# A Cross-Layer, Anomaly-Based IDS for WSN and MANET
## 5 Experimental Setup  
In the network of 30 nodes, there exist five data sources transmitting data to five destination nodes (sinks). All other nodes act as routers following an AODV protocol. In the experiment, UDP (user datagram protocol) connection was used and data traffic of constant bit rate (CBR) was applied between source node to destination nodes. The network used in this experiment has a data rate of 2 Mb/s (802.11b) and assumes a Friis loss model [17]. Different power levels and node velocities are studied in the paper as shown in Table 4.  
The raw data were collected by simulating a network of thirty mobile nodes using the widely adopted discrete-event network simulator NS-3. A node's mobility follows the random way point (RWP) mobility model. Five of the nodes are designated as dedicated sniffers that collect data from the neighboring nodes promiscuously. They then generate CCIs, which in turn are sent to the supernode that performs the AMoF algorithm that includes a linear regression of the MoF so that it can detect the malicious nodes. The first level detection is at the sniffers' level, where each sniffer generates a CCI at each Tr. Simple, yet effective, machine-learning algorithms have been adopted; most notably, the C4.5 decision tree or random forest. A supervised learning approach is adopted, which means simulations for both normal and malicious dataset retrieval are needed. The number of sniffers was chosen as a tradeoff between the following considerations:  
1. The Area covered is 1000 m by 1000 m, which requires a sufficient number of sniffers, especially when having low connectivity scenarios, e.g., node speed = 15 m/s, and power level 3 dBm (NS15P3). 2. The variability of data collected from a small number of sniffers will on average be higher than collected by a larger number of sniffers. The ability to provide effective intrusion detection for a small number of blackhole malicious nodes, i.e., the expectation is: the larger the number of black holes, the larger the required number of sniffers. For those reasons, the number of sniffers chosen was five, to provide effective area coverage, moderate variability, and effective operation for up to three black holes. The first set of simulations was performed to obtain the behavior of the network under normal conditions (no black holes deployed), by running the experiment for 2000 s each time for twenty different seeds, to have a better statistical average, for every single scenario. In the second set of simulations, a malicious condition was obtained by deploying three black holes in the network and running the simulations as in the normal case for another twenty seeds for each single scenario. The power levels, the node's mobility, and other simulation parameters are listed in Table 6.  
The extreme case scenarios adopted in this paper are chosen such that they span a diversity of node velocities and power levels. These scenarios are: NS1P3, NS1P7, NS15P3, and NS15P7. The abbreviation NS1P3, for example, means node velocity 1m/s and power level of 3 dBm. The model of normal and malicious states is obtained at every reporting time and is used to train the classifiers which, in turn, generate the CCIs. Different reporting times are used: 50 s, 100 s, and 200 s, and within each reporting time, different sampling times are used such as 5 s, 10 s, 20 s, and 40 s, depending on the length of the reporting period. For example, if we have a reporting time of 50 s, the sampling time used is 5 s, or 10 s, the ratio between _Tr_ and _Ts_ is chosen to have at least five instances in each class (normal or malicious). A reporting time of 200 s and sampling time of 5 s, will give 40 instances for each class.