# Method for Detecting Abnormal Activity in a Group of Mobile Robots
## 5 Experimental Results
### Analysis of the Results of an Experimental Study  
Therefore, to summarize the experimental study, we can consider Table 4. Table 4 presents the control numbers of the experiments. After conducting various types of attacks with varying degrees of intensity, several findings were determined. The data presented in the table were obtained from the node, which was the attack. That is, the victim node performed the calculations itself and relied on the data collected by it. Table 4 shows that, in denial of service attacks, a significant increase in the metric dispersion of network congestion is observed. When Black-Hole attacks occur, there is a decrease in the obtained metric values compared to normal behavior. The decrease in the metric values is due to the fact that, during the Black-Hole attack, the traffic intensity decreases. An attacker drops packets and, therefore, proxies do not receive them. Therefore, the nodes do not spend additional resources for receiving packets, and the overall network load is reduced. Denial of service shows a sharp increase in traffic, and the Black-Hole decreases in traffic levels. The \(Ratio_{s}\) metric should tend to one; with a denial of service attack, an increase in the metric is observed, and, with the Black-Hole attack, it goes to zero. For \(\text{Dev}_{\text{N},\text{j},\text{s}}\) in the examples of the presented attacks, we can say that, if an attack causes traffic growth, then the metrics grow; if there are different attack intensities, then the metrics grow to one degree or another. If the attack reduces traffic, then the metrics tend to zero or less, compared with the nominal behavior. Thus, we can say that the selected metrics allow us to fix the deviation from the static behavior of the system, while it can change both in the direction of traffic growth and decrease it. Also, we added ICMP-flood (ICMP - Internet Control Message Protocol) attack.  
\begin{table}
\begin{tabular}{c c c c} \hline
**ParameterAttack** & **DDoS** & **SYN-Flood** & **Black-Hole** \\ \hline CPU load (\%) & + & + & - \\ \hline Download RAM (Mb) & - & - & - \\ \hline CPU temperature (\({}^{\circ}\) C) & - & + & - \\ \hline Power consumption & + & + & - \\ \hline Number of packages & - & + & + \\ \hline Channel availability & + & - & - \\ \hline Dropped packet & - & + & + \\ \hline \multicolumn{4}{c}{+ indicates that influence takes place; - denotes that no influence takes place.} \\ \end{tabular}
\end{table}
Table 3: The impact of attacks on the characteristics of the mobile device. DDoS—distributed denial of service; CPU—central processing unit; RAM—random-access memory.  
According to the test results, it was determined that the developed software allows you to analyze the behavior of the device on the network, identify anomalies, and determine what type of attack is carried out on the network node. The maximum optimization of the application was achieved, for which the consumption of hardware resources was minimal.  
A distinctive feature of the application is the ability to test the site autonomously, not based on the analysis of neighboring nodes.