# Clear database from old data
## 8 Experiments and Discussion
In addition to the f-score, we measured, first, the network throughput, second, the increase in resource consumption with the algorithms embedded in contrast to the solution without the detection mechanism and, third, the delay before the attack detection (i.e., the time it takes for an attack to be detected after its launch). During the experiments on modeling and detection of the attacks, the metrics take the following values: average network throughput is 89%, the average delay before the attack detection is 1.2 s and the average increase in resource consumption is 18%. In all the experiments conducted, the increase in resource consumption of WSN nodes (i.e., CPU load in this case) after the implementation of data collection and attack detection algorithms did not exceed 20% of the initial one. Table 8 discloses the outcome of experiments on attack detection in particular instances of attack variations. It demonstrates the ability of the proposed algorithms to detect not only common variations of the attacks but also those implemented by exploiting the properties of self-organization and decentralization. In order to optimize the resource consumption of the detector node, the case of combined use of the decision tree machine learning method for all four variations of attacks was also considered. The obtained high values of the detection quality metrics confirm the correctness of the proposed data collection and attack detection algorithms. In particular, for sinkhole and hello-flood, the experiments showed that the collected data were sufficient to build enough efficient attack detection algorithms to produce high-quality attack detection rates (Table 7). Considering a certain similarity of the input data for the detection of the different types of attacks considered in this article, this fact allows us to conclude that the developed algorithms for data collection and attack detection will work correctly for other attacks taken from the proposed attack model. However, for other types of attacks, these algorithms may require some adjustments to certain parameters, such as the types of data to be collected, as well as adjustments to the machine learning methods and their hyper-parameters. Let us compare the obtained results with the detection results of similar attacks from alternative works. Generally, Table 1 in Section 2 reveals the quality results of detecting attacks in wireless sensor networks. For example, in [16], [PERSON] et al. present a method to detect DDoS attacks with high accuracy, including flood attacks. However, other than the accuracy metric, the authors do not expose other metrics for evaluating the detection performance. In [12; 14], methods for detecting various attacks in WSNs (including those similar to the sinkhole attack) as well as anomalies are discussed. The shown accuracy results for attack and anomaly detection are also quite high, i.e., the accuracy ranges from 0.83 to 1.0 for different types of attacks and 0.899 for anomaly detection. But note that the attacks considered by these authors are common variations of attacks on WSNs, i.e., they do not take into account the mechanism of decentralization and self-organization in the process of attack implementation. Note that, in the example of the flood attack discussed in this section, the attacker uses the mechanism of network decentralization, namely role allocation. Therefore, we can conclude that the detection algorithms proposed in this article work with high accuracy, both in the case of a new variation of attacks (exploiting the properties of decentralization and role allocation) and in the detection of the common variation of the attack. The differences in the data collection algorithm include a decentralized method of data collection, being adapted during the operation, depending on, first, the current set of network nodes, second, the distribution of roles between them, third, the volume of available storage resources on the nodes and, finally, the size of the collected data flows.