## 5 Performance Analysis  
The performance of the \(\Delta T\)_Vector_ extension has been rigorously analysed using the Dixon Q-test [20] as the outlier detection technique to identify tampered \(\Delta T_{i}\) values for a PM I-B wormhole infected route. The Q-test was chosen because of its simplicity and applicability to small and large datasets, making it appropriate for both the CASE 1 and CASE 2 scenarios. While the Q-test is only capable _per se_ of detecting a single outlier, it can be applied to detect either one or two tampered \(\Delta T_{i}\) values provided the right-tailed variant is used to separately test the two largest \(\Delta T_{i}\) values. The outlier test is thus performed by first ranking the \(\Delta T\)_vector_ in order and then respectively calculating two Q values:  
\[Q_{1}=\frac{\Delta T_{HC}\,-\,\Delta T_{HC-1}}{\Delta T_{HC}\,-\,\Delta T_{1}} \tag{9}\]  
\[Q_{2}=\frac{\Delta T_{HC-1}\,-\,\Delta T_{HC-2}}{\Delta T_{HC-1}\,-\,\Delta T_ {1}} \tag{10}\]Time tampering is suspected if either \(Q_{1}\) or \(Q_{2}\) is greater than the corresponding critical \(Q\)-value for the chosen confidence level. For this analysis, a low confidence level (80%) has been chosen, since from a security perspective, a higher time tampering detection rate is preferable to a low FP detection. Both the time tampering and FP detection performance for the \(\Delta T\)_Vector_ extension were analysed using a custom designed tool which simulated differently sized \(\Delta T\)_Vectors_ to reflect variable HC routes. \(\Delta T_{i}\) values were produced by randomly generating packet processing times for each node, with variable inter-node distances considered for each route. The _operating system_ (OS) for each MANET node was assumed to support multiprogramming with a scheduler assigning equal time slices to each process in rotation. Such an OS approximately implements processor-sharing so a logical processor executes each multiprogrammed task, with the processing capacity of a logical processor being the ratio of the physical processor capacity and the multiprogramming level. While nodes will typically have different physical processing capacities and multiprogramming levels, the equivalent multiprogramming level for each node will be relatively stable. A MANET having logical processors with diverse, yet stable processing capabilities is thus assumed to handle routing packets, so the corresponding packet service times for each node is assumed to be constant. Many concurrent route detection procedures can lead to routing packet queues in MANET nodes, since received routing packets must be sequentially processed to uphold route table updating requirements. For this reason, the packet processing times (\(\Delta T_{\mathit{PREQ/RREP}}\)) have been generated using the M/D/1 queuing model [23], which assumes Poisson-distributed packet arrivals, deterministic service times of routing packets, a single central processing unit and an infinite maximum queue length. Hence, at each node:  
\[\Delta T_{\mathit{PREQ/RREP}}=queuing\ \mathit{delay}\ +\ T_{S}\ =\ \frac{T_{S}\ (2-\rho)}{2(1-\rho)} \tag{11}\]  
where \(T_{S}\) and \(\rho\) are the routing packet service time and network traffic load upon a node respectively. Variations in both node processing capacity and multiprogramming level are reflected by using random \(T_{S}\) values from a linear probability distribution of different intervals denoted by the _relative standard deviation_ (\(\sigma_{R}\)), which is the standard deviation of all the packet service times divided by their average. Variable network traffic loads between nodes are mirrored by randomly selecting \(\rho\) on each node within the interval \(0\leq\rho\leq\rho_{max}\), where \(\rho_{max}\) is the maximum network traffic load per node. Time tampering detection performance for the CASE 1 and CASE 2 scenarios will now be respectively considered, where time tampering attacks on TTHCA are simulated in accordance with Equations (7) and (8).