## 4 Protocol Framework
### Sequential Probability Ratio Test  
In a static network environment, it would be illegal for a static node to appear in different locations, so a static sensor node is reasoned to be a replica node according to its appearance in more than one place. When the sensor node is mobile, a legal node would be falsely regulated as a cloned node or a captured node, so the judgment on whether a sensor is a replica node cannot be dependent on the technique. We must try to search for other techniques for cloned node detection in mobile environments. According to the mobility property of the sensor nodes, a normal node would not be able to move beyond some maximum speed \(v_{\max}\) which can be scientifically configured by the system. On the contrary, a replica nodes' measured speed would be faster than the ordinary speed, it would even appear to be over the speed threshold, provided the adopted velocity measuring system possesses a low error rate, since there are two or more than two mobile nodes with the same identity in different places at once. Without loss of generality, provided that the speed of a mobile node exceeds the predefined value, there is therefore a high chance that the node is detected as a cloned node. That is, a high speed exceeding \(v_{\max}\) means that two or more than two mobile nodes which are subverted or cloned are found out to coexist in the sensor network. Due to the clue of maximum speed, the method of Sequential Tests of Statistical Hypotheses [37] has been proposed to solve the detection of node replication attacks. [PERSON] first put forward the theory of the Sequential Probability Ratio Test (SPRT). In fact SPRT is a particular statistical model. In 1933, [PERSON] further proposed a sequential analysis problem using as inspiration the results reported by [PERSON] and [PERSON] [38]. A new detection method for node replication attacks which leverages a Sequential Probability Ratio Test is proposed. According to the Sequential Tests of Statistical Hypotheses, the test is assumed to be a direct line random walk between the prescribed minimum pointer and the prescribed maximum pointer. At the start, the prescribed minimum is linked to the null hypothesis. On the other hand, the prescribed maximum is linked to the alternate hypothesis. When the test begins, the random walk moves from an arbitrary point on the direct line toward the two endpoints including the lower limit and upper limit. Its movement is in the light of the measured speed of a moving sensor node. The lower limit should be constructed by linking with a speed that is below the predefined maximum value \(v_{\max}\), and the upper limit should be considered to exceed \(v_{\max}\), respectively. Each time the random walk hits or crosses the prescribed minimum, then the null hypothesis is accepted, that is the mobile sensor node is detected as a normal node. For another aspect, when the random walk hits or crosses the prescribed maximum, then the alternate hypothesis are accepted, that is the mobile sensor node is detected as a replica node or captured node. The basic principle of Sequential Tests of Statistical Hypotheses which is applied for the mobile replica detection can be described as follows: as a moving node migrates to a new position, it is necessary to judge whether the meeting one-hop neighbors are its witness node. If the meeting neighbors are just the witness node, each of the neighboring witnesses asks for a signed time-location claim and decides whether to store the received claim probabilistically. The witness node computes the speed by the application of two consecutive time-location claims of its tracked mobile node. Here, every speed is considered as an analysis sample of Sequential Tests of Statistical Hypotheses. If the sample exceeds the system-configured speed \(v_{\max}\), the random walk would be expedited in the direction of the prescribed minimum. Once the roam hits or crosses the prescribed maximum, and then node replication attacks are detected.