# A Cross-Layer, Anomaly-Based IDS for WSN and MANET
## 4 System Architecture  
The system shown in Figure 5 consists of \(n\) dedicated sniffers, \(S_{i}\), \(i=1\),..., \(n\). The packet traces are collected from the MAC and network layers related to the NUTs. The packets collected from the MAC layer are received and transmitted: request to send (RTS), clear to send (CTS), and acknowledgment (ACK). The packets collected from the network layers are received and transmitted: RREQ, RREP, and RERR. Both layers' features are shown in Table 5.  
The variability in the consecutive CCIs is a key feature used to distinguish between normal and malicious nodes, where normal nodes have higher variability in consecutive CCIs. This idea is based on the smaller size population (which represents the number of malicious nodes in the network) vis-a-vis the larger-size population (which represents the number of normal nodes in the network). The first stage of detection is conducted at the sniffer level, where each sniffer is a classifier and performs a local classification using a C4.5 decision tree or random forest. The outcome of this process is a CCI every \(Tr\) seconds, which is sent to the supernode for further processing. The simulation time is \(N\times Tr\), where the supernode performs the second stage of detection by applying an iterative slope (\(\beta\)) and threshold (\(\delta\)) calculation based on linear regression for each NUT as shown in Algorithms 1 and 2. Figure 4: Data fitting for the CCIs of sensor 5: (**a**) Data fitting for three distributions, EV, Gamma, and Nakagami in scenario NS5P7 for NUT 13; (**b**) Data fitting for three distributions, EV, Gamma, and Nakagami in scenario NS5P7 for NUT 19. Figure 5: A two stage cross layer IDS. The AMoF is calculated in Algorithm 1 by applying a sliding window of size 1 on an \(N\times n\) matrix, which is populated by the CCIs gathered about any NUT by the dedicated sniffers. This process if performed by subtracting the consecutive CCIs for each sensor, taking the average CCI of the \(n\) sniffing sensors, and finally adding the average of all the columns of the normalized absolute differences within each column, to the calculated sample from the previous iteration. The variable \(\mathit{Temp}^{(S_{i})}{}_{i}\) represents the subtraction of the consecutive CCIs, row-wise, where every column represents a number of sniffers. The absolute value is taken at each iteration and then divided by 100, which is the maximum possible difference between two consecutive CCIs. Finally, the \(\mathit{AMoF}^{(S_{i})}{}_{i}\) is calculated by finding the accumulated mean of the sniffers' CCIs. The second algorithm uses linear regression to iteratively find the fitted slope and confidence intervals regarding the CCIs of each NUT. Note that is the number of instances received by the supernode, which is also the number of reporting times in the experiment. Linear regression explains the dependency between the dependent variable \(X\) and independent variable \(Y\) as [16],  
\[Y_{i}=\beta_{0}+\beta_{1}X_{i}+\epsilon_{i}, \tag{1}\]  
where \(\beta_{0}\) and \(\beta_{1}\) are the model parameters. The errors \(\epsilon_{i}\) are assumed to be independent \(N\big{(}0,\sigma^{2}\big{)}\). The confidence interval for \(\beta_{1}\) is given as  
\[b_{1}\pm\frac{t\big{(}n-2,1-\frac{\alpha}{2}\big{)}s}{\big{\{}\big{(}x_{i}-x \big{)}^{2}\big{\}}^{1/2}}, \tag{2}\]  
where \(t\big{(}n-2,1-\frac{\alpha}{2}\big{)}\) is the \(100\big{(}1-\frac{\alpha}{2}\big{)}\) percentage point of a t-distribution with \((n-2)\) degrees of freedom and the residual sum of squares \(s^{2}\). The confidence of the slope in (2) is \(C\) as in Algorithm 2. Once enough AMoF samples have been generated (three samples suffice), the iterative regression calculates the fitted slope \(\beta_{1}\), including its upper and lower bounds.