Figure 6, we show a numerical result of the impact of the total number of times that the malicious node decides whether to perform suppression attack \(N_{atk}\) and the heuristically calculated increment threshold of sequence numbers \(th_{seq}\) on the average miss detection rate based on the aforementioned analyses. Here, we assume the length of observation window is 50 s. As shown in Figure 6, when \(th_{seq}\) decreases, the miss detection rate decreases significantly. This is because the malicious node broadcasts a large number of spoof data messages and causes the minimum sequence number to increase greatly, and these multicasting misbehaviors can be easily detected with a smaller \(th_{seq}\). As \(N_{atk}\) increases, the malicious node has more chances to perform suppression attack and multicast a series of spoof data messages within the observation window, which makes the minimum sequence number increase quickly, thus, the HED can easily compare the significant increment of a sequence number with the heuristically calculated \(th_{seq}\) to detect multicasting misbehaviors.  
Figure 6: Miss detection rate against the total number of times that the malicious node decides whether to perform suppression attack.