## 5 Intrusion Detection Scheme Based on Relaxed Flow Conservation Constraints
### Two-Hop Energy-Efficient and Secure Reporting Scheme
#### 5.2.4 First Selective Routing Attack Model  
In this model, a malicious node is defined as the one behaving maliciously against all od its upstream neighbors. Let \(\chi_{w}^{\omega\to u}\) denotes the highest flow drop observed on the link \((\omega,u)\) by the witness node \(w\) during the training phase. If node \(u\) is behaving maliciously against upstream neighbor \(\omega\), then constraint (C4) applied on link \((\omega,u)\) will be as follows:  
\[f(\omega,u)-g(\omega,u,Parent_{u})>\chi_{w}^{\omega\to u}\]  
**Proposition 2**. : _Under the first selective routing attack model, any honest node located in \(WR_{u}\) that rates \(u\) positively (resp., negatively), the other honest nodes located in \(WR_{u}\) must also rate \(u\) positively (resp., negatively)._  
**Proof. ** If two witness nodes \(w\) and \(w^{\prime}\) are monitoring node \(u\), four cases can occurs:  
* \(Child_{i}^{[w]}=Child_{i}^{[w^{\prime}]}\)
* \(Child_{i}^{[w]}\subset Child_{i}^{[w^{\prime}]}\)
* \((Child_{i}^{[w]}\
eq Child_{i}^{[w^{\prime}]})\wedge(Child_{i}^{[w]}\cap Child_ {i}^{[w^{\prime}]}=\varnothing)\)
* \((Child_{i}^{[w]}\
eq Child_{i}^{[w^{\prime}]})\wedge(Child_{i}^{[w]}\cap Child _{i}^{[w^{\prime}]}\
eq\varnothing)\)  
For all the four cases mentioned above, nodes \(w\) and \(w^{\prime}\) apply constraint (C4) on node \(u\) as follows:  
\[\sum_{w\in Child_{i}^{[w^{\prime}]}}f(\omega,u)-\sum_{w\in Child_{i}^{[w^{ \prime}]}}g(\omega,u,Parent_{u})>\sum_{w\in Child_{i}^{[w^{\prime}]}}x_{w^{ \prime}}^{w-u}=x_{w}^{u}\]  
\[\sum_{w\in Child_{i}^{[w^{\prime}]}}f(\omega,u)-\sum_{w\in Child_{i}^{[w^{ \prime}]}}g(\omega,u,Parent_{u})>\sum_{w\in Child_{i}^{[w^{\prime}]}}x_{w^{ \prime}}^{w-u}=x_{w^{\prime}}^{u}\]  
We can notice that both nodes \(w\) and \(w^{\prime}\) will reach the same opinion about node u's reputation (i.e., normal or malicious) and, hence, two honest witness nodes rate the same node alike. From the above proposition, we can easily prove the following corollary:  
**Corollary 1**. : _Under the first selective routing attack model, if two nodes located in \(WR_{u}\) are rating \(u\) differently, then one of them is liar and the other one is honest._  
A captured node can give positive and negative unfair ratings, which might jeopardize the whole reputation system and, thus, efficient protection against unfair rating is a basic requirement. The methods used to filter the ratings can be classified into two groups:  
* Endogenous methods: they exclude unfair ratings by assuming that the ratings provided by honest witnesses are equal or statistically close to each other. * Exogenous methods: they exclude unfair ratings by introducing external parameters like the reputation of the witness nodes. They are based on the assumption that the witnesses with low reputation are likely to give unfair ratings. The exogenous approach is costly in terms of message overhead, as there is a need to collect witness nodes' reputations from many sources. In the endogenous approach, the monitoring node \(m\) needs to get opinions from different \(M\) witness nodes about node \(v\), which incurs a communication cost of \(O(M)\). On the other hand, exogenous approach require collecting reputation information on each witness node \(w\) to decide if \(w\)'s opinion will be excluded or not. If we consider that for each witness node, \(K\) nodes on average rate \(w\). This leads to an overall complexity of \(O(K\times M)\). Accordingly, we choose to use the endogenous approach. Node \(m\) checks constraint (C3) periodically by performing the following two phases. In the first phase, the monitoring node \(m\) compares its own rating about node \(v\) with the rating provided by a witness node \(w\) about the same node \(v\). If the two ratings are different, \(w\) will be excluded from its list of two-hop honest witness nodes \(Honest_{m}\), initialized to be the set of \(m\)'s two-hop neighbors. In the second phase, a monitoring node \(m\), by applying constraint (C1) knows exactly how its downstream neighbor \(Parent_{m}\) is behaving.