# A Secure Protocol against Selfish and Pollution Attacker Misbehavior in Clustered WSNs
## 4 Design and Implementation
### Attack Detection and Punishment  
Our solution then has an attack detection and punishment phase, which locates the misbehavior that affects the network availability or integrity. It identifies the \(M\)Ns among the \(CH\)s executing the \(DoS\) or pollution attacks and applies a punishment mechanism to exclude them from the routing process. The \(BS\) is aware of all the nodes' locations and the different groups of clusters in the network. In addition, the \(BS\) has a control counter (\(cc\)) for each \(CH\), which decides on its maliciousness.  
At the end of each routing round, the \(BS\) is supposed to receive the set of packets \(L_{i}=\{(Id_{i},\,m_{i,j},\,p_{i})\}\) where \(j\in\{1,2,\ldots,p\}\) through \(p\) different paths coming from the nodes \(CH_{q_{j}}\), \(q_{j}\) are the \(p\)\(CH\) identities saved in the routing table for each source node \(N_{i}\). The \(BS\)'s decision depends on the source nodes and the packets received for each one. It begins by scanning the malicious \(CH\)s invoking a \(DoS\) attack then continues by scanning the malicious \(CH\)s effecting a pollution attack. Once it has collected the list of packets received for a source node \(N_{i}\), the \(BS\) compares it to the list \(L_{i}\).  
First, for \(DoS\) attack detection, it notes the set of packets missing and identifies the \(CH\) identities \(\{q_{j}\}_{j\in\{1,\ldots,p\}}\) in charge of transmitting them. Then, it increments their counter \(cc\) by 1, as they are suspected of being malicious nodes.  
Second, for pollution attack detection and after collecting the list of packets received for a source node \(N_{i}\), the \(BS\) proceeds via two steps:  
1. Since it has already saved the true value \(p_{i}^{\top}\) in its memory when calculating the original routed message, the \(BS\) checks for received packets containing a \(p_{i}\) value different from the \(p_{i}^{\top}\) value. It recognizes the \(CH\)s that have sent these packets as potentially malicious nodes and increments their counter \(cc\) by 1.  
It checks the \(C_{rp-pp}^{t}\) combinations of packets that generated the original message and notes the list of \(CH\) identities that have transmitted these packets. Then, it classifies the \(CH\)s with identities not belonging to this list as potentially being malicious and increments their \(cc\) by \(1\). The reason is that one polluted packet in a combination of \(t\) packets will generate a fake calculated message.  
Lastly, if the \(cc\) of a specific \(CH\) node \(Id_{q_{S}}\) reaches the value \(r\), where \(r\) is a threshold chosen by the user before deploying the network, the \(BS\) recognizes this \(CH\) as a selfish node. In other words, if the node with identity \(Id_{q_{S}}\) has effected a number of attacks, whether by refusing to send a data packet or by faking it, equal to \(r\), the \(BS\) proceeds as follows:  
* It excludes the node with identity \(Id_{q_{S}}\) from the network and bans it from the routing process by deleting it from the network nodes list.
* It invokes a network re-clustering using the updated list of existing nodes.
* It resets the paths used for each source node by choosing new \(p\)\(CH\) identities for each one.  
In this way, the protocol increases the security level of the network, not only by preventing \(Do5\) and pollution attacks, but also by conducting active steps to localize their source and punish the \(M\)Ns responsible.