# Clear database from old data
## 6 Attack Detection Algorithm  
After performing the process of data collection in a self-organizing decentralized WSN, it is necessary to construct an algorithm for detecting attacks for such networks. Currently, in practice, there are a number of different algorithms for detecting attacks in various networks, including in WSNs, based on profiling attacks and normal behavior of WSNs, the use of machine learning and data mining, statistical, and other methods. Each of these algorithms can be used to ensure the security of self-organizing decentralized wireless sensor networks with role-based control. But, in the context of the problem to be solved, the most promising seems to be a combination of several algorithms to ensure the identification of several of the most relevant attacks on the network at once. For example, a rules-based algorithm would be suitable for initial verification of the adequacy of sensor readings on nodes. To implement it, it is enough to set the required ranges of readings, and each node will be able to independently identify abnormal values. Additionally, it can be noted that the algorithm does not require large computational resources, which has a positive effect on the operation of network nodes. Thus, one can identify attacks aimed at falsifying sensor readings. To detect DoS attacks on WSNs, as a rule, a statistical approach using heuristics is used. A significant increase in the number of unsuccessful sessions or nodes connected to the network per unit of time may indicate the presence of an attack. Profiling allows for the detection of previously unknown attacks and anomalous behavior in general. The proposed combined algorithm for detecting attacks in self-organizing decentralized WSNs is presented in Figure 6. The algorithm combination is expressed in the joint usage of algorithms for different types of attacks into a single detection algorithm. The combined algorithm contains the following five steps. In step 1, a dataset is generated from previously collected data from the WSN. Step 2, which is seen as the most important one, involves selecting a feature space, calculating the features and transforming a dataset that will be suitable for detection algorithms for different types of attacks. Step 3 involves choosing specific machine learning methods and tuning their hyper-parameters to detect the required types of attacks. Steps 4 and 5 represent training machine learning methods as well as conducting experiments on attack detection and evaluating the detection quality, respectively. If the detection quality is not acceptable, then adjustments to the feature space or learning methods should be made. Algorithm 2 illustrates the pseudocode of the proposed attack detection algorithm. The input data contain a dataset with the data required for detection and a list of detection methods. The output data are the detected attack incidents as well as the detection quality assessment metrics. The first step is to read the required data and database; then, feature selection and the construction of new features are carried out. The last steps are model training, classification and detection quality evaluation. Figure 6: Combined algorithm for detecting attacks in WSNs. The main contribution of detection algorithms lies in the feature space for detecting specific attacks. Specific features for their detection were compiled for each class of attacks, as summarized in Table 6.  
The features described in Table 6 can be used for attack detection and can be obtained from the collected data, either directly or after their statistical and other processing. For example, the feature of the number of involved routes per unit of time can be obtained from the WSN message routes, whereas the average frequency of changing the roles of network nodes can be calculated by analyzing requests for the redistribution of node roles per unit of time.