# Method for Detecting Abnormal Activity in a Group of Mobile Robots
## 4 Method for Identifying Anomalies  
The methodology involved the steps described below. 1. Calculation of the total amount of network packets that went through the node:  
\[ \begin{array}{l}L_{Total}=\sum\limits_{N}s_{data}(\Delta t)+\sum\limits_{N}s _{routing}(\Delta t)+\sum\limits_{N}r_{data}(\Delta t)+\sum\limits_{N}r_{routing}(\Delta t)+\\ +\sum\limits_{N}d_{data}(\Delta t)+\sum\limits_{N}d_{routing}(\Delta t)+\sum \limits_{N}f_{data}(\Delta t)+\sum\limits_{N}f_{routing}(\Delta t)\end{array} \, \tag{1}\]  
where \(s_{data}\) is the total number of segments sent at the transport level, \(s_{routing}\) is the total number of packets sent by routing protocol, r\({}_{data}\) is the total number of segments received at the transport level, r\({}_{routing}\) is the total number of received routing packets, d\({}_{data}\) is the total number of discarded segments transmitted at the transport layer, d\({}_{routing}\) is the total number of discarded routing packets, f\({}_{data}\) is the total number of forwarding segments at the transport level, f\({}_{routing}\) is the total number of forwarding routing packets, and \(N\) is the total number of nodes in the network. It was necessary to evaluate the growth of this metric. If there is a rapid growth of the number of packets in the network, it is likely to be attacked. 2. The second step was to estimate the degree of variance of the network load parameter in past intervals relative to the average value. For this, it was necessary to calculate the general variance for the node network load value at the current interval for each node of the network:  
\[D_{Lg}=\left(\sum\limits_{i=1}^{N}\left(L_{i}-\overline{L}_{g}\right)^{2} \right)/N, \tag{2}\]where \(D_{lg}\) is the general variance of the network load parameter, \(\overline{L_{g}}\) is the general average for the network load factor, \(\mathrm{L_{i}}\) is the load level of the current node, and \(N\) is the total number of nodes in the network. If the growth of a network metric values is observed, it can be concluded that an anomaly is present on the network. 3. Calculation of the ratio of sent to received packets:  
\[Ratio_{s,r}=s_{i,n,data}/r_{i,n,data}, \tag{3}\]  
where \(Ratio_{s,r}\) is the ratio between received and sent packets. In normal network operation, the number of received data packets should approximately coincide with the number of sent packets, and there may be slight deviations. Therefore, if the ratio of sent and received packets is measured, then anomalous behavior of the node can be detected. If a node becomes a victim of a denial of service attack, then it receives more packets than it sends, or than other nodes receive. 4. Calculation of the deviation from the overall average for each network node:  
\[Dev_{N,i,s}(\Delta t)=(s_{n,i}(\Delta t)-\overline{s_{i}}(\Delta t))/N, \tag{4}\]  
\[Dev_{N,i,r}(\Delta t)=(r_{n,i}(\Delta t)-\overline{r_{i}}(\Delta t))/N, \tag{5}\]  
where \(Dev_{N,i,s}\), \(Dev_{N,i,r}\) are the deviations from the overall average parameter for the number of sent and received packets calculated for each node for the current time interval, and \(\overline{s_{i}}(\Delta t)\), \(\overline{r_{i}}(\Delta t)\) are the mean values for the number of packets received and sent for the current time interval for all nodes. Analysis of this parameter does not give an unambiguous answer for which node is implementing the attack. However, it can serve as a good tool for determining the degree of anomalous activity of malicious nodes. 5. Calculation of the ratio of dropped packets in the current time interval from normal network operation:  
\[Ratio_{i,d}(\Delta t)=d_{i}(\Delta t)/d_{norm_{i}}(\Delta t). \tag{6}\]  
6.