# New Detection Paradigms to Improve Wireless Sensor Network Performance under Jamming Attacks
## 3 Analysis of Detection Mechanism  
We propose two mechanisms (Extended and Connected) that are inserted in the routing protocol, which presents the following modifications to the protocol. One of the advantages of the Extended Mechanism is that it provides a global view of the complete network to the coordinator node. However, the main disadvantage is that this node requires the performance parameter for each node which results in an undesired overhead. The collector node groups nodes with similar behavior which consists of the distance, the amount of retransmitted traffic and average energy. Thus, the Extended Mechanism establishes the comparison parameters based on a set of nodes with similar features. Since the collector node already has all the information, it can easily spot when a node reports different thresholds than those established in its group. Consequently, an alert is generated, and the node is marked as an affected node. On the other hand, in the Connected Mechanism, each node receives information with the performance parameters of its neighbors directly connected via the HELLO packet, then this is the only reference it must know if the thresholds are within the normal conditions. This mechanism generates less overhead, but the reference is less reliable than the perspective of a conglomerate of nodes.  
There is a persistence parameter that is bound to the output of the neighbor's tables of nodes. The persistence parameter is located as a flag in the neighbor table of nodes. In case a node presents alterations in its performance metrics so that its neighbors can eliminate it as a valid route from their routing tables, there is a control packet that is sent to the neighbors when these performance metrics have an abnormal behavior (different values from their numbers under normal conditions). These metrics are packet retransmissions, retries to listening to the channel and, energy. Finally, there is a flag of **marked node** that allows the choice of the position of the node in the neighbor table and to identify it as **suspicious route** and locate it as a route at the end of the neighbor table.  
To deal with the jamming attacks at the network layer, a mechanism for discerning between the affected nodes and free-jamming nodes should be implemented. Once the affected nodes are identified, the corresponding entries in the routing tables of their neighbors should be handled to avoid the use of routes where such nodes are included. All nodes send HELLO packets for updating the list of neighbors and the modification is based on another information in this packet: performance metrics. If a neighbor node does not answer the HELLO packet then is removed from the routing table. However, the previous strategy could generate too many changes in the routing tables and an excessive overhead. Therefore, the self-configuration processes of the network due to other conditions might produce similar performance degradation in a similar way to the jamming attack, i.e., low-quality links to the neighbor nodes would present a high packet loss rate and collisions. Moreover, to avoid such behaviors where neighbor nodes are being added and removed frequently to and from the routing tables due to causes other than a jamming attack, we studied a proposed mechanism where we include the persistence value \(p\in\{0,1,2,3\}\) associated with each neighbor node. The persistence is increased by one each time that the corresponding neighbor answers the HELLO packet, otherwise is decreased by one. When \(p\) is equal to zero the node is removed from the neighbor table. We propose three scenarios to try out some variations in the behavior of this mechanism based on the executed routing protocol.