# Identifying Misbehaving Greedy Nodes in IoT Networks
## 5 Simulation and Results
### Greedy Node Identification Results  
Finally, the last step consists of testing the proposed detection method on 16 different simulations. For each simulation, the parameter of each node is compared with its threshold. A node is identified as greedy if its eight parameters are outside the set thresholds. If only one of these parameters is within the so-called normal values, the node in question will be considered as legitimate. The proposed greedy node detection algorithm receives as input the database of all nodes in the network with their parameters as indicated in Table 2. It will then calculate the eight thresholds appropriate for each parameter. In order to detect greedy nodes in the network, the algorithm proceeds by elimination. It starts with the first parameter, namely the number of packets sent. It will compare the number of packets sent from each node of the network with the threshold Th\({}_{1}\), it will therefore browse the database table starting with the first node, until the last. If the number of packets sent from a given node is less than the threshold Th\({}_{1}\), the node is considered legitimate. Otherwise, it tests its second parameter, and so on. If a given node satisfies all conditions, i.e., its eight parameters are considered abnormal, the node in question is determined to be greedy. It is enough that a single parameter is normal; the node will be determined as legitimate. The proposed method was applied on 200 legitimate nodes and 8 greedy nodes. The results of these tests are presented in Figure 7 which demonstrates the detection efficiency based on the following four metrics:  
1. Effective Detection Rate (EDR): It is the ratio between the number of nodes detected greedy by the proposed method and the total number of greedy nodes. 2. False Positive Alarm Rate (FPAR): It is the ratio between the total number of legitimate nodes in the 16 simulations and the number of legitimate nodes detected greedy by the proposed method. 3. False Negative Alarm Rate (FNAR): It is the ratio between the total number of green-dynodes in the eight simulations and the number of greedy nodes identified as legitimate nodes. 4. Efficiency (Eff) represents the efficiency of the detection algorithm and which is calculated as follows:  
\[\text{Eff = EDR - (FPAR + FNAR)} \tag{11}\]  
The simulation results demonstrated an efficiency of 99.5%. The effective detection rate is 100% since the proposed method has allowed the identification of all greedy nodes in the eight compromised networks. Therefore, there was no false negative alarm. On the other hand, there was only one false positive alarm in network N\({}_{3}\). Thus, 1 in 200 legitimate nodes has been detected as being greedy. Figure 7: Greedy node identification results. In order to ensure the efficiency of our algorithm, we simulated two new networks by increasing the number of legitimate nodes, and reducing the simulation time to 10 min. The goal is to check if the algorithm detects the greedy nodes in topologies which have not been taken into account in the calculation of the thresholds. For that we simulated two networks N\({}_{5}\) and N\({}_{6}\) composed respectively of 25 and 30 legitimate nodes, and a single greedy node. In both simulations, greedy nodes were detected, and no false alarms were recorded. Table 5 represents the database of the N\({}_{6}\) network.