## 5 Results and Discussion
### The Comparative Performance of PRDFS and BRDFS in Detecting Malicious Nodes
#### 5.2.1 Major Findings:
Figure 9 shows the false positive rates (FPR) for PRDFS and BRDFS when detecting malicious nodes. The X-axis represents the percentages of sensor nodes that were malicious in the simulation trial. The Y-axis represents the false positive rates (FPR). The blue line shows the FPR of PRDFS under  
different percentages of malicious nodes whereas the orange line shows the FPR of BRDFS under different percentages of malicious nodes. The FPR in PRDFS never exceeds 9%. The FPR of BRDFS rises sharply with the percentage of malicious nodes. The FPR of BRDFS varies from less than 10% to around 75%. Figure 11: Number of malicious nodes detected vs. number of malicious nodes undetected by PRDFS and BRDFS. **(a)** PRDFS, and **(b)** BRDFS. Each bar in the subplots ‘(**a**) PRDFS’ and ‘(**b**) BRDFS’ shows the number of malicious nodes detected and the number of malicious nodes undetected by PRDFSand **(a)** PRDFS. Figure 10: The distribution of detected malicious nodes by PRDFS and BRDFS over time. **(a)** PRDFS and **(b)** BRDFS showing the distributions of the number of malicious nodes detected by PRDFS and BRDFS, respectively, in contrast to total number of malicious nodes in the system in different time windows in all games. The length of each time window is equal to five-time steps. The X-axis represents the time window, and the Y-axis represents the number of malicious nodes. In one game, the total number of nodes is 14. Ten games out of all 11 games contain malicious nodes. The total number of nodes in ten games together is 140, among which 77 nodes are malicious. Nodes are compromised at the beginning of the game. If a malicious node is detected, it is converted to benign nodes. If an algorithm detects a higher number of malicious nodes early in the games, there will be a lower total number of malicious nodes later. We add up malicious nodes detected in all games at each time window to get the total number of malicious nodes at the given time window. The orange part of each stacked bar represents the total number of malicious nodes undetected at the beginning of each time window, whereas the blue part represents the total number of malicious nodes detected in that time window. PRDFS detects the largest number of malicious nodes at the fourth time window. BRDFS appears to have a shorter time window for detecting malicious nodes than PRDFS. BRDFS have not detected any malicious nodes after the third time window. BRDFS, respectively, under a given percentage of malicious nodes. In both subplots, the X-axis represents the percentage of nodes compromised, whereas the Y-axis represents the number of nodes. The blue part of the bar indicates the number of detected malicious nodes. The orange part of the bar indicates the number of undetected malicious nodes. In subplot '(**a**)PRDF', there is no orange part in any bar. This is because PRDFS has detected all the malicious nodes under all percentages of malicious nodes. In subplot '(**b**)BRDFS', on the contrary, all bars are completely orange, except for the first two bars. A completely orange bar indicates that no malicious node is detected by BRDFS under the given percentage of malicious nodes. BRDFS identifies all malicious nodes when the percentage of malicious nodes is 10%. It can detect most of the malicious nodes under attacks with 20% malicious nodes.