## 3 Proposed System
### Algorithm Considerations  
In this section, some issues on the applicability of the proposed method are discussed.  
* **Suitable scenario**: The proposed approach is suitable for a scenario with a limited variability on the network topology, where nodes are distributed in an area on almost-fixed positions, for example, for monitoring purposes (e.g., surveillance, anti-intrusion, and environment monitoring). When a new node is added to the network, the set-up phase has to be run again, i.e., the learning must be performed again to add the new class. However, this urgency is not present if a node leaves the network (and its ID is disabled). Indeed, in this case, the classification still works: if an attacker is classified as the disabled ID, it must be certainly blocked.
* **Complexity and Scalability** The complexity of the considered ML approaches must be evaluated separately for the two phases: training and test. During the training for each attribute (\(K\)), the information gain is calculated for the \(M=NX\) elements of the dataset (with complexity \(O(KM)\)) and values are sorted to find the right splitting threshold. The complexity of the sorting operation is \(O(KMlog_{2}M)\) that, asymptotically, is the complexity of the training phase. As the RF algorithm complexity must take into account the number of trees \(T\), the complexity is \(O(T\log_{2}(K+1)Mlog_{2}M)\). In our system, the number of attributes is \(K=5\), and, as shown in the numerical results section, both CART and RF need short training sequences, thus resulting in fast and limited complexity training. Obviously, the complexity increases as \(Nlog_{2}(NX)\), as the number of nodes, \(N\), increases. On the other side, the testing phase complexity is proportional to the tree depth \(P\) that depends on the number of splits that must be at least equal to \(N\). In the numerical results section, we verified that selecting a number of splits slightly higher than \(N\) provides a slight improvement in the accuracy, but a further increase does not provide advantages. For simplicity, assuming that the number of split is \(N\), in the best case (totally balanced-tree is \(P=log_{2}N\)) and in the worst case is \(P=N\). Hence, in the classification (test) phase, the algorithm complexity in the worst case is linear with \(N\), thus, scaling efficiently with \(N\). Indeed, this aspect makes the decision tree algorithms very fast and resource efficient during the test stage, and hence, suitable even for real-time machine learning deployment and large scenarios. In terms of performance increasing the number of nodes in the area, we can expect two opposite behaviors, indeed, as explained before, the spoofing detection capability improves if \(N\) increases, but on the other side, the \(P_{bun}\) can increase due to a reduction of the accuracy of the classification since nodes are closer to each other and it is more difficult to discriminate them. However, in the numerical results section, we verified that the performance degradation is not significant within a certain value; we tested node density up to around 50,000 nodes/km\({}^{2}\). Obviously, the number of needed splits of the trees increases.