## 5 Performance Analysis
In the meantime, the time \(t_{e}\) and \(t_{e_{1}}\) which are included in the two time-location claims are assumed to obey the uniform distribution in the same epoch, so the average difference of the two times is:  
\[E(|t_{e}-t_{e_{1}}|)=\frac{\overline{T}+\overline{T}_{stop}}{3} \tag{34}\]  
Therefore:  
\[P_{d}(i,j)= \begin{cases}P_{d}\times((\overline{T}+\overline{T}_{stop})/3)&,i= j\\ 0&,i\
eq j\end{cases}  \tag{35}\]  
Then we substitute Equations (28) and (35) into Equation (33) to obtain:  
\[P(N_{d}=k)=2^{(2k-1)}\times(1-p)^{2(k^{2}-k)}\times p^{2k}\times(1-\frac{ \pi}{D}\times{v_{\text{max}}}^{2}\times\frac{(\overline{T}+\overline{T}_{stop })^{2}}{9}) \tag{36}\]  
After \(n\) epochs, the witness node detects the two malicious nodes with the following probability:  
\[P_{2}(n)=\sum_{k=1}^{n}\left(\prod_{\omega=0}^{x-1}{(1-P(N_{d}=w))\times P(N_ {d}=k)}\right)P_{2}(n)=\sum_{k=1}^{n}P(N_{d}=k) \tag{37}\]  
The real probability that one witness node detects replicas is larger than \(P_{2}(n)\), since the witness nodes have some probability of sampling more than one measured speed before the \(k\)th epoch but until the \(k\)th epoch, the witness node detects the node replication attacks. In the proposed scheme, each node has \(\sqrt{N}\) witness nodes, the detection probability after \(n\) epochs in step 2 is \(P_{d2}(n)\):  
\[P_{d2}(n)\geq 1-(1-P_{2}(n))^{\sqrt{N}} \tag{38}\]  
When the node replication attacks are not detected at the second stage of the detection protocol, the protocol proceeds to the third phase. We assume there are only two witness nodes which would detect the compromised node \(e\) and its cloned node \(e_{1}\). Let \({N_{m}}^{\prime}\) denote the number of epochs before the malicious node is detected in the second phase of the protocol. Let \(P({N_{m}}^{\prime}=k)\) represent the probability that the node replication attacks are not detected until the \(k\)th epoch in the second stage of the protocol, under the premise that there is one speed sample gained from the malicious nodes:  
\[P({N_{m}}^{\prime}=k)=\frac{1}{2}{\sum\limits_{i=1}^{k}{\sum\limits_{j=i}^{k}{P( N_{m}=i)\times P(N_{m}=j)\times(1-P_{d}(t))}} \tag{39}\]  
\(P_{3}(n)\) represents the maximum probability that the witness node detects the two malicious nodes in the third phase of the protocol after \(n\) epochs:  
\[P_{3}(n)=\sum\limits_{k=1}^{n}{p\times(1-p)^{k-1}\times P({N_{m}}^{\prime}=k)} \tag{40}\]  
where \(p\) is the probability that any two mobile nodes encounter in an epoch. According to the principle of Sequential probability ratio test, we assume that \(p_{fp}\) is the false positive rate and \(p_{fn}\) is the false negative rate, in the light of [PERSON]'s theory [PERSON] (1995), the predefined maximum boundary of \(p_{fp}\) is computed by \(p_{fp}\leq\frac{\eta}{1-\gamma}\). Similarly the truth, the predefined maximum boundary of \(p_{fn}\) is computed by \(p_{fn}\leq\frac{\gamma}{1-\eta}\). The sum of the false positive rate \(p_{fp}\) and the false negative rate \(p_{fn}\) meets the following inequality:  
\[p_{fp}+p_{fn}\leq\gamma+\eta \tag{41}\]  
Since \(p_{fn}\) is the false negative, therefore the detection probability for node replication attacks is \(1-p_{fn}\). The lower bound of \(1-p_{fn}\) is given as follows:  
\[1-p_{fn}\geq\frac{1-\gamma-\eta}{1-\eta} \tag{42}\]  
Because each witness node has some probability to sample more than one measured speed before the \(k\)th epoch, and the witness node detects the node replication attacks until the \(k\)th epoch, so the real probability that one witness node detects replicas is larger than \(P_{3}(n)\). Let \({P_{d3}}^{\prime}(n)\) denote the probability that the node replication attacks are detected in the third stage of the protocol when there are only two witness nodes. Then we can substitute the lower bound of replica detection probability into Equation (40) to obtain:  
\[