## 6 Experimental Evaluation of SRF-IoT Framework
### Evaluation Results
Figure 5: Comparing median packet delivery ratio (PDR) per scenario after deploying 5 to 15 SRF-IDS detectors. Figure 6: Median parent switch results in SRF-IoT scenario after deploying 5 to 15 SRF-IDS detectors. The Median Packets Dropped obtained after deploying 5 to 15 detectors in SRF-IoT and BHR scenarios are displayed on Figure 8. Looking at the BHR scenario, the median percentage of packets dropped is initially 38.6% when 5 SRF-IDS detectors are deployed. The percentage fluctuates around 40% until the scenario with 12 SRF-IDS detectors, in which the percentage declines to 35%. This is related to the previous parent switch metric because in scenarios with higher packets dropped, more parent changes occur. Regarding the SRF-IoT scenario, it has an increasing trend of dropping packets as the number of SRF-IDS detectors becomes larger. A median of 14.2% of the packets are dropped when five SRF-IDS detectors are deployed, falling to 8.2% with seven detectors and then rising to 16.5% with eight detectors. The median value then remains at the same level apart from the scenarios with 12 and 15 SRF-IDS detectors in which the median dropped packets climb up to 20.2% and 25%, respectively. Therefore, our framework may assist the network to avoid blackhole attackers and reduce dropped packets. Figure 8: Median packets dropped per scenario after deploying 5 to 15 SRF-IDS detectors. Figure 7: Comparing median parent switches per scenario after deploying 5 to 15 SRF-IDS detectors. As a last metric, the Median SRF-IDS Packet Overhead is illustrated in Figure 9. In all scenarios, SRF-IDS generates less than 2.5% traffic overhead in the network. The only case where the SRF-IDS packet overhead is relatively high is in the scenario with 15 SRF-IDS detectors. The median value reaches 2.2% because the monitored nodes are trying to avoid attackers. We have the highest median parent switches in this scenario--the number of dropped packets is also increasing, and thus, SRF-IDS detectors attempt to help monitored nodes by sending them trust metrics. All the previous metrics indicate that the monitored network is greatly affected by attackers in that specific scenario. Generally, the number of packets sent from SRF-IDS detectors depends on the number of monitored nodes. For example, SRF-IDS detectors that are deployed near multiple nodes of the monitored network send more packets in order to update nodes with trust metrics. In our case, SRF-IDS nodes are randomly deployed in the simulated scenarios. As depicted in the column chart, SRF-IDS helps monitored nodes avoid attackers with very low packet overhead. A relatively high packet overhead percentage is depicted in the scenario with nine SRF-IDS detectors. The reason for the high median percentage in the scenario with nine detectors in comparison with other scenarios such as 13 or 14 SRF-IDS detectors is that in the specific case, the SRF-IDS detectors detect malicious attackers in the network and try to help monitored nodes by sending them many packets to alert neighbouring nodes. Some of these packets are lost and others are received by benign nodes. As a result, nodes receiving those alerts try to change parents, and, thus, the median parent switch metric shown in Figure 6 is also high in this scenario. In conclusion, the experimental evaluation of the SRF-IoT framework against rank and blackhole attackers showed higher PDR, lower packets dropped, as well as lower parent switches in comparison to the malicious scenarios where SRF-IoT had TM disabled. Results indicate that the proposed framework can aid nodes to choose the proper nodes as parents and avoid the compromised ones. According to the evaluation results, deploying seven SRF-IDS detectors in a network with at least 36 nodes generates the best results, assuming that one-sixth of them might be compromised. Moreover, results depicted that deploying 5 to 10 SRF-IDS detectors still helps the IoT network to isolate and avoid attackers.