# Method for Detecting Abnormal Activity in a Group of Mobile Robots
## 5 Experimental Results
### Implementation and Analysis of the Impact of Attacks  
#### 5.2.1 Denial of Service Attack  
The SYN flood (SYN - Synchronize sequence numbers) attack was chosen as an internal denial of service attack for the experimental study. This choice was due to the popularity of this attack in computer networks according to Kaspersky Lab [30]. The result of this attack was obviously a noticeable increase in resource consumption by the device that was attacked. During the attack, there was no availability of the communication channel. Three attack scenarios were developed. The first scenario was that one intruder node actively attacked one trusted node such that there was one victim in the network. In the second scenario, an intruder attacked 25% of the trusted nodes. In the third scenario, 50% of the nodes were victims. Since, out of the 10 nodes, one was an internal attacker and one node was a central server, the principle of the attack was that the attacker sent SYN requests and overflowed the connection queue for the victim of the attack. Half-open connections appeared in the queue, waiting for confirmation from the client. Figure 3 shows the change in the variance of the network load for nodes \(D_{Lg}\) by Equation (2). It can be seen from the figure that the variance increased significantly upon increasing the number of victims. This means that the load of nodes was quite different from the average. This is because the load level of the malicious node was significantly greater than the node for the load of trusted hosts. The load level of the victim nodes also increased in comparison with the normal state. During normal network operation, when nodes sent packets according to a given algorithm and operated in the normal mode, the dispersion level could reach 7-10. Thus, it can be said that there was abnormal activity in the network. Three types of situations were simulated. In the first case, the estimation of the energy consumption by network nodes in the absence of an attack was carried out. In Figure 4, this situation is represented by a blue chart marked with rhombuses. In the second case, the network was attacked, while the traffic of the malicious node was \(\rm{I_{t}}\leq I_{m}\leq 2I_{t}\), where \(\rm{I_{m}}\) is the malicious node traffic, and \(\rm{I_{t}}\) is the traffic of the authentic node. The third graph represents a situation where an attack was carried out intensively and \(\rm{I_{m}>2I_{t}}\)[31]. Figure 4 shows that, during the low-intensity attack, the energy level of the nodes remained almost the same as for the case when the attack was not carried out. That is, in this case, the attack could be considered ineffective. The graph reflects the change in the energy level during intense attacks where a sharp drop in energy level was seen, which confirmed the effectiveness of the attack. At the same time, the load of the attacker's node was more than twice the workload of trusted nodes. The effectiveness of this attack could also be assessed by the presence of discarded packets. Malicious nodes create such a situation in the network when trusted hosts cannot take a large number of requests and discard packets from the queue. Together with packages from malicious nodes, the victims also discard useful packages. Figure 5 shows that a more intense attack with more intruders on the network resulted in an increase in the percentage of dropped packets. Thus, the sender does not re-send the necessary information, and the recipient does not know that the information was transferred to him [32]. Figure 4: Changes in the residual energy level depending on the traffic load of network nodes. Figure 3: The variance of the load parameter \(D_{l,g}\) for nodes under denial of service (DoS) attack with various numbers of victims. The presence and effectiveness of a denial of service attack are fairly accurate and can be effectively determined using the ratio of sent to receive packets. Figure 6 shows that the nodes under attack took more packets than they sent, with a difference of more than 2-2.5 times.