# A Cross-Layer, Anomaly-Based IDS for WSN and MANET
## 8 Conclusions and Future Work  
A new IDS design based on a two-stage detection process is proposed in this paper. The use of the AMoF as a novel feature showed promising results especially for small size datasets; this is inherent to MANET operation, particularly in demanding environments where rapid decisions must be made. The inaccuracies of detection in stage one are compensated for in stage two, by taking advantage of the variability of the CCI for normal and malicious nodes. The idea is based on the variance of two distinct sizes of random variable populations, i.e., the normal and malicious node populations, where the variance is higher for the larger normal node population (in our case, 90% of the total nodes). This scheme, as all others we are aware of, will face higher challenges when exposed to comparably sized populations. The results show that for low-node velocity and high power transmitted, e.g., node velocity of 1 m/s and power level of 7 dBm (NS1P7), different ratios of reporting time to sampling time, _Tr_/Ts, reveal well-separated regions that facilitate the detection process. This is related to a high-node connectivity. The scenario of high-node velocity and low-transmitted power, e.g., NS15P3, shows less detection capability. This is related to low node connectivity, a regime in which MANET performance always degrades. Our solution is rather robust across a range of node speed and transmit power regimes, and the goal of future work is to further improve on this. Since much of the underlying probability distribution is a priori incompletely known, the classifier must continually adapt when pattern class structures change [25]. Therefore, MANET systems require continuous training to obtain reasonable detection results. However, the ratio between sample size to feature size in this case is close to three, which according to [26] demonstrates that the design-set error rate is an extremely biased estimate of either the Bayes or test-set error rate. Computationally demanding techniques can be used to reduce the effect of finite sample size, such as Monte-Carlo resampling, cross validation, etc., which may have problems when dealing with correlated features resulting in inaccurate decisions. Our approach deals with the stringent requirements facing WSN and MANET deployment, such as the limited size of training datasets and computational power availability. A new scheme based on the CCI, which includes information on both the true positive (TP) and the true negative (TN), is used due to the fact of having very limited training instances. Such a finite sample size generally limits the accuracy of classifiers as compared to situations where training instances are much larger, for example, in legacy or fixed networks. It is the variation of the CCI values that is of main interest, since the values of the CCI, including its corresponding TP and TN at any single reporting time (_Tr_), generates inaccurate decisions. In addition, a new scheme will be examined in future work that is based on incremental data acquisition for decision-making to alleviate the need of the second stage. Specifically, a more adaptive feature selection scheme will be tested, which fits the dynamic nature of the MANET. Testing the proposed IDS on different type(s) of malicious activity, such as denial of service, is needed to verify its robustness under wider range of attacks. Moreover, a wider range of classifiers will be utilized as well. These changes are expected to improve the decision accuracy associated with the nodes under test. The results presented here also apply to wireless sensor networks (WSN) and represent a novel intrusion detection scheme for such networks. Although this work was not supported, previous work supported under contract by the United States Special Operations Command, Phases I & II: Detection of Compromised Nodes in Wireless Ad Hoc/Sensor Networks, served as motivation. [PERSON] and [PERSON] designed the experiments, performed the coding, analyzed the data, and wrote the paper.