## 2 Literature Review
Two important security properties were added: data authentication and data freshness. Data authentication ensures the receiver that the data was really sent by the claimed sender. Data freshness ensures that the message was not a replay to an old message. * In [37], SecLEACH was developed, and it was based on a random key distribution mechanism. The IDS enhanced the security of the S-LEACH through using a random key pre-distribution  
Figure 1: LEACH protocol topology. technique. In addition, it enhanced the Node-to-CH authentication but still it had some drawbacks. For example, data integrity of the schedule message was not delivered [35]. * In [18], MS-LEACH was developed and it was based on multi-hop/single-hop transmission. The IDS enhanced the security of S-LEACH IDS through providing node-to-CH authentication and data confidentiality using pairwise keys shared between CHs and their cluster members [18; 35]. One of its drawbacks, it did not provide authentication for join request messages [35]. Moreover, from the performance evaluation provided in the literature and in [38; 39; 40], it can be seen how IDSs have compromised the network energy because of their IDS mechanisms. As some researchers have introduced security through cryptographic algorithms, where those types of algorithms require lot of processing causing the energy requirement to be compromised. So it can be concluded, that not all IDSs are secure enough nor energy efficient [22; 25; 39]. Furthermore, performance measurements and metrics were used in evaluating IDSs and routing protocols are reflecting the efficiency of the simulated network [41]. The used performance measurements and metrics differ from one study/research to another which include the network lifetime, number of rounds, consumed energy, delivered packets, delay and overhead measurements [40; 42]. Certainly, what we are measuring and evaluating will make a difference in the performance selection criteria/metrics, either if it is for the purpose of measuring the energy efficiency, security, scalability or overhead. However, it has been witnessed from several studies in [21; 43; 44] that different performance measurements were used regardless of the purpose (and even for the same purpose). There is no criteria/metrics standardization for measuring the performance and specifying if it is secure, scalable or efficient enough. Thus, leading to inconsistent measures and conclusions. For example, the proposed IDSs in [21; 43; 44] used different performance measurements, although they were used for the same purpose and for the same attack and using the same communication protocol. To clarify more, a performance comparison between those IDSs is provided in Table 1. The compared IDSs were developed with the same properties:  
* Goal and Purpose: Energy Efficient Attack Detection (or Detect the attack with the least amount of consumed energy). * Detected Attack: Packet-Dropping Attack
* Used Communication Protocol: LEACH protocol  
However, other important measurements should have been employed that are more relevant to the packet-dropping attack. For example, number of dropped packets, false positive (any normal behavior that is identified as anomalous or malicious) and false negative (any malicious behavior that is identified as normal) ratios. As for the energy efficiency, it was important to know when did the first and last node die throughout the simulation time. In order to develop and test IDSs, SE processes are required, starting by the first step which is selecting the suitable software model. In [45], a recent comparative analysis was provided to show