# Identifying Misbehaving Greedy Nodes in IoT Networks
## 5 Simulation and Results  
In order to analyse the behaviour of a greedy node in a WSN network based on IEEE 802.15.4, we consider the following scenario: We simulate a scalable network composed of 5, 10, 15, and 20 nodes sender, and a sink node responsible for collecting network information. We inject in each topology one greedy node.  
We have chosen to execute the attack on the network using a single greedy node, because the use of several malicious nodes will create competition between them for access to the medium since they use the same CSMA/CA parameters. This will lead to a  
Figure 2: Greedy node algorithm identification steps.  
degradation of their performance, while the aim of this study is to analyse the behaviour of the selfish node and its influence on network parameters. This analysis will be used to calculate the thresholds, allowing for distinguishing the normal values from the abnormal ones. In addition, the use of a single greedy node on a scalable network has demonstrated its performance and effectiveness since it has managed to create a significant disturbance in a network made up of a considerable number of legitimate nodes.  
It should be noted that each simulation was repeated two times. Thus, the experimental study is done on 16 distinct simulations. The simulations composed of 5, 10, 15, and 20 will be called in the rest of the article N\({}_{1}\), N\({}_{2}\), N\({}_{3}\), and N\({}_{4}\) respectively. Given that each simulation has been performed twice, N\({}_{1,2}\) represents the second simulation for each i network. We chose to use the Cooja simulator of the Contiki OS [22], to carry out the different simulations, and since it requires fewer resources to run [23], it is therefore the most appropriate for an IoT environment known for its very limited resources. The topology used in each simulated network is peer to peer, and the nodes are randomly positioned on a square grid, their coordinate being picked randomly according to uniform random variables. It should be noted that the surface of the grids vary according to the density of each network.  
The wake-up frequency used in the ContikiMAC primitive is 8 Hz. The duration of each simulation is 30 min (according to the simulator time). The transport protocol used is UDP, and the routing protocol is RPL. The tow files updated to falsify the CSMA/CA parameters are csma.c in the MAC layer, and contikimac.c in the RDC (Radio Duty Cycle) layer of contiki OS.  
We collect network traffic from the sink node to build a database composed of the most relevant network parameters mentioned above. The sink node receives every 60 s a report from each node of the network containing all information and parameters values that concern them such as power, transmit power, transmit duty cycle, CPU power, churn, listen power, etc. The sink node collects this information in a database and updates it each time it receives a report from one of the nodes in the network. Regarding the number of packets sent and received, and the number of collisions for each node, we calculated them with a script that we implemented which receives the contiki OS timeline file as input.  
It should be noted that we did not take into account the values of the sink node neither in the analysis of the results nor in the calculation of the thresholds, since the sink node does not have the same characteristics as sender nodes as it periodically collects network data.