# Clear database from old data
## 8 Experiments and Discussion
The novelty of the attack detection algorithm consists of the constructed sets of features (1) obtained by analysis of the data collected in the WSN, network specifications and configurations, and (2) used to detect attacks that exploit the properties of decentralization and self-organization networks through using machine learning and statistical methods. The technique for the model and algorithm application in self-organizing decentralized WSNs describes the main stages of the data collection and attack detection processes. In essence, it specifies a proper way for realization of the developed models and algorithms into a real physical implementation of a WSN. Its differences include experimentally substantiated stages for specifying and adjusting the parameters of data collection algorithms and detection algorithms, including the selection of hyper-parameters of the used learning methods. Note that the presented algorithms, models and technique could be applied to research areas other than the considered one, for instance, combined Ethernet/Wi-Fi networks and ad hoc smart device networks. For example, a sinkhole attack, which redirects traffic \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Attack Type** & **Variation** & \begin{tabular}{c} **Machine** \\ **Learning** \\ **Method** \\ \end{tabular} & **F1 Score** & \begin{tabular}{c} **Delay before** \\ **Attack** \\ **Detection, s** \\ \end{tabular} & \begin{tabular}{c} **Average** \\ **Throughput, \%** \\ **Algorithms/with Them** \\ \end{tabular} \\ \hline \multirow{4}{*}{\
\begin{tabular}{c} Sinkhole \\ \end{tabular} } & Common attack variation & SVM & 0.99 & 1.2 & 86 & 34.5/40.3 \\ \cline{2-7}  & With the exploitation of the properties of self-organization and decentralization & SVM & 0.98 & 1.0 & 88 & 33.1/38.4 \\ \hline \multirow{4}{*}{
\begin{tabular}{c} Hello-flood \\ \end{tabular} } & Common attack variation & Decision tree & 0.99 & 1.3 & 87 & 54.3/65.7 \\ \cline{2-7}  & With the exploitation of the properties of self-organization and decentralization & Decision tree & 0.99 & 1.1 & 89 & 55.6/63.9 \\ \cline{2-7}  & Integral for the listed attacks types & Decision tree & 0.98 & 1.2 & 89 & 59.0/70.8 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Attack detection quality indicators. through an attacker node, and a Man-in-the-Middle attack being close to sinkhole, are relevant to Ethernet/Wi-Fi networks. When this attack is mounted, data confidentiality and integrity are compromised, and, typically, it is important the network is operated in a critical infrastructure. To detect Man-in-the-Middle attacks for a specific system, it may be necessary to adjust the types of input data for detection due to the different methods and the differing nature of the communication. Nevertheless, the results of this article could be relevant to a broader class of networks but require further research to validate the applicability and effectiveness of the proposed modeling framework for the broader class of networks and cyber-physical systems. It is worth noting that the developed algorithms and technique have certain limitations, primarily concerning resource constraints. These limitations include constraints on the duration and volume of data to be stored on the nodes and needed for the attack detection. In essence, WSN nodes represent devices with limited hardware and software capabilities as well as energy resources, often not suitable for installing heavy databases, and should not be used to store large amounts of data for a long time. Therefore, one of the most important aspects is to use lightweight data storage only, provided that severe restrictions are placed on the volume of data and the duration of storage. In the experimental example, the data were stored in JSON format, and the duration of data stored simultaneously was 1 h, with 10 GB of the occupied volume (i.e., data older than one hour of the system operation and data more than 10 GB were discarded).