## Evaluation
### Simulation Experiment
#### Results under Scenario 1  
In this condition, we randomly selected one expert node (\(I=0.95\)) to perform our attack from day 45. As node \(D\) was not a partner of node \(A\), node \(A\) could only evaluate the trustworthiness of node \(D\) by collecting the data from its partner list. As a study, we tested two conditions: (1) node \(D\) sent truthful answers to four partner nodes of node \(A\), but behaved untruthfully to the other two partner nodes (T4U2); (2) node \(D\) responded truthfully to three partner nodes of node \(A\), while sending untruthful answers to the remaining partner nodes (T3U3). Figure 4 describes the trust value of the malicious node. * _T4U2._ Under this condition, it was found that the trust value of the malicious node (node \(D\)) could gradually decrease below the threshold after nearly 15 days, while the trust value could return above the threshold over a period of time. This was because up to four partner nodes reported a \"benign\" status for node \(D\). Supposing node \(A\) was a central server in a CIDN, node \(D\) could still make an impact on its judgement as long as its trust value was higher than the threshold of 0.8. * _T3U3._ In this condition, node \(D\) could behave untruthfully to three partner nodes of node \(A\). It was identified that the trust value of node \(D\) could keep decreasing at most cases and fall below the threshold after 15 days without going up to the threshold again. Intuitively, the detection accuracy was better than for the first condition, as one more node would report a \"malicious\" status for node \(D\). The results demonstrate that our attack has the potential to compromise the robustness of the challenge mechanism in this scenario. If behaving normally to most partner nodes, a malicious node can maintain its trust value close to the threshold. Figure 3: Convergence of trust values of intrusion detection system (IDS) nodes regarding three expertise levels. Results under Scenario 2  
In this scenario, we randomly selected one expert node (\(I=0.95\)) as a malicious node (e.g., node \(D\)), which conducted our special attack from day 45. Node \(D\) had to behave truthfully to node \(A\), as node \(A\) could directly send challenges to node \(D\). The trust computation of target node (node \(A\)) regarding node \(D\) is shown in Figure 5. We also tested two conditions: (1) node \(D\) behaving truthfully to four partner nodes of node \(A\), whereas it provided untruthful feedback to the remaining two partner nodes (T4U2); (2) node \(D\) responding truthfully to three partner nodes but giving untruthful answers to the remaining three partner nodes (T3U3). It is worth noting that node \(D\) always sent truthful feedback to node \(A\). The trust value of the malicious node is shown in Figure 5.  
Figure 4: Trust values of malicious node (e.g., node D) calculated by target node (e.g., node A) under Scenario 1. Figure 5: Trust values of malicious node (e.g., node D) calculated by target node (e.g., node A) under Scenario 2. * _T4U2_. In this condition, the trust value of node \(D\) computed by node \(A\) could gradually decrease closer to the threshold during the first 10 days, because two partner nodes could report malicious actions of node \(D\) to node \(A\). Afterwards, the trust value was maintained in the range from 0.81 to 0.82 in most cases, as four partner nodes reported that node \(D\) was normal. As the trust value was higher than the threshold of 0.8, node \(D\) could still make an influence on node \(A\) and its alarm aggregation. * _T3U3_. In this condition, node \(D\) sent truthful feedback to three partner nodes of node \(A\) but sent malicious feedback to the other three partner nodes. It was found that the trust value of node \(D\) computed by node \(A\) could keep decreasing during the first 15 days, whereupon it was maintained around the threshold. As node \(D\) always sent truthful feedback to node \(A\), its trust value crossed below and above the threshold.