## 5 Simulation Results and Analysis
### The Performance under Different MinPts and Eps  
First, we compare the effects of MinPts on TPR, FPR, and AUC when there were 5% or 20% of the malicious nodes in the network. The value of MinPts should ensure that the sample points generated by malicious nodes will not become core points or boundary points; that is, the value of MinPts should not be less than the total number of samples generated by malicious nodes in a data set. As shown in Figure 8a, this paper sets that the node can be judged as a malicious node when three malicious samples appear consecutively or at intervals. When two malicious nodes appear simultaneously in a candidate node set, the number of malicious samples in a detection window is at least six. Therefore, when MinPts = 4, or 5, malicious samples will become core points or boundary points, resulting in a low detection rate. However, as shown in Figure 8b, the larger the MinPts, the fewer normal samples become core points, and the more samples become boundary points and outliers, thus increasing the recognition rate (TPR) of malicious nodes. However, the probability of misjudging normal nodes as malicious nodes (FPR) will also increase correspondingly; that is, AUC will decrease with the increase in MinPts. \begin{table}
\begin{tabular}{c c} \hline \hline
**Name** & **Value** \\ \hline The size of UWSNs & \(5500\times 5500\times 5500\) [ m\({}^{3}\)] \\ \hline The number of sensor nodes & 100 [\#] \\ \hline Communication range & 2000 [m] \\ \hline Node placement Randomly deployed Acoustic & 20 [Kbps] \\ channel bandwidth & \\ \hline The length of detection sliding window & 6 [\#] \\ \hline The length of decision sliding window & 6 [\#] \\ \hline The length of packet & 1024 [bit] \\ \hline Data transfer rate & 6 [Kbps] \\ \hline Transmit mode power consumption & 2 [w] \\ \hline Receive mode power consumption & 0.75 [w] \\ \hline Time to live & 15 [hops] \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Simulation parameters. Figure 7: Network structure. Then, different Eps also affect TPR, FPR, and AUC. As shown in Figure 9a, the larger the Eps, the more samples that can become core points, and the higher the probability of malicious nodes becoming boundary points. Therefore, the identification rate (TPR) of malicious samples is reduced, while the probability of legitimate nodes being misjudged as malicious nodes is correspondingly reduced. In addition, it can be seen from Figures 8 and 9 that the detection method proposed in this paper has a better detection effect with a small number of malicious nodes in the network. The main reason is that IDS is based on outliers in the DBSCAN clustering algorithm. The pseudo-code of the DBSCAN algorithm is shown in Algorithm 1. Outliers are characterized as such when they are far away from most other sample points in the data set and the number of samples close to them is small. However, with the increase in malicious nodes in the network, the number of malicious nodes in the candidate nodes of each node increases, resulting in the multiple growth of the number of malicious samples. Figure 8: (**a**) The effects of MinPts on TPR; (**b**) The effects of MinPts on FPR; (**c**) The effects of MinPts on AUC. Figure 9: (**a**) The effects of Eps on TPR and FPR; (**b**) The effects of Eps on AUC. Therefore, the chances of malicious samples becoming core and boundary points increase, which ultimately leads to the greatly reduced recognition rate of IDS for malicious nodes.