## 4 Research Methodology
### Description of the Benchmark Algorithm (BRDFS)
#### 4.3.3 Malicious Node Detection System of BRDFS  
This skewness detector is proposed in [37]. The idea is, if a sensor is involved in a collusion attack, the distribution of forecasting residuals of the measurements from the sensor (that usually tend to be normal) should be skewed to the left or right.  
The training phase of the skewness detector includes the following steps. Step 1: Fit a forecasting model to the time series of the sensor's readings. Step 2: Find the residuals of the forecasting model. Step 3: Estimate the rolling skewness coefficients of the residual series using the rolling window of \(N\) time steps. We set \(N\) to 30. This gives a series of skewness coefficients. Step 4: Estimate the unconditional mean \((m)\) and standard deviation \((s)\) of the skewness series. Then compute the acceptable range \((-\delta=m-3s,\text{\emph{and}}+\delta=m+3s)\) for the skewness of the forecasting error distribution.  
During the stealthy attack distribution, the following steps are followed. Step 1: Take the new sequence \((r_{0})\) of forecasting residuals over the last \(N\) time steps. Step 2: Generate a sequence \((r_{rand})\) of normal random number with \(\mu\) and \(\sigma^{2}\) estimated in the training phase. The length of \(r_{rand}\) is \(0.05N\). Step 3: Replace a small proportion of entries in \(r_{0}\) with \(r_{rand}\) and generate a new sequence \(r_{test}\) for testing. Step 4: Compute the skewness coefficient \((SC)\) of \(r_{test}\). If \(SC\) falls outside the acceptable range \((-\delta,\mu+\delta)\), raise the alarm that the sensor is participating in the collusion attack.  
Correlation Detector 'CAD'  
The correlation detector, called CAD, is proposed in [38] to detect compromised nodes. CAD includes two sub-schemes: temporal collusion detection scheme and spatial collusion detection scheme. If both sub-schemes find a node anomalous, the node is regarded as compromised.  
Temporal collusion detection sub-scheme performs the following steps to detect the anomalous nodes. Step 1: Estimate the correlation between each node's measurements at time step \(t\) and at time step \(t+1\). Step 2: Estimate a predefined confidence interval for temporal correlations based on the bootstrap distribution. If at a given time window, the temporal correlation falls outside the confidence interval, the node is considered a malicious node.  
The spatial collusion detection sub-scheme performs the following steps. Step 1: Compute the Pearson's correlation coefficient between the measurements of each pair of sensors over time window \(t\) (a time window consists of multiple time steps). This gives a correlation matrix which is called the correlation map. Each vector of the matrix contains the pairwise correlation coefficients between the measurements of one particular sensor \((i)\) and that of every other sensor over time window \(t\)--this vector is the location of sensor \(i\) in the location map at time window \(t\). Step 2: Estimate the global centroid which is the vector in the matrix that has the smallest distance from all vectors in the matrix. Step 3: Perform \(k\)-means clustering to partition the vectors into \(k\) clusters. Step 4: If a vector's distance from the global centroid is greater than 0.5, and if the vector's distance from the centroid of its closest cluster is greater than 0.3, the sensor represented by the vector is classified as compromised.