# Clear database from old data
## 8 Experiments and Discussion
Logging main events in the network, such as adding a node or reconfiguring roles, makes it possible to implement mechanisms for detecting attacks related to, for instance, Denial-of-Service or unauthorized increase in resource consumption. In case of a Denial-of-Service attack mounted through the ability to add and remove network nodes, the remaining nodes start to constantly update their configuration files. These events lead to increased resource consumption and energy consumption. Thus, through the analysis of the event log, it is possible to detect an inflated frequency of adding or deleting network nodes, which can be used as one of the important features of such attacks. To test the proposed data collection algorithm and attack detection algorithm, a Denial-of-Service attack (flood attack) was simulated on the test-bench of a self-organizing decentralized WSN with role-based functioning. Schematically, the simulation is presented in Figure 11. In essence, the attack consists of connecting a malicious node to the network and unauthorized initiation of the mechanism for redistributing roles. It is assumed that the attacker performs the following steps to realize this attack: connecting a compromised node to the WSN; initiating a request for redistribution of the roles of the nodes; incorrect completion of the role's redistribution request; returning the network to its original state; repetition of all previous steps several times. Figure 11: Illustration of attack impacts by simulating a flood attack. As a result of this attack, all WSN nodes are constantly forced to spend additional computing resources and energy resources on service responses that are necessary for the normal process of role redistribution. However, the redistribution of roles is completed incorrectly, and the WSN returns to its original state, and so forth. Ultimately, the network's performance is disrupted, and the autonomous life of its nodes is significantly reduced. In the process of modeling this attack, a dataset was collected. This dataset contains sensor readings from collectors transmitted over the network, as well as entries of the service log of the network controller, which includes requests for network redistribution and reconfiguration. The performed experiments on the test-bench confirmed that the collected data were sufficient to correctly detect the simulated attack. Some initial data that are required for the detection but are not explicitly in the logs are calculated by using statistical methods. For example, the value of the average frequency of role redistribution of nodes is calculated by using information from the service log of the network controller. A few instances of detection modules for several variations of attacks were built. To produce these attack detection modules, machine learning methods realized in the scikit-learn library were used. The following classifiers were used: AdaBoost, Random Forest, Bayesian classifier (MultinomialNB), LogisticRegression, linear SVM classifier, decision trees and RidgeClassifier. The dataset constructed for the experiments contained data for the following types of attacks:  
* Impacts on user and service data in the WSN (i.e., two variations, a common attack and one with the exploitation of the properties of self-organization and decentralization). These impacts involve distortion of the readings of WSN sensor values, as well as distortion of service data (sinkhole attack);
* Impacts on network devices (two variations, a common attack and one with the exploitation of the properties of self-organization and decentralization). These attacks include physical and other impacts on the nodes (hello-flood attack). The results of the experiment are presented in Table 8. It discloses the name of the better particular ML method for detecting each type of impact and the values of the detection quality indicator (f-score was chosen as the most representative single indicator).