## 2 Related Works  
[PERSON] and [PERSON] [9,10] described a Lightweight Security Scheme (LWSS) as an approach that can be used to detect a selective forwarding attack in the sensor network field. LWSS uses a multi-hop acknowledgment to launch alarms by obtaining responses from the nodes that are located in the middle of a path. This approach has as a target the detection of network attackers. The target is to send an alarm that indicates a selective forwarding attack when a malicious node is discovered. The authors used two detection processes in the scheme, namely a downstream process and an upstream process. Sending an acknowledgement packet and alert packet would drain energy during the detection process. In thisapproach, a node is randomly selected as the checkpoint that sends a message acknowledging the detection of an adversary. Among the drawbacks of LWSS we may list the following:  
* Resending the packet by using another route causes energy consumption and delays during the detection.
* Transmission of the acknowledgement packet and one-way key packet also cause energy consumption.
* The scheme lacks scalability.
* The scheme spends much effort on detecting the attack thus it lacks efficiency.
* The LWSS scheme could not detect the attacks under some certain conditions.
* Sending the acknowledgment causes wasted energy.
* There is no commitment to reliability if the packet is dropped.  
[PERSON] and [PERSON] [11] described an approach to detect selective forwarding attacks. The approach is called Lightweight Detection (LWD). It consists of a lightweight mechanism where each sensor node is provided with a detection module that is built on top of an application layer. A sensor node sets its routing rules and uses information about its two-hop neighborhood to generate an alert packet. [PERSON] and [PERSON] suggested two routing rules to improve the monitoring system. The first rule is to determine whether the destination node forwards the packet along the path to the sink. The second rule is that the monitoring node waits and detects a packet that had been forwarded along the path to the sink. Some of the drawbacks of LWD are:  
* The network has a static topology. Therefore, the LWD scheme will not detect the attack if there is a change in the type of topology.
* There is no guarantee of reliability.
* The detection scheme is not work if a node is compromised.  
[PERSON] _et al._[12] proposed Secure Data Transmission (SDT) for detecting a selective forwarding attack. They used watermark technology to detect malicious nodes. Prior to employing a watermark-based technique, they used a trust value to find a source path for message forwarding. When the network is initialized, all of the nodes are assigned the same trust value. [PERSON] _et al._ used a watermark-based technique to calculate the amount of packet loss. The base station compares the extracted watermark to the original watermark to detect a selective forwarding attack. Among the drawbacks of SDT Drawbacks one can mention:  
* There is no data resend method if the packet is dropped.
* The SDT scheme cannot detect a malicious node if more than two.
* The scheme is not convenient for sensor-caused malicious nodes and the BS cannot compromise.  
[PERSON] _et al._[13] proposed Received Single Strength Indicator--Extra Monitor (RSSI-EM). They used extra monitoring (EM) to eavesdrop and monitor all of the traffic when data were transferred between nodes. The value of an RSSI is that four EM nodes can be arranged to establish the positions of all of the sensor nodes, with the base station located at (0, 0). They assumed that the attackers could capture and damage the nodes. Therefore, all of the sensor nodes must protect themselves or be made from tamper-resistant hardware. The RSSI-EM drawbacks are:* The topology is static thus any change will affect the efficiency of the scheme.
* The scheme accuracy is low.