## 3 Proposed Solution
### Scope of Attacks Covered with the Approach
For these reasons, if the attacker introduces \(N_{err}\) change in the sample of the size \(N_{sample}\), the value of \(\Delta D\) will range between 0 (in the case the changes are symmetric, so the effect of one change cancels the effect of another and the distribution does not change at the end), and the value that corresponds to the case when the effects of each change are completely uncorrelated, so they sum together, which is given with the following formula:  
\[D_{\max}=2n*f_{err}=\frac{2 nN_{err}}{N_{sample}} \tag{4}\]  
Thus, having in mind the correlation of the n-grams, in order to model this change that ranges from 0 to \(D_{max}\) we use the next formula:  
\[F\big{(}\rho\big{)}=\beta+\big{(}1-\beta\big{)}e^{k\alpha} \tag{5}\]  
where \(\alpha=1-1/\rho\), \(\beta\)(\(<\)1, since the function should grow with \(\rho\)) and \(k\) are constants defined in the design process (the specific meaning of both will be explained later in this section) and \(\rho\) is the coefficient of total correlation between the n-grams. The value of \(F(\rho)\) is \(\beta\) for \(\rho=0\), (the reason for this will be explained in the following), and 1 for \(\rho=1\). The coefficient of total correlation [17] expresses the amount of dependency that exists among a set of variables. For a given set of k random variables \(X_{l}\), \(X_{2}\),..., \(X_{k}\), the total correlation \(C(X_{l}\), \(X_{2}\),..., \(X_{k})\) is given by the following formula:  
\[C\big{(}X_{1},X_{2},...,X_{k}\big{)} = \sum_{i=1}^{k}H\big{(}X_{i}\big{)}-H\big{(}X_{1},X_{2},...,X_{k} \big{)} \tag{6}\]  
where \(H(X_{i})\) is the information entropy of variable \(X_{i}\), while \(H(X_{l}\), \(X_{2}\),..., \(X_{k})\) is the joint entropy of the variable set \(\{X_{l}\), \(X_{2}\),..., \(X_{k}\}\). In our case, the variables are the extracted n-grams. For the sake of calculating the above formula, their distribution can be approximated either as a common distribution depending on the purpose of the deployed sensor network, or using the historical data sensed by the network. Regarding the value of \(\beta\), we have to take into account that the higher the value of \(\beta\) is, the function becomes closer to its asymptotic function \(F(\rho)=1\). Thus, the effect of \(\rho\) becomes smaller. Similar stands for the value of \(k\). As k \(\to\) 0, the function becomes closer to the same asymptotic function. In the opposite case, as \(k\rightarrow\infty\), the function reaches its asymptote: \(F(\rho)=0\) for \(\rho<1\), \(F(\rho)=1\) for \(\rho=1\). In both cases the effect of \(\rho\) becomes less significant. Finally, we get the following formula:  
\[F(\rho)\frac{2 nN_{{}_{\mathit{err}}}}{N_{{}_{\mathit{sample}}}}>f_{{}_{\mathit{ sh}}} \tag{7}\]  
which gives us the minimal number of changes the attacker has to introduce in order to be detected by the approach:  
\[N_{{}_{\mathit{err}}\,\mathrm{min}}=\frac{N_{{}_{\mathit{sample}}}}{2 nF(\rho) }f_{{}_{\mathit{sh}}} \tag{8}\]  
In the previous equation we have the following degrees of freedom: \(N_{{}_{\mathit{sample}}}\), n and \(f_{{}_{\mathit{sh}}}\). Lower characterization periods (\(N_{{}_{\mathit{sample}}}\)) and the threshold on one side and higher n on the other give us the opportunity to detect the attacker even if he introduces very few changes. However, this can also result in higher false positive rate, so a tradeoff between higher detection and lower false positive rate has to be established. This depends on many factors, such as the application of the deployed WSN or the existing redundancy. Also, the values of both \(\beta\) and \(k\) indirectly affect on this value through \(F(\rho)\). As the value of \(\beta\) increases or the value of \(k\) decreases, the value of \(F(\rho)\) for the same \(\rho\) increases, which further decreases the value of \(N_{{}_{\mathit{ermin}}}\). In opposite cases, as the value of \(\beta\) decreases or the value of \(k\) increases, the value \(N_{{}_{\mathit{ermin}}}\) will increase. The previous formula also helps us to define the minimal value of \(\beta\).