## 3 Proposed Detection Mechanism
### Traffic Classification
The CAIDA dataset contains around an hour of anonymized traffic traces from a DDoS assault that occurred on 4 August 2007. This form of denial-of-service attack tries to prevent users from accessing the targeted server by using all of the server's computational resources and all of the bandwidth on the network linking the server to the Internet. To represent flash crowds, the World Cup 1998 dataset is used. The World Cup 1998 data is a compilation of requests made to www.france98.com (accessed on 3 March 2021) during the football tournament. In related studies, the World Cup 1998 dataset is used as a flash crowd dataset. While having these two datasets experimented with, it is assumed that the proposed mechanism will also be similarly effective with other types of real-world scenarios. There is no specific DDoS or FC related dataset seen that is meant for WSNs only. Moreover, the chosen datasets are mainly processed on the BS that has adequate resources and capable to perform similar to the nodes in the wired networks. Additionally, various methods are utilized to create the dataset. Some fragments of the dataset are created from simulations and then from the real traffic to train and test the proposed system. The distribution of nodes in the dataset is designed as follows: (a) attack nodes are 30%, (b) normal nodes are 40%, and (c) FC vectors are 30%. This section is further divided as follows: In Section 4.1, calculation of threshold value is discussed. The classification of normal and abnormal nodes is performed in the first experiment discussed under Section 4.2. In Section 4.3, the abnormal nodes' traffic is further analyzed to determine the attack and flash traffic flows. In Sections 4.4 and 4.5, the same procedure is repeated to obtain another set of results. The experimental results on the real dataset are given in Section 5. The key parameters are listed in \[\sigma=\sqrt{\sum_{i=1}^{n}\frac{(h_{i-}\mu)^{2}}{n}}\]1

### Threshold Value

Different experiments were performed to obtain the threshold value for varying numbers of nodes (30, 40, 50, 100, and 200). However, we obtained the optimal result for 30 nodes. For threshold value, 30 out of 100 nodes were selected to transmit packets with different data rates varying from 10 kbps to 40 kbps. The total simulation time was set to 60 s, during which the nodes transmitted their data towards the BS. The simulation time was then 12 intervals each having a slot of 5 s. According to the procedure, the median of the received packets was computed for each interval. A total of 12 median values were computed for the entire simulation time. Another median was computed of these obtained 12 median values. The ultimate value computed was 167 vectors per slot. This value is considered as the threshold value. \begin{table}
\begin{tabular}{l l} \hline \hline
**Parameter** & **Values** \\ \hline Simulator & NS-2.33 \\ Duration of Simulation & 60 s \\ Nodes’ Transmission range & 250 m \\ Network Area & 1000 \(\times\) 1000 m \\ Base Protocol & AODV \\ Number of Nodes & 100–200 \\ Nodes’ Distribution & Random \\ Traffic source & CBR \\ Maximum speed of node & 10 m per second \\ Packet Size & Random \\ Nodes’ Pause Times & 10 to 60 s \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Parameters for experimental simulation. ### First Experiment

The first experiment was performed based on 30 nodes to verify the performance of the mechanism for abnormal and normal traffic categorization. According to the procedure, 10 nodes were identified as normal while the rest were abnormal. Table 3 shows the number of packets generated by normal and abnormal nodes in 60 s. The same values are graphically represented in Figure 3.

### Classification of Traffic

The 20 suspicious nodes were further classified as attacker and flash nodes. The attacker nodes frequently transmitted packets from 20 to 40 kbps with the same sized packets with a constant timespan, while flash nodes frequently transmitted random-sized packets with an irregular time span from 25 kbps to 45 kbps.