## 4 Experimental Results
### Experiments  
One of the most representative identity attacks is the sybil attack, due to its aggressiveness and elusiveness. Besides, it includes most of the identity attacks (thief, mole, clone, etc.) by changing the behavior of the attack. Figure 2: Function for updating reputation values. Figure 3 shows the evolution of the reputation of every node before and after introducing the sybil attack. The Y-axis represents time whereas X-axis indicates space. Z-axis shows reputation values and it is represented by color gradation. These results have been obtained by simulating a scenario of 2,000 nodes while a sybil node that attacks with 800 identifiers. The sybil node is located in the center of the scenario while the reputation server is located at the origin. The system is working normally until the 1000 th iteration, when the sybil attack is launched. The experiments have revealed that the **detection time** is extremely similar in the three algorithms since the attacks are detected almost immediately. With the linear algorithms (Figure 3(a)), the reputation of the nodes close to the sybil node is strongly decreased and it takes a while for them to recover the initial reputation. Figure 3(b) shows that this effect is stronger with the beta algorithm but it can restore the reputation of the surrounding nodes of the attacker faster than the linear algorithm. On the other hand, the SOM algorithm (Figure 3(c)) does not affect the neighbors of the sybil node. The three of them also isolate the attacked nodes (thick black stripe), although SOM is more lenient with well-behaved nodes. It is noteworthy that the SOM algorithm allows very fast confinement of the attack while not affecting so much to the nodes being impersonated (thick dark stripe) and the attacker neighbors (the thin stripe is thinner). Figure 4 shows the evolution of the percentage of real and false positives and negatives with the three  
Figure 3: Reputation evolution for a sybil attack. algorithms. When the attack is introduced, the number of false negatives increases during a time. This time is the duration of the attack or **isolation time** and, after that period, it is confined. The height of this curve indicates the depth of the attack in the system. The **capacity of confinement** can be measured by the number of false positives at the stationary period, that is zero in every case. If the area under the curve _number of false positives_ is calculated, we can determine the **impact of the attack** because this magnitude takes into account both aspects of the attack: its duration and its depth. Figure 5(a) shows how the impact of the attack changes depending on the redundancy of the sensor nodes. We have simulated the same attack in scenarios in which the number of sensor nodes is decreased. The X-axis represents the number of sensor nodes per each one hundred attacker (\(n\)). The Y-axis indicates the impact (\(I\)), calculated as the sum of the false positives given by the Formula 5. \[I(n)=\sum_{t=0}^{T_{s}}P_{fp_{t}}(n) \tag{5}\]  
where \(T_{s}\) is the simulation time and \(P_{fp_{t}}\) is the percentage of false positives at the instant \(t\). Figure 4: Evolution of the true/false positives/negatives for a sybil attack. Figure 5(b) shows how the system behaves as the redundancy of the sensor network decreases. As we did in the previous simulation, we have used the same attack but decreasing the total number of nodes. The X-axis represents the number of sensor nodes per each one hundred attacker (\(n\)). The Y-axis indicates the value of the **system degradation** (\(D\)), given by the Formula 6. \[D(n)=\frac{N_{att_{Ts}}}{N_{fp_{Ts}}(n)+N_{att_{Ts}}} \tag{6}\]  
where \(N_{att_{Ts}}\) is the number of ill-behaved nodes at the end of the simulation (\(T_{s}\)) and \(N_{fp_{Ts}}\) is the number of well-behaved nodes considered as ill-behaved ones. The system degradation is optimal when its value is 1.