## 3 Proposed Scheme: MC-TIRP
### Trust Evaluation Component
#### 3.2.1 Local Trust Evaluation  
Trust evaluation is derived by learning based on the results of the discovery component. The sensor nodes monitor the behavior of neighboring nodes and apply a formula that considers the packet forwarding ratio (_PFR_), expected transmission time (_ETT_), and energy. \[ \begin{split} PFR_{i,\ j}=\frac{F_{i,\ j}\ (t)}{S_{i,\ j}\ (t)} \end{split}  \tag{1}\]  
_PFR_ is derived by observing the packet-forwarding behavior of neighboring nodes using the promiscuous mode, as shown in Equation (1). \(S_{i,\ j}\ (t)\) is the number of packets sent by node \(i\) to node \(j\), and \(F_{i,\ j}\ (t)\) is the number forwarded by node \(j\). This method can detect nodes maliciously dropping packets through _PFR_ calculation and simply obtain the reliability of the link. However, a simple method of calculating _PFR_ is difficult to detect advanced attacks such as on-off that are performed according to a specific time. We utilize a flexible blacklist threshold and Q-learning to address this. A blacklist threshold value (\(\gamma\)) is defined and is used to identify malicious nodes (\(0\leq\gamma\leq 0.75\)). The blacklist threshold considers the mission-critical tactical network of nodes and is measured as shown in Equation (2). \[ \begin{split} Blacklist\ threshold(\gamma)=\frac{Link\ bandwidth}{Current\ bandwidth}\end{split}  \tag{2}\]  
_Link bandwidth_ is the maximum rate of data transfer across a given link. The current bandwidth is an estimate of the _Current bandwidth_ of the network interface in bits per second (bps). The reason for the above calculation is to determine whether an attack by a malicious node is occurring or the communication status is bad. Low _Current bandwidth_ usage increases the blacklist threshold to detect malicious nodes with low drop attacks. High _Current bandwidth_ usage makes it difficult to determine whether an attack from a malicious node or a bottleneck is causing network performance degradation. The blacklist threshold is reduced to help in the discreet resolution of malicious node exclusions [14]. Trust evaluation is classified into types: direct, indirect, and witness trust [13]. Direct trust is derived by evaluators by observing the behavior of their direct neighbor nodes. Indirect trust is the recommended value calculated for the target node obtained from the evaluator's indirect node. When it is difficult to perform an accurate trust evaluation using only direct trust, it is possible to perform a more accurate trust evaluation from calculations based on recommendations received from indirect nodes. The indirect trust value for calculating the total trust value is forwarded from the direct node to the source node. A witness trust is a value by which a proven direct node evaluates an indirect node and recommends the value to the source node. The difference between indirect and witness trusts is that the indirect trust is calculated and recommended by indirect nodes, whereas the witness trust is done by certified direct nodes. We consider not only direct trust but also indirect witness trust for a more accurate and effective trust evaluation. The QoS factor of links is measured using _ETT_, as shown in Equation (3). \[ETT=ETX\times\frac{X}{B} \tag{3}\]  
_ETT_ improves _ETX_ (Expected Transmission Count) by considering the differences in link transmission rates. _ETT_ is an appropriate QoS factor to satisfy the delay requirements of mission-critical data. \(X\) denotes the size of the packet (for example, 1024 bytes), and \(B\) denotes the bandwidth (raw data rate) of the link [15]. _ETT_ does not include the back-off time spent waiting for the wireless channel [16]. In MC-WSN, if the devices cannot operate due to an energy discharge, it can have a fatal impact on operations. Therefore, it is essential to calculate the reliability evaluation considering energy. Resource-constrained devices that operate in a WSN environment require recharging or exchange when their energy is depleted.