## 4 Proposed System
### Selective Forwarding Detection (SFD) Algorithms  
#### 4.3.1 MAC Pool of IDs Layer  
The first layer consists of a pool of MAC IDs that filters and matches the traffic. Each traffic packet is monitored. The packet is matched to identify malicious activity using message fields (e.g., the packet, destination, and source IDs). It checks whether a node is legitimate or malicious. If a node is assigned a value of zero, it drops a packet and is considered malicious. Otherwise, it is accepted as a legitimate node. In our study, we analyze the malicious nodes that are detected in the first step using an algorithm based on the pool of MAC IDs as shown in Algorithm 1. ```
1. Input = (MP: Mac Pool)
2. Network parameter = (SN: sensor node, RT: route, TSN: Total sensor node)
3. For (SN = 0; SN <= TSN; SN++)
4. Set SN = SN + 1
5. If SN \(\in\) MP then
6. Set SN = 0 // the node is declared as malicious node not allowed for communication. 7. Rejected
8. Dropped
9. Else if SN = 1 // Node is declared as a legitimate node and allowed for communication
10. Accept
11. Store
12. Set SN = RT
13. SN \(\rightarrow\) RP
14. End if
15. End else
16. End for

Figure 3: Selective Forwarding Attack Detection Flowchart. #### 4.3.2 Rules Processing Layer

The second layer involves rule-based processing. It is the middle layer. It detects known attacks using rules. These are techniques used to define and describe the normal operations for detecting selective forwarding attacks. Rules must be applied before nodes are deployed in a network area. The rule-based processing layer checks the traffic by comparing it to a list of rules. If the traffic satisfies at least 90% of the rules, the node is confirmed to be legitimate (Algorithm 2). Therefore, the traffic will be returned to the pool of MAC IDs for release. If the traffic does not satisfy 90% of the rules, the node is considered doubtful and is rejected. Details of the rules are given in Table 1.
```
1. Input = (RP: Rules Process)
2. Output = (DT: Selective Forwarding Detector, RU: Rules)
3. Network parameter = (SN: Sensor node, RT: Route)
4. Attacking parameter = (SFAT: Attacker)
5. RL1 = Rules based in IDS (RL1 IDS)
6. RP \(\subseteq\) RL1 IDS
7. Set RL1 \(>=\) RU // 90% from the rules
8. For (SFAT \(=\) RL1; SFAT \(<=\) RP; SFAT \(++\))
9. If SFAT \(\subseteq\) RP then
10. DT \(\rightarrow\) SFAT
11. Attack alert
12. Rejected
13. Dropped
14. Else if (SFAT \(\subseteq\) RP) then
15. Set SN = RT
16. SN \(\rightarrow\) AD
17. End if
18. End else
19. End for
```
**Algorithm 2**Rules Processing Layer \begin{table}
\begin{tabular}{c c} \hline \hline
**Rule No.** & **Rule Description** \\ \hline Rule1 & Each node wait to see if the neighbor node forward the message or not. \\ Rule2 & The node that will receives message has to checks the transfer’s identity to make sure it is not \\  & change during transferring. \\ Rule3 & Each node makes sure that the next node has a shared key for negotiation. \\ Rule4 & Each node has a message route when it wants to transfer to other node. \\ Rule5 & Each sensor node must have ACKs. \\ Rule6 & Each sensor node must have the same ACK that use. \\ Rule7 & Each node has not created a new response before the previous one transfer. \\ Rule8 & Each node has to send the message using the correct route. \\ Rule9 & Each sensor node only communicates with other sensor nodes that locate in the same topology. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Rules based in selective forwarding attack. 4.3.3 Anomaly Detection Layer Based on Intrusion Detection System

The third layer involves anomaly detection, which is the recognition of unknown attacks. This layer checks the traffic that comes from the rule-based processing layer. Therefore, it works to analyze the traffic. The possible results of anomaly detection are false negative, false positive, true negative, and true positive. If the algorithm determines that an unknown attack is a false negative, it sends an alert and rejects the relevant packet.