## 3 General Concept and Passive Detection
### Defining Normal Case and Significant Deviation  
Regression analysis is a classical method in statistics [32; 33]. It can be utilized to determine the exact functional relationship between \(E(M)\) and \(M\). With the help of experimental results provided by [30], it can be predicted that the functional relationship between \(E(M)\) and \(M\) is non-linear exponential:  
\[E(M)=a_{I}e^{\beta_{I}M}\cdot\epsilon,\quad\ln\epsilon\sim N\left(0,\sigma^{2} \right) \tag{1}\]  
Figure 1: General concept of detection and protection against vampire attacks. where \(\epsilon\) is a normal random variable with 0 mean and variance \(\sigma^{2}\); and \(a_{l}\), \(b_{l}\) and \(\sigma\) are constant parameters independent of \(M\). The well-known Friis transmission equation [34] shows that energy consumption over a distance between any pair of communicating nodes is proportional to the square of that distance. If one or more relay nodes are introduced in between, energy consumption could be effectively reduced. Generally, a larger \(M\) is equivalent to higher node density, meaning more candidate nodes are available for forming a route. In this case, routes (consisting of more nodes) with better energy efficiency are more likely to be found. However, adopting these extra nodes naturally causes additional energy, which partially counteracts the energy saved from introducing these relay nodes in communications. Moreover, this is why \(E(M)\) in Equation (1) reveals a shape of an exponential function instead of a linear one. The exponential form of Equation (1) suggests that the relationship can be simplified by taking the logarithm. Let \(\ln E(M)=E^{{}^{\prime}}(M)\), \(\ln a_{l}=a_{l}^{{}^{\prime}}\), \(b_{l}=b_{l}^{{}^{\prime}}\), \(M=M^{{}^{\prime}}\), \(\ln\epsilon=e^{{}^{\prime}}\); hence, Equation (1) can be transformed to a simplified linear regression form. \[E^{{}^{\prime}}(M)=a_{l}^{{}^{\prime}}+b_{l}^{{}^{\prime}}M^{{}^{\prime}}+ \epsilon^{{}^{\prime}} \tag{2}\]  
The next step is to determine the estimates of \(a_{l}\) (or \(a_{l}^{{}^{\prime}}\)) and \(b_{l}\) (or \(b_{l}^{{}^{\prime}}\)), represented by \(\hat{a_{l}}\) (or \(\hat{a_{l}^{{}^{\prime}}}\)) and \(\hat{b_{l}}\) (or \(\hat{b_{l}^{{}^{\prime}}}\)), respectively, with the aid of linear regression method and the past records of \(E(M)\) obtained from [30]. The simulation results of [13] conclude that in a very general sense, a vampire attacker at a random location in a network with randomly generated topology can cause a significant rise in network energy consumption. More precisely, the consumption increases by a factor of 1.48 \(\pm\) 0.99 when a carousel (route loop) attack is ongoing, and the number can be 2.67 \(\pm\) 2.49 in the case of a stretch attack. Note that there is a significant standard deviation here owing to the unpredictable adversarial path length that can be affected by the attacker's location in relation to the source or destination node. Higher network energy consumption is probably linked to a higher possibility of vampire attacks in operation. The extra energy cost introduced by carousel attacks and stretch attacks may rise to a factor of 3.96 and 10.5, respectively, in a worst-case scenario. In order to detect any abnormal increment (caused by vampire attacks) discussed in the previous paragraph, it is necessary to keep tracking all incoming packets and their expected transmission cost. Once any harmful sign shows up, the active detection phase is triggered. For more details, see Sections 4 and 5. All incoming data packets can carry information about their journey history in the network by recording a list of nodes passed through together with their location information (for nodes localization, see Section 3.2.2). These records are essential to calculate the expected energy cost of packet transmissions mentioned in the previous paragraph (for estimation details, see Section 3.2.1). Note that the transmission cost of the location information is a bit higher than that of the regular packet; later evaluation has to consider this factor.