## 6 Experimental Evaluation of SRF-IoT Framework
### Configuration and Metrics  
The settings and metrics utilised for evaluation purposes of the SRF-IoT framework are discussed in this subsection. We considered the median value in our calculations as it is robust against outliers. In many experiments, due to the random behaviour of the attackers, \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **BR** & \begin{tabular}{c} **IDS** \\ **Root** \\ \end{tabular} & \begin{tabular}{c} **Benign** \\ **Nodes** \\ \end{tabular} & \
\begin{tabular}{c} **Malicious** \\ **Nodes** \\ \end{tabular} &
\begin{tabular}{c} **IDS** \\ **Detectors** \\ \end{tabular} & **Total** \\ \hline Normal scenario & \multirow{2}{*}{\(1\)} & \multirow{2}{*}{\(1\)} & \multirow{2}{*}{\(30\)} & \multirow{2}{*}{-} & \(5\) to \(15\), Trust & \multirow{2}{*}{\(37\) to \(47\)} \\ with MRHOF & & & & & & \\ \hline Malicious scenario & \multirow{2}{*}{\(1\)} & \multirow{2}{*}{\(1\)} & \multirow{2}{*}{\(30\)} & \multirow{2}{*}{\(6\) Blackhole} & \(5\) to \(15\), Trust & \multirow{2}{*}{\(43\) to \(53\)} \\ with MRHOF & & & & & & \\ \hline SRF-IoT scenario & \multirow{2}{*}{\(1\)} & \multirow{2}{*}{\(1\)} & \multirow{2}{*}{\(1\)} & \multirow{2}{*}{\(30\)} & \multirow{2}{*}{\(6\) Blackhole} & \(5\) to \(15\), Trust & \multirow{2}{*}{\(43\) to \(53\)} \\ with SRF-OF & & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Number of node types in each scenario. \begin{table}
\begin{tabular}{c c c} \hline \hline
**RPL InstanceID** & **Node Type** & **Description** \\ \hline
0 & BR &
\begin{tabular}{c} Acts as a sink node. Receives messages and sends only UDP replies. \\ \end{tabular} \\ \hline
0 & Benign node &
\begin{tabular}{c} Uses RPL-lite to create a mesh network and sends data periodically to BR. \\ \end{tabular} \\ \hline
0 & Malicious node &
\begin{tabular}{c} Uses RPL-lite to join the network and advertises low rank (rank attack) and drops all incoming packets (blackhole attack). Also, it sends UDP packets like benign nodes. \\ \end{tabular} \\ \hline
1 & SRF-IDS Root &
\begin{tabular}{c} Plays the role of sink in IDS and collects all the information from SRF-IDS detectors. \\ \end{tabular} \\ \hline
1 & \
\begin{tabular}{c} SRF-IDS \\ Detector \\ \end{tabular} &
\begin{tabular}{c} Sniffs traffic of monitored network to detect malicious nodes. Stores information about messages exchanged and packets forwarded. \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Node types and configuration. observed results differ significantly. Therefore, to get a more realistic picture of the results and avoid outliers, we used median value. The metrics used are the following:  
* Median Packet Delivery Ratio (PDR): Indicates the median value of the ratio of the total number of unicast packets received by BR up to the total number of unicast packets generated by all benign and malicious nodes. It does not include UDP re-transmitted packets. * Median Parent Switch: Presents the median value of the number of parent switches that benign and malicious nodes execute during the simulation. A parent switch happens to select a better route to the BR. Changing parent results to changing the rank of a node. * Median Packets Dropped: Shows the median percentage of packets dropped by the attackers during the simulation. Malicious nodes drop all types of packets that normally should be forwarded to next hop. * Median IDS Packet Overhead: Indicates the median percentage of the SRF-IDS detector's packets sent to SRF-IDS root and the monitored network during simulation. The value is calculated from the number of packets exchanged in \(N\) repetitions. Below, the mathematical definitions for the metrics are provided. Let  
\[S_{r}=\frac{Rcvd}{\sum_{k=1}^{n}P_{k}} \tag{4}\]  
be the packet delivery ratio for repetition \(r\) where \(Rcvd\) is the total number of packets received at BR, \(k\) is the number of node sending the packets, \(n\) is the total number of nodes, and \(P_{k}\) is the total number of packets sent from node \(k\).