## 3 The Proposed Approach of SCDNN
### The SCDNN Algorithm
For convenience, the dataset is adapted for the proposed algorithm; synthetic data are labelled with security attack types based on known major attack types on the AODV protocol and are shown in Table 4[50; 51]. There are seven attack types that can be categorized based on consideration of their protocol messages in term of message type, transfer time and the number of hops. In this experiment, the detection methods are run 500 times each and the average detection accuracy if given as the final result. The output results are shown in Table 5.

The detection accuracy at each sensor node scale is shown in Figure 6 and Table 5. The SCDNN can detect all seven attack types with high detection rates. For the 5% attack scale, the proposed model can find almost all attackers. Detection rates decrease with increasing the size of the attacker to 10% in the network. Moreover, detection accuracy is impacted for different values of \(\sigma\). The reason for this change may be that when the attack process attempts to modify router information, the resulting increase of transport packets in WSNs makes detection performance more unstable. \begin{table}
\begin{tabular}{l l c} \hline \hline
**Attack Name** & **Attack Description** & **Attack Type** \\ \hline Active Reply & The route reply is forged with abnormal support to reply. & 1 \\ Route drop & The routing packets are dropped with some specific address. & 2 \\ Modify Sequence & The number of target sequences increases with largest maximal values. & 3 \\ Rushing & Rushing of routing messages. & 4 \\ Data Interruption & A data packet is used to drop the route. & 5 \\ Route Modification & The route is modified in Routing Table Entries. & 6 \\ Change Hop & The route cost in routing tables entries is altered. & 7 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Basic attacker types with packet routing protocols on the ad hoc on-demand distance vector (AODV) protocol in wireless sensor networks (WSNs). \begin{table}
\begin{tabular}{l l l l l l l} \hline \hline \multirow{2}{*}{**Dataset**} & \multirow{2}{*}{**Parameter**} & \multicolumn{6}{c}{**Sensor Nodes**} \\ \cline{3-7}  & & **10 Nodes** & **20 Nodes** & **30 Nodes** & **40 Nodes** & **50 Nodes** \\ \hline \multirow{3}{*}{5\% Attacker in Networks} & \(k=4,\sigma=0.1\) & 96.8 & 96.4 & 95.8 & 94.5 & 94.6 \\  & \(k=4,\sigma=0.5\) & 93.1 & 93.5 & 92.4 & 89.3 & 88.7 \\  & \(k=4,\sigma=1.0\) & 89.6 & 89.2 & 86.5 & 82.4 & 83.3 \\ \hline \multirow{3}{*}{10\% Attacker in Networks} & \(k=4,\sigma=0.1\) & 96.8 & 96.4 & 95.8 & 94.5 & 94.6 \\  & \(k=4,\sigma=0.5\) & 93.1 & 93.5 & 92.4 & 89.3 & 88.7 \\ \cline{1-1}  & \(k=4,\sigma=1.0\) & 89.6 & 89.2 & 86.5 & 82.4 & 83.3 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Average detection accuracy for five sensor nodes scales by the SCDNN algorithm using optimal \(k\) and \(sigma\) values (%). Figure 6: Detection accuracy with five sensor node scales with 95% confidence interval. Accuracy is shown for (**a**) a 5% attacker and (**b**) a 10% attacker, 500 times each. ## 5 Discussion

In order to evaluate the performance of the SCDNN and compare it with the experimental results of the other four models in this section, receiver operating curves (ROC) are obtained for all models [52]. The ROC function is widely used to indicate an algorithm's discriminative capability in this field. The overall category performance of each model, the true positive rate (TPR) from Equation (11) and the false positive rate (FPR) (calculated as 1-Specificity from Equation (13)) are used to generate the ROC in Figure 7.

In this section, there are five network data types to be detected, an example of multiclass classification. Handling five classes is complex, with the possibility of \(n\) positive results and \(n^{2}+n\) errors to consider. In this situation, multiclass ROC and area under curve (AUC) methods are used to plot ROC curves and calculate each AUC [53].