## 5 Performance Evaluation
### Simulation Results and Analysis
This is because more valid data messages will be rejected due to the changes in the increment of the minimum sequence number. As shown in Figure 8b, when the number of malicious nodes increases, the PRR of MPL under suppression attack decreases. This is because more number of malicious nodes can launch more multicasting misbehaviors, and more valid data messages from source node will be rejected. However, the HED provides much higher PRR than that of MPL under the suppression attack.This is because the HED can detect the anomalous increment of sequence number due to multicasting misbehaviors of malicious node, the malicious node can be isolated and removed from the network more quickly, and more data messages can be received. In Figure 8c, as the simulation time elapses, the PRR of both MPL under the suppression attack and HED fluctuate around 77% and 30%, respectively. However, the PRR of both MPL under the suppression attack and HED are sensitive to the number of spoof data messages \(N_{spkt}\), and lower PRR is observed with larger \(N_{spkt}\). This is because the minimum sequence number increases greatly and quickly with larger \(N_{spkt}\), and fewer data messages will be accepted. **False Detection Rate:** Third, the false detection rate is measured by varying suppression attack rate, number of malicious nodes, and \(N_{spkt}\) in Figure 9. Overall, the false detection rate of HED is below 6.5%. In Figure 9a, the false detection rate of HED decreases as the suppression attack rate increases. With larger suppression attack rate, the malicious node can show multicasting misbehaviors more frequently. However, these multicasting misbehaviors can be detected by the proposed scheme, resulting in lower false detection rate. When a short observation window is adopted, a lower false detection rate is achieved because each node can frequently compare the increment of a sequence number with threshold value to detect more multicasting misbehaviors. In Figure 9b, the false detection rate remains steady as the number of malicious nodes increases. However, the HED with smaller observation window and larger \(N_{spkt}\) achieves the lowest false detection rate. Figure 7: The detection rate against suppression attack rate and number of malicious nodes. Figure 8: The packet reception rate (PRR) against suppression attack rate, number of malicious nodes, and elapsed simulation time. **Changes of Increment Rate:** Finally, we measure the changes of the increment rate without and with adversary against simulation time and a filter gain constant \(\alpha\) in Figure 10. Since a low packet rate is adopted, the increment rate of the sequence number without adversary fluctuates below 2 seq/s. Due to exponential distribution of the packet rate, it is possible to have a sudden increase of packet rate at the source node, that in turn, leads to a high increment rate. However, as shown in Figure 10a, the sudden increase of a packet rate resulting in high increment rate is very rare. Under the suppression attack, the malicious node can multicast a series of spoof data messages within a short period of time and thus, a higher increment rate is observed as shown in Figure 10b. As the value of a filter gain constant increases, the increment rate slightly decreases because the recently calculated increment rate of a sequence number contributes less weight according to Equation (1). Figure 9: The false detection rate against suppression attack rate and number of malicious nodes.