## 4 Analysis
### Security Analysis  
#### 4.1.1 Replication Attack  
Since nodes need authentication keys to communicate with other nodes in our mechanism, a variety of external attacks could be resisted effectively because those nodes cannot provide a legitimate key to access the network. We detail how the mechanism MSA resists replication attack. The influences will be shown by adjusting the value of \(\Delta\). \(|\mathrm{u}\mathrm{u}^{\prime}|<\mathrm{R}\): If the compromised node \(u\) and the replica of the compromised node \(u\)' collude in claiming the same position and carefully choosing one of them to transfer messages, the other meanwhile keeps silent to escape the detection. In this case, the replica of the compromised node is hard to detect because of the accuracy limit of the location verification. On the contrary, malicious nodes could be detected easily when the compromised node and the replica of the compromised node claim different positions. In a real situation, the replicas of the compromised nodes would be deployed in a large region to get more secret information. Hence we will move on to the next situation. \(\mathrm{R}\leq|\mathrm{u}\mathrm{u}^{\prime}|<2\mathrm{R}\): Figure 1 depicts an overlapped area S between MSA\({}_{\mathrm{u}}\) and MSA\({}_{\mathrm{u}^{\prime}}\). Replication attacks will be detected if there is at least one witness node in area S. MSA_LD-1 works in this situation and we set the value of \(\Delta\) to R. The witness nodes could detect contradiction that two nodes marked with the same ID are in different positions at the same time by communicating with both of them. Figure 1: An example of detecting a replication attack by using LD-1. According to Equations (1) and (2), the following equation can be derived:  
\[\text{P}(|n|\geq 1)=1-\text{P}(|n|<1)=1-e^{-\rho S} \tag{6}\]  
Equation (6) reflects the probability that there is at least one node in area S. Figure 2 shows the detection probability. The probability is related to the probability that there exist nodes in the overlapped area. That is to say, it is related to nodes' communication range R and nodes' density \(\rho\). As shown in Figure 2, the value range of \(\rho\) is from 0 to 0.1. \(\rho\) denotes the number of nodes per unit area. We set the values of R as 15 m, 11 m, 7 m and 3 m, respectively. With a smaller communication range, a lower detection probability follows. The probability is higher when the density of nodes is increased. \(2\text{R}\leq|\text{u}\text{u}^{\prime}|<3\text{R}\): In this case, we could use LD-2 to detect the replicas of the compromised nodes, as shown in Figure 3. Here, we set \(\Delta=1.5\text{R}\). Figure 3 depicts an extreme situation in which \(|\text{u}\text{u}^{\prime}|=3\text{R}\). In this case, witness node \(\text{w}_{1}\) has the information of u and meanwhile \(\text{w}_{2}\) has the information of \(\text{u}^{\prime}\). When these two witness nodes encounter each other, they exchange their neighbor lists and find the contradiction that two nodes marked with the same ID are in different positions at the same time. Thus the attack is detected. Next, the probability is calculated. Figure 3: The model of detecting replication attack by using LD-2. Figure 2: The result of detection probability for resisting replication attacks by using LD-1. As shown in Figure 4, the critical distance between \(w_{1}\) and \(u^{\prime}\) is 2R. \(S_{1}\) is the overlapped area between the first small circular area and the biggest circular area. In this overlapped area, \(w_{1}\) can communicate with \(u\) and \(w_{2}\) at the same time. \(S_{2}\) is the overlapped area between \(w_{1}\)'s communication range and the circular area with center point \(u^{\prime}\). In the area \(S_{2}\), \(w_{2}\) can communicate with \(w_{1}\) and \(u^{\prime}\) at the same time. In this model, the detection probability is:  
\[P=(1-e^{-\rho S_{1}})*(1-e^{-\rho S_{2}}) \tag{7}\]  
\(P_{1}\) represents the probability there is at least one node in \(S_{1}\).