## 5 Data Collection Algorithm  
To develop algorithms for detecting the attacks described in Sections 2 and 4, it is necessary to specify the initial data that need to be collected on network devices. Particularly, here, we need to collect data to form possible features of attacks and data about their source, i.e., the network nodes initiating the attack. Table 5 discloses the types of data that need to be collected to detect attacks described in the attack model. Table 5 shows the relevant types of data for the attacks, where the intruder exploits the properties of self-organization and decentralization. Note that these attacks could be detected with difficulty by attack detection tools used for common WSNs. The considered WSNs are of role-based functioning, including various functions, such as collecting, processing and storing information, to be assigned to various network nodes. Detection of attacks in such a WSN should be performed using a special node with a new detector role, and all developed algorithms for data collection and attack detection should be implemented by this node as well. \begin{table}
\begin{tabular}{c c c c} \hline \hline  
The proposed combined algorithm for data collection in a WSN contains six main steps. The algorithm is presented in Figure 5. The distinctive differences of the algorithm present the specially selected types of needed data, as well as identifying information on their sources. Step 1 involves the initial configuration of data collection parameters. The interval from the data request, the types of data collected and the sources for obtaining them are specified. For example, for data structures,'requests for redistribution of node roles', the network controller node is requested. The correctness of the specified parameters is also checked. Step 2 involves directly requesting data from other network nodes, waiting for a response from them, as well as collecting data (i.e., detector logs). Steps 3 and 4 involve preliminary processing of the obtained data, as well as their unification, that is, bringing data from different sources to a single form. Steps 5 and 6 involve storing data in the detector node's storage and periodically clearing the outdated data, respectively. Figure 5: Combined data collection algorithm for detecting attacks in WSNs. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Data Type** & **Source of Data** & **Unit** & **Attack Examples** \\ \hline WSN message routes & Nodes routing tables & pcs. & Sinkhole, Sybil, wormhole, blackhole \\ \hline Requests to redistribute nodes roles & Network Controller service log & event and them attributes & Sinkhole, Sybil, wormhole, blackhole \\ \hline Nodes sensor readings & All sensor nodes & fact of reading & Malicious code injection \\ \hline Control software checksums & All nodes & value & Malicious code injection, data aggregation distortion \\ \hline Payload size of data packets & Message packets transmitted over the network & bytes & Malicious code injection \\ \hline Node resource consumption (CPU load, memory consumption, remaining energy resources) & All nodes & percent & Denial-of-Sleep, hello-flood \\ \hline Geolocation of nodes & All nodes & GPS coordinates & Jamming, sinkhole \\ \hline Events of adding new nodes to the network & Network Controller service log & event and its attributed & Jamming, sinkhole, Sybil, wormhole, blackhole \\ \hline Wireless signal level & All nodes & dBm & Jamming \\ \hline \end{tabular}
\end{table} 
Table 5: Types of data collected for attack detection. Algorithm 1 presents a pseudocode of the developed data collection algorithm. As input, this algorithm has a list of all WSN nodes with their addresses and a list of required data. The output contains the data stored in the data storage, which should be used for the detection. The required data are requested from other WSN nodes, and then they are checked, preprocessed, and written into the database.