## 5 Simulation and Results
### Results
allows for a more in-depth examination of the ORM's efficacy in detecting and mitigating threats compared to the more conventional TTD approach. Figure 6 shows the number of false negatives (FNs), where a malicious node is mistakenly categorized as benign. The ORM displays a consistent performance when the number of intruder nodes is 1, 3, 11, 13, and 15. Moreover, both approaches exhibit similar results for 5 and 9 intruder nodes. However, as the number of malicious nodes rises, the ORM's performance in terms of false negatives notably improves. The ORM's adaptive nature, especially due to the forgetting curve prioritizing recent behavior, allows for more accurate trust evaluations. This adaptability to changing node behaviors potentially contributes to the lower false negatives and higher accuracy of the ORM in identifying both benign and malicious nodes across diverse scenarios. Figure 5: Comparative analysis of false positives in ORM vs. TTD and RWC. Figure 6: Comparative analysis of false negatives in ORM vs. TTD. Undetected positives, as depicted in Figure 7, represent the nodes that could not be classified as benign or malicious due to limited observations. As the number of intruder nodes increases, the performance of the ORM improves. Figure 6 demonstrates that the ORM consistently recognizes fewer undetected positives compared to the TTD, which is especially evident with 7 and 15 intruder nodes. In other cases, both approaches perform similarly in identifying undetected positives. In terms of true negatives (TNs), where benign nodes are accurately identified as benign, both methods perform equally well when the number of malicious nodes is 5, 7, or 9. However, the ORM displays better performance, detecting more benign nodes compared to TTD, specifically for 1, 3, 11, 13, and 15 intruder nodes, as shown in Figure 8. The ORM's ability to consistently detect benign nodes across varying intrusion instances indicates a potentially enhanced discrimination capability compared to the TTD approach. This capability leads to a reduced number of false negatives, showcasing the ORM's precision in differentiating benign nodes, even in scenarios with different degrees of intrusion. Figure 8: Comparative analysis of true negative evaluation in ORM vs. TTD. Figure 7: Comparative analysis of undetected positives in ORM vs. TTD. In Figure 9, the undetected negatives represent the benign nodes. The identification of such nodes is challenging due to limited observations. However, as reflected in Figure 8, the performance of the ORM is comparable to the other methodologies. The ORM showcases enhanced performance, notably observable in scenarios where the number of malicious nodes reaches 13, as shown in Figure 8. The ORM's enhanced performance in identifying undetected negatives, especially prominent with 13 malicious nodes, stems from its adaptive trust evaluation. Additionally, the ORM's comprehensive evaluation, considering multiple trust metrics, likely aids in mitigating misclassifications, contributing to its better identification of benign nodes in challenging scenarios with limited observations. The ROC curve presented in Figure 10 offers a comparative analysis between ORM and TTD methodologies. This curve visualizes the relationship between Sensitivity (True Positive Rate) and False Positive Rate (FPR). Sensitivity measures the accurate classification of class M items, while FPR gauges the misclassification of items not belonging to class M. Additionally, Specificity (True Negative Rate) defines the precision in classifying items not of class M. The area under the curve (AUC) for the ORM is calculated as 0.7, indicating a notably higher probability of detection compared to TTD, which has an AUC of 0.55. This significant discrepancy suggests that TTD struggles to achieve an acceptable detection probability, indicating its limited applicability, especially in IoT systems where RPL implementation is lacking. Figure 10: Receiver operator curve—evaluating discrimination power in ORM vs. TTD.