# A Protocol Layer Trust-Based Intrusion Detection Scheme for Wireless Sensor Networks
## 4 Performance Analysis
### Numerical Results and Discussion  
We use Matlab as simulation tool to generate the performance results of our scheme. We consider a WSN with 50 nodes, randomly deployed in a 100 m \(\times\) 100 m operational area. The transmitting power of a SN is 2 mW and the communication frequency is 2.4 GHz. The trust update interval is set to 10-100 min. The detailed simulation parameters are listed in Table 1.  
Figure 3 shows the relationship between the trust value of a SN and the simulation time and compares the trust value of the SN with the node density varying from 30 nodes to 50 nodes per 10,000 m\({}^{2}\) (e.g., 30 nodes mean 1 CH and 29 SNs). We observe that the trust value of the SN fluctuates in a narrow range (0.982, 0.984), when the simulation time is relatively short. If the simulation time is long enough, the trust value of the SN becomes stable, because the longer the simulation time is, the more data are collected and the more accurate the results are. We also notice that with the increase of node density the fluctuation of the trust value of the monitored node becomes smaller. This is because if the node density is small, the number of neighboring nodes of the monitored node will \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Parameter** & **Value** & **Parameter** & **Value** \\ \hline Size of network & 100 m \(\times\) 100 m & \(\mathrm{w_{1}}\), \(\mathrm{w_{2}}\), \(\mathrm{w_{3}}\) & 1/3 \\ Number of SNs & 49 & Number of CH & 1 \\ Trust update interval & 10–100 min & \(\mathrm{p_{1}}\), \(\mathrm{p_{2}}\), \(\mathrm{q_{1}}\), \(\mathrm{q_{2}}\) & 1/2 \\ MAC protocol & 802.11 DCF & Routing protocol & AODV \\ \(\mathrm{t_{DIFS}}\) & 50 \(\mathrm{\SIUnitSymbolMicro}\)s & \(\mathrm{t_{DIFS}}\) & 10 \(\mathrm{\SIUnitSymbolMicro}\)s \\ Slot time & 20 \(\mathrm{\SIUnitSymbolMicro}\)s & \(\mathrm{t_{ACK}}\) & 112 \(\mathrm{\SIUnitSymbolMicro}\)s \\ Size of Route Request (RREQ) packet & 176 bits & Size of Route Reply(RREP) packet & 176 bits \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Assumed values of system parameters. MAC = medium access control, AODV = Ad-hoc On-Demand Vector. be small, the data that the monitoring node can obtain will be less and hence the trust value of the monitored node will not be so accurate. Figure 4 shows the variation of the trust values of the monitored node under the scenario of several types of attacks. We simulate four typical attacks at the MAC layer and network layer, including back-off manipulation, selective forwarding attack, sinkhole attack and MAC-Network cross-layer attack. In the back-off manipulation attack, a malicious node gets unfair priority access to the channel by setting a small CW. In the selective forwarding attack, a malicious node selectively drops packets passing though it according to a predefined criterion. In the sinkhole attack, an attacker tries to attract network traffic by sending bogus RREP messages. In the MAC-Network cross-layer attack, the malicious node initiates attacks at the MAC layer and network layer simultaneously to make itself a node on the routing path by using a small CW and sending a fake routing message with small hop count. We observe that if a node initiates attacks its trust value will decrease obviously (less than 0.8). The behavior of back-off time manipulation of the malicious node will affect its idle time trust value, number of retransmissions trust value and physical layer trust value, so its trustworthiness will decrease to about 0.78. The selective forwarding attack will reduce the packet forward trust value of the malicious node. In the scenario of cross-layer attack, the parameters of both MAC layer and network layer will be affected, so the trust value of the malicious node will decrease markedly. The sinkhole attack will affect the hop count trust value, packet forward trust value, physical trust value of the malicious node because the malicious node will drop the Route Request (RREQ) packet, send the RREP packet with small hop count.