# Efficient Intrusion Detection Algorithms for Smart Cities-Based Wireless Sensing Technologies
## 4 Proposed Intrusion Detection Algorithms for Smart Cities Network
### Multipath-Based IDS (MBIDS)  
To solve the sinkhole problem, an MBIDS algorithm is assumed to be uploaded to all of the CHs. However, before describing the details of the algorithm, a modified version of the AODV protocol is introduced to guarantee disjoint routes as follows:  
To guarantee disjoint routes for the control messages, AODV is modified as follows:  
Once the RREQ is broadcasted by the source, each intermediate node receiving the request attaches its address to the request and broadcasts it again to its neighbors. This process is repeated until the request reaches the sink node. The sink node forms disjoint paths as a reply to the source node request through the selected paths to send the data through them. The proposed attack identification and prevention system, MBIDS, is described as follows:  
Phase 1: The network is divided into clusters, where each cluster has a CH. Phase 2: Once the data Msg is ready, an RREQ is instantiated by the CH as a source node. The reply Msg includes two different paths to the sink node, as stated previously, in the modified version of AODV protocol. The CH sends the data Msg through one of the received routes and generates Ctrl Msg through the other route. The Ctrl message consists of sender ID, size, control route information, packet information route, and checksum. Figure 5: Typical routing scenario. Phase 3: Once the sink node receives the data message and both control messages, it starts to compare the control message with the received message. By analyzing the control messages, the sink node will realize if the received message is changed or it is received without change. In addition, if the sinkhole drops the received messages, the sink node would realize that by receiving the control messages. Phase 4: Since the sink node records all of the routes, it analyzes the history of the same route to discover which CH is attacking the traffic. Phase 5: If the sink node detects an intrusion, it broadcasts an alert to all of the CHs to avoid the compromised one. As shown in Algorithm 1, it is assumed to have \(S\) number of nodes, a set of cluster heads \(H\), and one sink node or more, \(SN\). When a sensor \(s_{i}\) is ready to send its sensed data, it sends the RREQ message to the \(CH_{j}\) connected to it. \(CH_{j}\) broadcasts a message to its neighbors following the procedure of phase 2, stated previously, \(Neigh\big{(}CH_{j}\big{)}\). Once it receives the two disjoint paths, it replies by RREP message to \(s_{i}\) with permission to send. After receiving the message, \(CH_{j}\) sends the received message (data msg) through one of the routes it received--Send (Msg)--and forms a Ctrl message to be sent through the other route Send (Ctrl). At the sink node, both data and the control messages are received from different routes. The sink compares the received data with the information contained in the Ctrl message. Basically, it compares the sender ID, Msg size, packet information route, and checksum. The packet information route is checked once more to guarantee the route is not tampered with, and the routes are disjoint routes. If the data do not match the information in the Ctrl message, then the route and its history are investigated. If a certain number of messages are directed to the same CH, such CH is considered as sinkhole node. Based on our experiments, 15 rounds are enough to detect the sinkhole.