## 4 IDS Analysis from Software Engineering Perspectives
### Shortcomings of Existing IDSs from SE Perspectives  
Currently developed IDSs do not show clear, structured software development processes. Consequently, resulting inadequate requirement management, processing, validation, and verification of requirements quality [19]. To elaborate more on the evidence provided in the literature, the detection process is not deployed at each layer of the hierarchy. For example, the malicious behavior can occur at the nodes layer, CHs layer, or BS layer. Thus, the problem is being unable to detect all possible malicious behaviors which affects the performance of the proposed IDSs in terms of increasing the detection delay and the energy consumption, in addition to degrading the detection accuracy, as illustrated in previous studies. To discuss further the software failure causes that were found in the IDSs, some of them have been presented in [47; 48; 50] and they include but are not limited to the following:  
* Poor system development planning. * Inadequate requirement engineering process. * Requirements not adequately identified, managed, and validated. * Unclear and badly defined requirements. * Incorrect requirements. * Misunderstanding of requirements. * Requirements continually changing. * Not all requirements are traced while testing. Therefore, the above points need to be considered when developing an IDS and all requirements need to be gathered, fulfilled, and traced with regard to WSN resources limitation, to be specific, energy supply limitation. In order to achieve this goal, the system development must go through a set of SE processes. Engineering an IDS while following the needed SDLC phases, applied on WSNs systems, is important to develop an efficient IDS--thus allowing the system to deliver the required functionalities, with respect to operational constraints, with an improved performance, accuracy, and reliability [51]. Therefore, this study has selected a hierarchical energy efficient IDS that was proposed in [21], to illustrate the lack of SE and how it is important to have a synergy between the SE field and WSN field. This IDS detects Black hole attacks, which is an attack that drops the whole data packets and prevents them from reaching the BS. In other words, dropping packets means that data will not be sent. The routing protocol used by this IDS was LEACH protocol, and this is why their IDS was energy efficient. However, the LEACH protocol has no security services; in other words, the LEACH does not detect attacks. To clarify it more, Figure 3 illustrates the LEACH routing protocol. Therefore, on the same routing scheme of the LEACH protocol, a black hole detection schema was added. However, adding security to the LEACH is challenging because it is dynamic and it uses randomness in some of its functionalities [16]. Consequently, it periodically rearranges the CHs and changes the links between sensor nodes, due to the fact that it has a lot of overhead and hence it is not a recommended routing technique to provide security with the least amount of resource usage, as these properties make achieving security more difficult [16]. Furthermore, the detection process was performed on CHs only because LEACH protocol is a cluster-based protocol that relies essentially on CHs for data aggregation and routing [24; 36; 37]. Thus, electing a malicious node as CHs is the most devastating and damaging attacks to the network [36; 37]. The detection schema proposed in [21] selected a second cluster head (SCH) that keeps track of what has been received by the CH. The SCH was selected based on the node that has the highest remaining energy. The tracking process starts by having the nodes, associated with the CH, sending control packets to the SCH. The control packets contain the node identifier (ID) and the number of packets sent to the CH (Nbrpk). The associated nodes send their control packets at the end of the transmission phase to the SCH. Then, the SCH sends its received data to the BS.