## 4 IDS Analysis from Software Engineering Perspectives
### IDS Enhancements from an SE Perspective
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt}} \hline \hline
**Type** & **Requirement** \\ \hline Functional Requirements & The system shall: \\  & \(\bullet\) & Detect intrusions, of type Black hole attacks. \\  & \(\bullet\) & Be energy efficient. \\ System Requirements & The system shall: \\  & \(\bullet\) & Not introduce new weaknesses. \\  & \(\bullet\) & Use little system resources (e.g. energy). \\  & \(\bullet\) & Not degrade the overall system performance by introducing overheads. \\  & \(\bullet\) & Be reliable and scalable. \\  & \(\bullet\) & Add a third layer to the LEACH hierarchy, called the second cluster head layer. \\  & \(\bullet\) & Allow the SCHs to listen and monitor the CHs, by deploying the Watchdog technique. \\  & \(\bullet\) & Allow the SCHs to communicate with the BS. \\  & \(\bullet\) & Detect packet-dropping attacks at the CH layers only. \\  & \(\bullet\) & Select the SCH nodes based on the highest energy indicator (EI) and received signal strength indicator (RSSI) of a node. \\  & \(\bullet\) & Detect internal (within the network) intruders/attackers. \\  & \(\bullet\) & Allow the BS to broadcast an alarm message when attacks occur. \\  & \(\bullet\) & Maintain Black hole table for each node to prevent the selection of malicious nodes as CHs or SCHs. \\  & \(\bullet\) & Automatically record actions and incidents when they occur. \\ Output Requirements & The system shall: \\  & \(\bullet\) & Generate trace file report to log all actions. \\  & \(\bullet\) & Generate monitoring report to track intrusion incidents and discover Black hole attacks. \\  & \(\bullet\) & Generate network performance reports \\ Simulation Requirements & The functional requirements must meet real-time requirements and reflect the real-time cases and characteristics of nodes in WSNs. For example, if the IDS scheme functions based on the location of the node then it needs to consider that this consumes a lot of energy, since in real-time you will have to add a GPS to the node but in simulation the location can be easily calculated. Therefore, the developer will consider this when calculating the energy of the node in the simulation. \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Determine objectives and constraints. (3) Phase Three: Develop and Verify the System  
In order to develop, verify, and test the IDS, this paper used the network simulator tool version 2 (NS2) [61], which is well known and widely used in the field of network simulation. To get high reliability, accuracy, and efficiency in the developed IDS, this study has performed two steps before starting the actual development of the enhanced IDS:  
Step One: Study the LEACH protocol implementation  
The LEACH code is an open source code that was developed by a couple of researchers from the Massachusetts Institute of Technology (MIT). This was a good starting point for requirement engineering as well as exploring and learning the behavior of the WSNs. Step Two: Implement the compared-to approach [SCH-IDS] developed in [21]  
The source code of this IDS is not an open source code; therefore, we had to implement the IDS scheme but SCH-IDS had a lot of unclear points as mentioned before. Thus, in this research, three different designs were suggested, implemented, and tested. In spite of that, this has offered a chance to observe the different aspects that must be considered when implementing the requirements. Furthermore, we were able to find another contribution in the SE field, which is how different software designs of IDSs can affect the WSN performance. The details of how the development was carried out and tested are also described in Sections 5 and 6. (4) Phase Four: Plan Next Phase  
In this phase, we plan to overcome the risks and implement the suggested alternatives and explore their effects. This phase could be considered as future research work and extension to this research study.