## 5 Evaluation
### Simulation Framework
Some of the features are calculated from the network flow, such as the flow duration, packet count, and byte count, while others are extracted from the packet header, such as the protocol and port numbers. We used the flow duration, protocol, and packet count parameters from the dataset to train and test our machine learning models. We also used the source and destination IP addresses and port numbers to identify the type of attack. The AnyLogic simulator was used to generate synthetic network traffic data for testing our intrusion detection system. The simulator also allowed us to visualize the behavior of the system and test different scenarios to evaluate the performance. **UAV energy consumption:** Conserving energy is one of the critical challenges for UAV-based systems. In the proposed UAV model, the energy is consumed when a UAV moves, communicates, collects data, and hovers. The energy consumption in terms of speed is shown in Figure 5 and can be seen to be relatively high when the speed of the UAV is either too high or too low. The figure shows the energy consumption of three subsets of the energy, i.e., parasite, induced power, and blade profile. The figure illustrates that approximately 14 m/s is the ideal speed for achieving the most efficient energy consumption. In the proposed work, the broker initiates the data collection process on multiple routes; therefore, Figure 6, shows the UAV residual energy with simulation time. Each route has a variable length causing UAVs to take different times to complete the task. The first path is the longest as it covers more area to collect data from deployed sensors; thus, UAVs consumed more energy to collect the data. The third path is the shortest because of the small coverage area of the fog site where the UAVs consumed less energy. In the first route, UAVs took more time and consumed around 80% of their energy. In the case of a benign scenario, the UAVs have full charge after every cycle. On the second route, it takes around 60% of the residual energy and takes relatively less time to complete the path. The same is the case with the third route. In case of malicious behavior, the UAV acquires a lower charge after every trip and is eventually removed from the group. Moreover, the deployed model detects the malicious behavior using the energy and communication parameters; thus, helping to send the UAV for inspection before offloading the data at the fog node. Figure 7 shows the residual energy when UAVs become malicious with simulation time. It is assumed that a UAV is 80% malicious because it participates in only 20% of the required recording and transmission. In this case, the UAV will only have 20% more charging. In the first route, the UAV does not have enough charging to complete its route and eventually is removed from the system. Similarly, in the second and third routes, malicious UAVs are automatically removed from the system after completing two rounds due to zero charging. **Resource utilization--**the proposed framework is benchmarked in terms of resource usage, i.e., memory and CPU. These resources are used effectively by a well-constructed system. The memory consumption is shown in Figure 8 with varying nodes, i.e., UAVs/sensors. UAVs, brokers, farms, and sensors that have been deployed are included in this list of nodes. With 200 UAVs, only 4.5% of memory is utilized, whereas with 400 UAVs, 6.4% of memory is used. When the number of UAVs increases to 600, only 9.1% of memory is occupied, indicating a linear increase in memory usage with the number of UAVs. Notably, no memory leaks are noticed during the simulation run. The CPU consumption is shown in Figure 9. CPU usage escalates as the number of sensors increases. In this scenario, with 200 UAVs, 30% of CPU is used, whereas with 400 UAVs, 35% of CPU is utilized. When the number of UAVs increases to 600, the CPU usage reaches 39% only, which includes, computational algorithms, mobility models, energy modules, and communication links between the UAVs, installed sensors, brokers, and fog sites.