# A Cross-Layer, Anomaly-Based IDS for WSN and MANET
## 3 Mathematical Modeling of the CCIs  
An analytical form of the AMoF is desired, in order to establish a proper detection threshold to distinguish between two classes, malicious and normal nodes. To obtain such a form, extensive work was conducted to obtain best distribution fitting of the accumulated CCIs, at the supernode, which represents the main block of the AMoF modeling. The data is collected in a matrix form, where the number of rows is equal to the number of reporting times \(N\), and the number of columns is equal to the number of sniffing sensors \(n\). The matrix is populated with the CCIs obtained at every \(\mathit{Tr}\), as shown in Table 1. The reporting time (\(\mathit{Tr}\)) is simply the simulation time divided by \(N\), and is the time used to collect data by the sniffers to generate a CCI which is then sent to the supernode. An example of \(\mathit{Tr}/\mathit{Ts}\) calculation is shown in Section 5. The sample fitting was performed column-wise to show the best distribution fit for each sniffing sensor. The log-likelihood ratio is employed to decide the closest distribution to our data samples. The top three distributions that provided best fits were found to be the extreme value (EV), gamma, and Nakagami distributions. Algorithm 1 and the preceding paragraphs in Section 4, provide a detailed explanation and calculation of the AMoF, which are based on subtracting the consecutive CCIs for each sensor, taking the average CCI of the \(n\) sniffing sensors and finally, adding to the calculated sample from the previous iteration. The extreme value distribution proved to be the best fitting distribution for a wide range of reporting time/sampling time (\(Tr/Ts\)) ratios based on the log-likelihood value. Samples of fitted distributions using a reporting time of \(Tr=100\) s and a sampling time of \(Ts=10\) s (for two extreme cases of node mobility and power level) are shown in Tables 2 and 3. The data fitting for the first scenario with node velocity 1 m/s and power level 3 dBm is shown in Table 2. The other scenario is presented in Table 3, where the node velocity is 15 m/s and the power level is 7 dBm. Node 13, a normal node, and Node 19, a malicious node, are used to illustrate the best fit for the CCIs. In Tables 2 and 3, the node under test (NUT) is indicated. The node speed and power levels are used to describe different scenarios in this work, for example, a node speed of 1 m/s and power level of 3 dBm is abbreviated as NS1P3. As mentioned earlier, an analytical model for the AMoF proved to be challenging; therefore, well-established heuristic methods were employed to develop a model and algorithm that calculates the AMoF. Given that the underlying distribution of the AMoF is extremely complex to obtain, we see it is important, at least, to model the main unit in calculating it, that is the CCI. \begin{table}
\begin{tabular}{c c c} \hline \hline  & \multicolumn{2}{c}{**Sniffers**} \\ \hline  & \(S_{1}\) & \(S_{n}\) \\ Correctly Classified Instances (CCIs) for every repotting time \(T_{r}\) & \(CCI_{1}^{(S_{1})}\) & \(CCI_{1}^{(S_{n})}\) \\  & \(CCI_{N}^{(S_{1})}\) & \(CCI_{N}^{(S_{n})}\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: A sample table for the collected correctly classified instances (CCIs) at the super node every \(Tr\). \begin{table}
\begin{tabular}{c c c c} \hline \hline  & \multicolumn{2}{c}{**NS1P3, \(Tr=100\) s, \(Ts=10\) s**} \\ \hline  & \multicolumn{2}{c}{NUT: 13} & \multicolumn{2}{c}{NUT: 19} \\ \hline  & \multicolumn{2}{c}{Log-likelihood for sensor 5} & \multicolumn{2}{c}{Log-likelihood for sensor 5} \\ \hline  & 21.4374 & EV & 20.0272 \\ Gamma & 15.2119 & Gamma & 17.4694 \\ Nakagami & 16.0349 & Nakagami & 18.1008 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The log-likelihood for three different density fits in scenario NS1P3.