## Evaluation
### Node Expertise  
Similarly to former studies, this work also considered three expertise levels for a CIDN node: low (0.1), medium (0.5) and high (0.95). The IDS's expertise can be modeled by means of a beta function as shown below:  
\[\begin{split}& f(p^{\prime}|\alpha,\beta)=\frac{1}{B(\alpha, \beta)}p^{\prime\alpha-1}(1-p^{\prime})^{\beta-1}\\ & B(\alpha,\beta)=\int_{0}^{1}t^{\alpha-1}(1-t)^{\beta-1}dt\end{split} \tag{1}\]  
where \(p^{\prime}(\in[0,1])\) describes the probability of an IDS in examining an intrusion, and \(f(p^{\prime}|\alpha,\beta)\) describes the probability that an IDS node at the expertise level \(l\) responds in \(p^{\prime}\) to an intrusion examination of difficulty level \(d(\in[0,1])\). A higher \(l\) value means a larger probability of correctly detecting an intrusion, while a higher \(d\) value means that an intrusion is harder to identify. Further, \(\alpha\) and \(\beta\) can be set as below:  
\[\begin{split}&\alpha=1+\frac{l(1-d)}{d(1-l)}r\\ &\beta=1+\frac{l(1-d)}{d(1-l)}(1-r)\end{split} \tag{2}\]  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Parameters** & **Value** & **Description** \\ \hline \(\lambda\) & 0.9 & Forgetting factor \\ \(\varepsilon_{l}\) & 10/day & Low request frequency \\ \(\varepsilon_{h}\) & 20/day & High request frequency \\ \(r\) & 0.8 & Trust threshold \\ \(T_{s}\) & 0.5 & Trust value for newcomers \\ \(m\) & 10 & Lower limit of received feedback \\ \(d\) & 0.3 & Severity of punishment \\ \hline \hline \end{tabular}
\end{table}
Table 1: Simulation parameters in the experiment.  
where \(r\in\{0,1\}\) is the expected result of the detection. Regarding a fixed difficulty level \(d(\in[0,1])\), the node with higher expertise should have a larger probability of correctly identifying an intrusion. For instance, a node with an expertise level of 1 can accurately identify an intrusion if the difficulty level is 0.  
**Node Trust Evaluation**  
An IDS node can send a challenge periodically to measure the reputation of a tested node. A satisfaction level can be derived on the basis of the difference between the expected answers and the received feedback. As a result, the trustworthiness of a node \(i\) according to node \(j\) can be computed as below:  
\[T_{i}^{j}=(w_{s}\frac{\sum_{k=0}^{n}F_{k}^{j,i}\lambda^{tk}}{\sum_{k=0}^{n} \lambda^{tk}}-T_{s})(1-x)^{d}+T_{s} \tag{3}\]  
where \(F_{k}^{j,i}\in[0,1]\) represents the satisfaction level of a received feedback \(k\), \(n\) is the total number of received feedbacks, \(\lambda\) is the _forgetting factor_ by allocating more weight to recent answers, and \(w_{s}\) is the _significant weight_, which relies on the number of received feedbacks. If the number of received feedbacks is below a minimum threshold \(m\), then \(w_{s}=\frac{\sum_{k=0}^{n}\lambda^{tk}}{m}\); otherwise \(w_{s}=1\); \(x\) is the percentage of \"don't know\" replies for a period of time; \(d\) is a positive incentive parameter, which is used to control the severity of the punishment to \"don't know\" replies. For the detailed equation derivation, we refer to [6; 7].  
**Satisfaction Evaluation**  
We let \((e\in[0,1])\) denote an expected feedback and \((r\in[0,1])\) denote a true received feedback. A function \(F(\in[0,1])\) can be defined to calculate the satisfaction level by identifying the difference between the the expected feedback and the received feedback [7]:  
\[F=1-(\frac{e-r}{max(c_{1}e,1-e)})^{c_{2}}\quad e>r \tag{4}\]  
\[F=1-(\frac{c_{1}(r-e)}{max(c_{1}e,1-e)})^{c_{2}}\quad e\leq r \tag{5}\]  
where \(c_{1}\) and \(c_{2}\) control the degree of penalty for wrong estimates and the satisfaction sensitivity, respectively. Similarly to a former study [7], this work sets \(c_{1}=1.5\) and \(c_{2}=1\) in the evaluation.