## 2 Background and Rationale
### Rationale  
Like in most en-route filtering scheme, PVFS and FASIN use minimum cost forwarding, i.e., the shortest path for forwarding the event reports. However during the path discovery phase, the e-CH discovers \(c\) (the value of \(c\) may be different for different clusters) different paths to the sink to overcome a node failure. The shortest path is always used for data forwarding until a node failure occurs on the path. Due to this uneven distribution of workload in the intermediate nodes, the energy dissipation behavior is uneven across the network. Therefore, nodes with extra workloads (i.e., receiving, verifying and forwarding the data) die out sooner due to rapid energy loss. Therefore, the energy of the CHs on the shorter paths deplete rapidly compared to that of the nodes/CHs on other paths [30] even though the number of verification nodes on every path is same (and therefore so is the filtering strength). However, some paths have more verifications nodes closer to the e-CH than other paths. The path that has the lowest average distance of the intermediate verification nodes from the e-CH has more verification nodes closer to the e-CH. It will be more convenient to filter false reports earlier if the attack rate is higher. Equation (1) calculates the average number of verification keys stored on a filtering CH\({}_{i}\). \[N_{ver-keys}=c\cdot(d_{max}-\ d_{i}), \tag{1}\]  
\(d_{max}\) is the distance between the farthest CH and the BS and \(d_{i}\) is the distance between the CH\({}_{i}\) and the BS [7]. CHs that are closer to the BS hold more keys than the CHs that are farther away, and thus they are expected to perform more verifications for several different clusters that generate reports. Moreover, if filtering nodes are nearer to the BS, false reports may travel farther before they are filtered. Since nodes around the BS perform data-relay activities more often on behalf of several clusters, their energy drains more rapidly than other nodes in the network. Therefore, a hotspot problem occurs around the BS. Selection of verification nodes away from the BS and closer to the report generating CHs helps to filter false reports earlier and avoid the hotspot problem from happening around the BS. Moreover, authentication keys are created and shared only once during the initialization phase of network deployment. In FASIN, the same shared keys are exchanged between the newly chosen and previously active verification nodes. In PVFS, the filtering nodes are chosen probabilistically and remain fixed during the entire lifetime of the network. However, one serious problem with the static sharing of authentication keys and verification node selection is that the filtering nodes may get compromised, and the adversary can obtain all the verification keys on the compromised intermediate node. Therefore, it is highly desirable that both the verification nodes be chosen dynamically, and the authentication keys be created and shared afresh with the intermediate verification nodes. In most routing protocols, only the energy is considered during the selection of routing paths. However, in the presence of a security attack, the selection of such paths may result in a rapid depletion of energy resources of nodes than the paths that have not been chosen so far [31]. PVFS is static and does not adapt to the frequency of the attacks, data generation rate, and the energy on the nodes participating in the data forwarding and verification. Furthermore, PVFS does not use back check keys and drop report acknowledgment [11]. In FASIN, the filtering nodes are initially chosen randomly. However, as time passes, the nearness of the verification nodes to the location of the e-CH is gradually improved adaptively in response to the current attack situation and the average node energy on the path. The dynamic selection of verification nodes in FASIN only takes place on the same path used for data forwarding, i.e., the chosen shortest path.