# Clear database from old data
## 8 Experiments and Discussion
Figure 8: Illustration of a self-organizing decentralized WSN operation in the case of (**a**) new node appearing, (**b**) assigning a role to a new node, (**c**) initiating a redistribution of roles and (**d**) redistributing roles in the network. node informs the network controller about this, and the process of role redistribution starts; the keeper role will then pass to another node (block 'd' in Figure 8). The developed WSN model is primarily focused on solving issues of attack detection. Therefore, during a network operation, a log of events is recorded. The log collects events such as the initiation of reconfiguration of roles in the network and the deletion or addition of network nodes. Automated log analysis allows for the detection of attacks related to the exploitation of the self-organization and role-based functioning of the WSN. Log entries contain information about the time of an event, the type of event and its status. An example of a log recorded during testing is depicted in Figure 9.  
A validation scheme was developed to validate the proposed data collection and attack detection algorithms and their application technique. This scheme is presented in Figure 10.  
The first step of the validation scheme is to simulate the attack on a hardware/software test-bench. This step includes the creation of a prototype, declaring specific attack steps to be simulated, modeling the attack and recording the required data from the WSN by using the proposed data collection algorithm. For example, when implementing a flood attack on the test-bench, the specific steps of this attack were modeled, and they are exposed in Figure 9. Namely, the attacker, exploiting the property of self-organization, connects a malicious node to the network. To complete this activity, initially, the attacker learns the identifier of the network (PAN ID). Next, the attacker node initiates the process of redistribution of node roles in WSN. It waits for a response from other nodes in the WSN with a confirmation that they are ready for the redistribution. Just after that, the attacker terminates this initiation process. After the network returns to its initial state, the attacker repeats all these steps several times for a certain period (i.e., forming a long-duration repeated attack). In our experiments, the duration of running the test-bench was 60 min and the total duration of the attack was 20 min (namely, it was 4 attack runs of 5-min duration). Thus, the result of the first step is a recorded dataset, which is further used to train the classifiers. Figure 10: Validation scheme of the proposed solutions. Figure 9: A fragment of WSN event logs. The second step is the processing of the collected data. It includes extraction of the features required for the detection, constructing new features and generating a final dataset, which is then used to train detection models. The third step is the implementation of attack detection, i.e., the selection of detection methods and their hyper-parameters as well as training and classification. The fifth, and last, step is to evaluate the detection of quality as well as other metrics such as detection algorithm resource consumption. Specifically, common metrics, such as f-score, recall, precision and accuracy, are used to evaluate the detection quality. In addition, the detection algorithms are tested for false positives and missed attack incidents, and the time between the attack start and the successful detection is measured. The following values are set as the required values: the attack detection quality index f-score \(\geq\) 0.9, while the time from the start of an attack to its detection should be no more than 1 minute. The validation of the proposed solutions is performed on the hardware/software test-bench of a wireless sensor network according to the previously described scheme. The software/hardware test-bench of a self-organizing decentralized WSN is used to confirm the correctness and prospects of the proposed models and algorithms for attack detection.