## 2 Literature Review  
WSN security has drawn the attention of many researchers [7; 8; 9]. Some research studies have focused on building trust and reputation in WSNs at different contexts and using different measures [26; 27; 28]. However, in the past few years, it has been witnessed [9; 12; 25; 29; 30] that IDSs have been developed and are very well investigated by researchers. However, those developed IDSs are not efficient enough to detect all malicious behaviors in a WSN. One of the main reasons is due to not deploying the SE processes. Equally important, researchers and software engineers need to consider energy consumption when developing IDSs to defend attacks. One of the first energy efficient protocols for WSN is Low-Energy Adaptive Clustering Hierarchy (LEACH) protocol [23]. LEACH is defined as \"a self-organizing, adaptive clustering protocol that uses randomization to distribute the energy load evenly among the sensors in the network\" [24]. The LEACH's routing process is as follows:  
* The network is divided into a collection of clusters. Each cluster is managed by its cluster head (CH);
* Each CH has its own nodes, called Cluster Nodes (CN);
* The CH node sets up a time division multiple access (TDMA) schedule and transmits this schedule to all CNs;
* Then, the CNs transmit their data messages to their corresponding CHs;
* Afterwards, the CHs aggregate and compress the data and forward it to the base station (BS). This is because energy consumption of WSN can be reduced by allowing only CHs to communicate with the base station (BS). Figure 1 illustrates how the topology is built in LEACH protocol. LEACH protocol was developed to increase the lifetime of WSNs; however, security was not considered [23]. Therefore, researchers have extended the LEACH protocol, with the attempt of securing its routing services [23; 27]. Furthermore, not all extended LEACH protocols used in packet dropping detection systems are secured enough or energy efficient. Some extended protocols have compromised the network energy because of their IDS mechanism--for example, the proposed IDS in [15] has introduced security to LEACH protocol through cryptographic algorithms. However, this approach has compromised the energy, since those types of algorithms require a lot of processing. To elaborate more on the IDS studies proposed by researchers, a sample of existing IDSs are explored and reviewed in this literature. In [21], the authors have proposed a hierarchical energy efficient IDS for black hole attacks. The proposed detection schema has introduced a new layer to LEACH protocol called the second cluster head (SCH) layer. The selected SCH node keeps track of what has been received by the CH. The control packets contain the node identifier and the number of packets received by the CH. Then, the control packets are exchanged between SCH and BS, in order for the BS to compare the number of packets received from the CH and SCH. Some IDSs do not only detect attacks, but they also remove them from the network to prevent the attack from happening again [31; 32]. Furthermore, some researchers took different approaches when exploring and developing IDSs by considering the energy efficiency and simplicity. Energy efficiency, in IDSs, is as important as security because one of the main challenges of WSNs is the network's lifetime [33] or, otherwise, the network would be useless. As mentioned earlier, LEACH protocol was developed to increase the lifetime of WSNs; however, security was not taken into account [34; 35; 36]. Therefore, the need for security in LEACH protocol has inspired many researchers to extend the LEACH protocol with the attempt of adding security features, to secure the routing process [34; 35] and have it be resilient against insider and outsider attackers [36]. To elaborate more on the extended protocols used as IDSs, some studies are discussed below:  
* In [15], S-LEACH was developed, and it was the first protocol that added security to LEACH.