# A Cross-Layer, Anomaly-Based IDS for WSN and MANET
## 6 Results and Discussion  
Extensive simulations for different scenarios having different power levels and node velocities were conducted. The scenarios presented here are representative of the performance for the maximum and minimum cases both in power and velocity. The results of the AMoF and detection threshold for scenario NS1P7 with _Tr_ = 50 s and _Ts_ = 5 s are shown in Figure 6. The results of the AMoF and detection threshold for scenario NS1P7 with _Tr_ = 100 s and _Ts_ = 10 s are shown in Figure 7. Both cases exhibit good detection behavior in which the threshold permits discrimination between normal and malicious nodes starting from the sixth iteration which corresponds to 300 s of simulation time for the first case. The detection threshold criterion, which represents the difference between consecutive fitted slopes, is chosen after a certain number of iterations that achieve small fluctuation in the consecutive fitted slopes, showing stable behavior; \(|\Delta|=10^{-3}\) was picked for this purpose.  
Similarly, in the second case, the detection threshold gives good results at the fifth iteration, which corresponds to 500 s of simulation. The abbreviations in part b in each set of Figures refer to the fitted slope (FS), upper bound (UB), and lower bound (LB) intervals for each NUT.  
Figure 6: The AMoF for different nodes and the fitted slope for those nodes for scenario NS1P7 (_Tr_ = 50 s, _Ts_ = 5 s): (**a**) The AMoF for different TNs; (**b**) The fitted slope, and its confidence for different NUTs.  
Figure 7: The AMoF for different nodes and the fitted slope for those nodes for scenario NS1P7 (_Tr_ = 100 s, _Ts_ = 10 s): (**a**) The AMoF for different NUTs; (**b**) The fitted slope, and its confidence for different NUTs.  
The last scenario shown is NS15P3 with \(Tr=100\) s and \(Ts=5\) s in Figure 8. The performance in this case shows a major decline, as the detection threshold lies very close to the margins of normal and malicious nodes, making the detection process very difficult. The ability of the dedicated sniffers to capture firsthand packets related to the TNs is highly affected by having those nodes within their sense range. This is reflected on building detection models that generates low variability in the CCI leading to tight detection margins as shown in Figure 8b. According to [18], the nodes with low velocity and high power would have higher connectivity. Analytical simulation results for the probability of detection vs. sensing range of nodes in a wireless sensor network was presented in [19] and shows a higher detection probability as the sensing range increases. This will impact the amount of data collected by the dedicated sniffers; the higher the connectivity, the more packets collected. This helps to build more accurate models that will then allow the generation of more accurate decisions.  
It is important to mention that the detection performance for the whole IDS is determined at the supernode level. The detection rate reaches 100% once the detection criterion is achieved. This would require more time to reach in some challenging scenarios, as shown in Figure 8 where the connectivity of the nodes is at its lowest.