# Method for Detecting Abnormal Activity in a Group of Mobile Robots
## 4 Method for Identifying Anomalies
Evaluation of theratio for the sent, received, and dropped packets:  
\[Ratio_{sent}=\frac{(\sum s_{total}(\Delta t))}{L_{Total}}*100\%, \tag{7}\]  
\[Ratio_{received}=\frac{(\sum r_{total}(\Delta t))}{L_{Total}}*100\%, \tag{8}\]  
\[Ratio_{dropal}=\frac{(\sum d_{total}(\Delta t))}{L_{Total}}*100\%, \tag{9}\]  
where \(Ratio_{sent}\) is the percentage of sent packets in the total traffic, \(Ratio_{received}\) is the percentage of dropped packets in the total traffic, \(Ratio_{dropal}\) is the total number of sent packets for the current time interval, \(r_{total}\) is the total number of received packets for the current time interval, and \(d_{total}\) is the total number of dropped packets for the current time interval. 7. The monitoring of energy consumption was carried out using a KEWEISI KWS-V21 tester on a housing chip with an operating voltage of 3-20 V and a working current of 0-3.3 A. This tester was equipped with a bright screen and had the ability to display the following characteristics: voltage (U), current energy consumption (W), consumed battery capacity (mAh), and time (by a timer). 8. Oversupply of dropped packets (ODP). Under normal network operation, hosts can drop packets as a result of collisions and packet queue overflow. Thus, in normal network operation, when an intruder does not conduct an attack, the allowed number of dropped packets is 1%. For initial verification of this metric, it was necessary to determine whether the number of dropped packets increased in comparison with the normal network operation for the current time interval:  
\[ODP_{i}=d_{i}/d_{norm_{i}}. \tag{10}\]  
If dropped packets exceeding the level were seen more than three times, the presence of abnormal activity in the network was considered. Dropped packets can occur not only during a black hole attack but also during a denial of service attack, since the nodes do not have time to process the packets and discard them from the queue. 9. Oversupply of forwarded packets (OFP). An intruder, performing some attacks, creates fake nodes or simulates the presence of a large number of malicious nodes in the network. For example, the main purpose of the Sibyl attack is to redirect the attacker's influence on himself. It creates conditions such that packets should be routed through the fake nodes. Thus, there is a tendency to increase the number of routing packets. To determine the presence of anomalous activity during the attack, it is advisable to track the growth of forwarding packets. This can be done in two ways. Firstly, the level of forwarding of packets over the current time interval over the number of forwarding packets recorded during normal network operation is estimated:  
\[OFP_{i}=(\sum_{N}f_{i,nadv_{i}};f_{i,nadv_{i}})/(\sum_{N}f_{i,norm,adv_{i}};f _{i,norm,adv_{i}}), \tag{11}\]  
where \(OFP_{i}\) is the ratio between the number of forwarding packets at the current time for the node to the total number of forwarding packets per time interval for normal network operation. Also, detection of abnormal activity can be measured by the percentage of the number of packets routed as a function of the total number of network packets:  
\[Ratio_{s,r}=s_{i,n,data}/r_{i,n,data}, \tag{3}\]0