# A Novel Anomaly Behavior Detection Scheme for Mobile Ad Hoc Networks
## 5 Simulation Results
### Comparative Analysis of the Proposed Approach with Existing Mechanisms  
Table 3 presents the comparative account of detection ratios when the number of nodes is varied. The ADR value decreases in the 1000-node network, reaching a minimum value of 66.5% due to nodes being silent after control packet transmission. The value of WCAR for the 1000-node network is maximal--i.e., 16%; hence, the rise is observed when the number of nodes varies from 200 to 1000. In addition, the ADR value is greater than  
ALADR when the number of nodes increases, because outliers are detected that do not belong to a local subgroup.  
The proposed scheme performs better than the other schemes [26; 33] described in the literature, considering the comparison parameters of ALWCAR, ADR, ALDR, and WCAR. DD-ZRP performs better at the local subgroup level and network level, as shown in Tables 4 and 5, respectively.  
To summarize, in this work outliers are detected in resource-constrained key management networks, and a lightweight key management network is constructed to ensure confidentiality, authentication, and integrity in outlier detection. The work is an extension of [PERSON] and [PERSON]'s model, in which outlier detection is incorporated to construct a secure network. The hybrid approach of DD-ZRP was designed by integrating three well-accepted protocols proposed by [PERSON] and [PERSON] [1], [PERSON] et al. [2], and [PERSON] et al. [3]. The simulation was performed using NS-3, and the proposed algorithms take link state and QoS parameters such as packet drop and energy consumption in the network into consideration in order to detect outliers. To identify outliers in a network, cluster zones in the network were put under observation.  
Algorithm 1 explains the variation in threshold limit for the local event if the link is IDLE; in this algorithm, the anomaly score is compared with the threshold value to identify outliers. Algorithm 2 observes the QoS parameters in threshold limit calculation. QoS parameters such as throughput, link capacity, bandwidth, and packet delivery are considered for positive results, while end-to-end delay and energy consumption are considered for negative results. Higher positive results or lower negative results are acceptable for high-performing networks. Algorithm 3 explains the scenario where the anomaly score's threshold limit is calculated when packet loss or drop is high. In a high-packet-loss or -drop scenario, the value of the anomaly's score varies exponentially until the packet loss or drop is beyond a certain threshold. In this work, along with outlier detection at the local level, outliers are also identified at the network level.  
On comparing the network outlier detection threshold with the average value of the local threshold, if the network threshold value is lower than it is recomputed after days and weeks to record observations. This process keeps going on until the network threshold value is higher than the average value of local subgroups, as a network must have an equal or higher number of nodes compared to the total number in all subgroups. Algorithm 4 selects the node with the highest energy as the cluster head, and by comparing the route reply of a node with the threshold, an outlier is detected and an alert to the cluster head and the neighboring node is set. The results are compared with the studies of [PERSON] et al. [26] and [PERSON] et al. [33], using the ADR, WCAR, ALADR, and ALWCAR parameters at the subgroup and network levels.