## 7 Comparative Analysis: Resiliency against Upstream-Node Effect  
In this section, we compare between the relaxed flow conservation constraint, the packet sending rate, and the packet dropping rate with respect to resiliency against the upstream-node effect, as shown in Figure 6. In this comparison analysis, we consider two nodes: \(M\), and \(P\), and \(M\) is sending packets to \(P\). We consider the following notations:  
* \(x\) is the number of packets dropped by the upstream node \(M\).
* \(PF_{P}\) denotes the number of packets that are forwarded by node \(P\).
* \(PR_{P}\) denotes the number of packets that are received by node \(P\) from node \(M\).  
Proposition 3: _The packet sending rate feature is not resilient against upstream-node effect._  
Proof: Node \(P\) is considered by a monitoring node \(O\) to be legitimate if \(PR_{P}>Th_{SR}\). Otherwise, it is considered as malicious.  
A malicious node \(M\) drops \(x\) packets, and node \(P\) only receives and forwards \(PR_{P}-x\) packets accordingly. Thus, the packet sending rate observed at node \(P\) is \((PR_{P}-x)\). We will prove Proposition 3 by contradiction: let us assume that node \(P\) is always considered by a monitoring node as legitimate. Formally,  
\[\forall x:PR_{P}-x>Th_{SR} \tag{1}\]  
From (1), it follows that: \(\forall x:f_{SR}(x)=PR_{P}-x-Th_{SR}>0\). As shown in Figure 5(a), \(\exists x:f_{SR}(x)\leq 0\), which contradicts Assumption 1. Hence, for some values of \(x\), node \(P\) is considered by a monitoring node as malicious. Therefore, the packet sending rate feature cannot prevent the upstream-node effect.  
Proposition 4: _The packet dropping rate feature is not resilient against upstream-node effect._  
Proof: Node \(P\) is considered by a monitoring node \(O\) as legitimate if \((1-\frac{PF_{P}}{PR_{P}})\leq Th_{DR}\). Otherwise, it is considered to be malicious.  
A malicious node \(M\) drops \(x\) packets, and node \(P\) only receives and forwards \(PR_{P}-x\) packets accordingly. Thus, the packet dropping rate observed at node \(P\) is \((1-(\frac{PF_{P}-x}{PR_{P}-x}))\). We will prove Proposition 4 by contradiction: let us assume that node \(P\) is always considered by a monitoring node as legitimate. Formally,  
\[\forall x:(1-(\frac{PF_{P}-x}{PR_{P}-x}))\leq Th_{DR} \tag{2}\]  
From (2), it follows that: \(\forall x:f_{DR}(x)=(1-(\frac{PF_{P}-x}{PR_{P}-x})-Th_{DR})\leq 0\). As shown in Figure 5(b), \(\exists x:f_{DR}(x)>0\), which contradicts Equation (2). Hence, for some values of \(x\), node \(P\) is considered by a monitoring node as malicious. Therefore, the packet dropping rate feature cannot prevent the upstream-node effect.  
The relaxed flow conservation feature is resilient against upstream-node effect.  
Node \(P\) is considered by a monitoring node \(O\) as legitimate if \((PR_{P}-PF_{P})\leq Th_{RF}\). Otherwise, it is considered as malicious.  
A malicious node \(M\) drops \(x\) packets, and node \(P\) only receives and forwards \(PR_{P}-x\) packets accordingly. Thus, the relaxed flow conservation feature observed at node \(P\) is \((PR_{P}-PF_{P}-x)\). We check whether the following statement is correct:  
\[\forall x:(PR_{P}-PF_{P}-x)\leq Th_{RF} \tag{3}\]  
From (3), it follows that: \(\forall x:f_{RF}(x)=(PR_{P}-PF_{P}-x-Th_{RF})\leq 0\), as shown in Figure 5(c), and which proves Proposition 5. Hence, \(P\) is always considered by a monitoring node as legitimate.