# A Novel Anomaly Behavior Detection Scheme for Mobile Ad Hoc Networks
## 5 Simulation Results
### Comparative Analysis of Detection Ratios  
To analyze the performance, the ns-3 simulator was used. In addition to the ns-3 simulator, Python language was used on LINUX OS.  
The variation in the number of nodes on ns-3 was 200-1000 for the zone routing protocol (ZRP) for 5000 s. The comparison of detection ratios with node variation is presented in Table 3.  
(i) Anomaly detection ratio (ADR)  
\[\mathbf{ADR}=\frac{\mathbf{anomalies detected by proposed system}}{\mathbf{number of anomalies in trace file}}\]  
As the number of nodes increases, the value of ADR decreases; its minimum value is 66.5% in a 1000-node network. The reason for the decrease in ADR value is that, after transmitting control packets, many nodes become silent.  
(ii) Wrongly calculated anomaly ratio (WCAR)  
\[\mathbf{WCAR}=\mathbf{number of inliers detected as outliers}\]  
As the number of nodes increases, the value of WCAR also increases, ranging from 8% for 200 nodes to 16% for 1000 nodes.  
(iii) Average local anomaly detection ratio (ALADR)  
\[\mathbf{ALADR}=\frac{\mathbf{value of ADR collected from each local subgroup}}{\mathbf{number of local subgroup}}\]  
The value of ALADR \(<\) ADR, and further declines with an increasing number of nodes. The different values of ALADR and ADR indicate the presence of outliers in the network that are not constituents of any local subgroup. The minimum and maximum values are 1.1% and 1.4% for 200 and 1000 nodes, respectively.  
(iv) Average local wrongly calculated anomaly ratio (ALWCAR)  
\[\mathbf{ALWCAR}=\frac{\mathbf{accum of WCAR values from each local subgroup}}{\mathbf{number of local subgroups}}\]  
\begin{table}
\begin{tabular}{c c c c} \hline \hline  & \multicolumn{3}{c}{**N = 1000**} \\ \hline
**Parameter** & **[PERSON] et al.**[26] & **[PERSON] et al.**[33] & **Proposed Approach** \\ \hline
**Minimum ADR** & 48.8\% & 57.8\% & 66.5\% \\ \hline
**Minimum WCAR** & 9\% & 10\% & 8\% \\ \hline
**Minimum ALADR** & 0.1\% & 0.2\% & 0.6\% \\ \hline
**Minimum ALWCAR** & \(\leq\)0.1\% & \(\leq\)0.2\% & \(\leq\)0.6\% \\ \hline \hline \end{tabular}
\end{table}
Table 4: Comparative detection ratio analysis at network level.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **N = 200** & **N = 400** & **N = 600** & **N = 800** & **N = 1000** \\ \hline
**ADR** & 0.741 & 0.715 & 0.711 & 0.693 & 0.665 \\ \hline
**WCAR** & 0.080 & 0.11 & 0.12 & 0.14 & 0.16 \\ \hline
**ALADR** & 0.730 & 0.700 & 0.683 & 0.672 & 0.651 \\ \hline
**ALWCAR** & 0.055 & 0.07 & 0.08 & 0.09 & 0.10 \\ \hline
**ALWCAR-WCAR** & 0.025 & 0.04 & 0.04 & 0.05 & 0.06 \\ \hline
**ALADR-ADR** & 0.011 & 0.015 & 0.028 & 0.021 & 0.014 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Comparative analysis of detection ratios with variations in the number of nodes.  
Here, ALWCAR < WCAR, and ALWCAR increases with an increase in the number of nodes.  
To appraise ADR, WCAR, ALADR, and ALWCAR in real implementation:  
ADR is one of the important factors to influence the performance of the network by detecting anomalies on time; WCAR should be minimal, as it constitutes the incorrect identification of inliers as outliers, which may significantly affect the performance in terms of energy consumption and security; ALADR is the parameter that helps to identify the outlier at the local subgroup level and network levels.