## 6 Results and Analysis  
This section examines the impact of the three software designs on the performance of the selected IDS in terms of:  
* Energy Consumption: This metric is defined as the amount of energy used and spent by the sensor nodes in WSN. The unit measurement is in Joules (j). * Network Lifetime: This metric is defined as the amount of time a WSN would be fully operative. The unit measurement used here is in seconds (s). It is measured through a set of parameters, which include:
* Number of Nodes Alive: This metric is defined as the amount of nodes that are still alive and have the energy to function. * Number of Rounds: Since the measured IDS is based on LEACH protocol, the operation of LEACH is divided into rounds (i.e., rounds are basically time stamps) [23]. Thus, this metric is defined as the amount of rounds that were performed in WSN. * Time of First Node to Die: This metric is defined as the time until the first sensor node runs out of energy in WSN. Packet Delivery Ratio (PD): In general, sensor nodes consume most of their energy in sending and receiving packets (communication cost) [62; 63; 64; 6; 65; 13; 17; 18; 66; 67; 68; 64]. [PERSON] et al. [23] demonstrated that a node needs \(ETx(k,d)\) to send \(k\) bits message to a destination at distance \(d\), as shown in Equation (1):  
\[\mathit{SendingCost}\ (k,\ d)\ =\ \mathit{ETx}\ (k,\ d)\ =\ \mathit{Elec}\, *\,k\ +\ \mathit{Eamp}\,*\,k\ *\,d^{2} \tag{1}\]  
Figure 8: Watchdog design process. where \(E\)_elec_ = 50 nJ/bit, \(E\)_amp_ = 100 pJ/bit/m2. Additionally, a node needs \(ER\)x(_k_) to receive a \(k\) bits message--Equation (2):  
\[receivingCost\ (k)\ =\ ERx\ (k)\ =\ E\)_elec_*_k_ \tag{2}\]  
in case of sending and receiving only one packet. However, to calculate the overall cost, the total number of packets (Sent packets and Received packets) need to be considered. Thus, the total cost is calculated in Equation (3):  
\[Overall\ cost\ =\ \sum\
olimits_{i=1}^{Spkt}ETx(ki,di)+\sum\
olimits_{j=1}^{ Rykt}ERx(kj) \tag{3}\]  
where \(Spkt\) is total number of sent packets and \(R\)_pkt_ is total number of received packets. Therefore, two main factors are affecting the amount of consumed energy--the number of packets and the size of the packet itself (in bits) as will be illustrated in the results below. The different designs of the IDS were developed and tested using the NS2.34 simulation tool [64]. For the purpose of removing the effect of randomness caused by the simulation environment, each experiment was repeated many times and then the results were averaged. Moreover, this takes us to another problem, which is the lack of systematic tools used by engineers to check if the requirements are achieved [33]. In addition, there are no available standard IDS test suites [59], so engineers need to generate both malicious activities and benign activities to test their IDSs. The simulation parameters that were used in the testing process are summarized in Table 6. In addition, Table 7 lists the notations used in the following equations and their meanings. This research has studied the effect of black hole attacks before being detected and excluded from the network. Two scenarios were performed on the original LEACH, the first one is the normal case \begin{table}
\begin{tabular}{c c} \hline \hline
**Parameter** & **Value** \\ \hline Network surface & 1000 m\({}^{2}\) \\ BS location & (50,181) \\ Number of nodes & 100 nodes \\ Number of clusters & 5 \\ Size of data packet & 500 bytes \\ Size of packet header & 25 bytes \\ Routing protocol & LEACH \\ MAC protocol & CSMA/TDMA [Carrier Sense Multiple Access/Time Division \\  & Multiple Access] \\ Simulation time (in seconds) & 3600 \\ Initial energy (in joule) & 2 \\ Attackers’ intensities & 30\% \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Simulation parameters.