# Detection of Packet Dropping Attack Based on Evidence Fusion in IoT Networks

Authors: Weichen Ding; Wenbin Zhai; Liang Liu; Ying Gu; Hang Gao
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Internet of Things (IoT) is widely used in environmental monitoring, smart healthcare, and other fields. Due to its distributed nature, IoT is vulnerable to various internal attacks. One of these attacks is the packet-dropping attack, which is very harmful. The existing packet-dropping attack detection algorithms are unsuitable for emerging resource-constrained IoT networks. For example, ML-based algorithms always inject numerous packets to obtain the training dataset. However, it is heavyweight for energy-limited nodes to forward these extra packets. In this paper, we propose a lightweight evidence fusion-based detection algorithm (EFDA), which leverages the packet forwarding evidence to identify malicious nodes. Firstly, EFDA finds the sequence numbers of dropped packets and their corresponding source nodes. Then, it traces the routing path of each dropped packet and collects evidence for detection. The evidence stored by nodes around the path record the node’s forwarding behaviors. Finally, the collected evidence is fused to evaluate the trust of nodes. Based on nodes’ trust, the K-means clustering is used to distinguish between malicious nodes and benign nodes. We conduct simulation experiments to compare EFDA with ML-based algorithms. The experimental results demonstrate that EFDA can detect the packet-dropping attack without injecting packets and achieve a higher detection accuracy.


---

## Body

## 1. Introduction

In the last decade, the Internet of things (IoT) has become a popular infrastructure to support many applications, such as intelligent transportation [1] and smart home [2]. IoT is a system consisting of interrelated computing devices, which collect and process the data acquired from the environments. These devices (such as sensors) cooperate with each other through the IoT protocol, including ZigBee [3], Wi-Fi [4], and Bluetooth.With the rapid development and application of IoT, it is prone to varied attacks, among which the packet-dropping attack is very hard to detect and prevent. In the packet-dropping attack, malicious attackers can invade and control legitimate devices to discard some essential packets halfway, causing the base station loses the important information. For example, malicious nodes drop the vital packets in the healthcare wireless sensor network (WSN) that contains the alarm information for the patient’s health parameters such as blood pressure and heart rate [5]. If the alarm information is not transmitted to the doctors but dropped halfway, the patients will be at risk. It is vital to detect malicious nodes.


### 1.1. Motivation

In recent years, many traditional packet-dropping attack detection algorithms have been proposed, but they are not suitable for the emerging resource-constrained IoT networks. For instance, traditional machine learning (ML)-based detection algorithms [6–9] identify malicious nodes by training detection models. The performance of the detection models depends on the size of the training dataset. To get a large size of the training dataset, numerous labeled packets need to be injected into the IoT networks. However, it is heavyweight for energy-limited nodes to forward numerous injected packets. It is crucial to propose a lightweight algorithm for resource-constrained IoT networks. To overcome this problem, we propose a lightweight evidence fusion-based detection algorithm (EFDA), which uses the packet forwarding evidence (PFEs) to identify malicious nodes. The PFE is generated during the packet forwarding process. When a node in the network forwards a packet, it locally stores a packet forwarding record. Due to the broadcast characteristic of wireless communication in IoT networks, each neighbor of the node can sniff the packet and generate a PFE.As shown in Figure1, EFDA contains three phases.(1)
Getting the dropped packet set: the base station needs to find the dropped packets and their corresponding source nodes. For this purpose, the base station divides received packets into groups according to their source nodes. Then, the base station sorts the received packets in each group based on their sequence numbers. The dropped packets can be found because their sequence numbers are not in the groups. Figure1 shows an example that the base station divides the received packets into two groups according to two source nodes: N1 and N2. After sorting the packets in each group, it finds that the dropped packet is N1.Packet2, which is the identifier of the packet whose corresponding source node is N1.(2)
Collecting PFEs: for each dropped packet, the base station traces its routing path and finds the suspicious nodes. In Figure1, the base station sends a request to N1 to ask it for the next forwarding node of N1.Packet2; N1 searches its forwarding records and finds that the next forwarding node of N1.Packet2 is N2, on behalf of the base station, N1 asks N2 for the next forwarding node of the packet; N2 searches its forwarding records and finds that next forwarding node is N4; N2 continues to ask N4 for the next forwarding node of the packet; N4 reports the next forwarding node of the packet is N6. But after N4 asks N6, N6 reports that it has never received the packet. At this moment, the base station finds a logic conflict between N4 and N6, and then, it identifies N4 and N6 as suspicious nodes. To resolve the logic conflict and find the liar, the base station collects PFEs stored by the neighbors of N4, namely N2, N3, and N5.(3)
Fusing PFEs: the base station fuses the collected PFEs. BecauseN2, N3, and N5 provide PFEs to prove that N4 has forwarded N1.Packet2 to N6, the base station discovers that N6 lies to hide its dropping packet behavior.Figure 1
The process of EFDA.As mentioned above, EFDA does not need to inject extra packets to obtain the training dataset to train the detection model, and it utilizes the existing PFEs in the network to perform logical reasoning and identify malicious nodes.In summary, the contributions of this paper are as follows.We propose a lightweight evidence fusion based packet dropping attack detection algorithm (EFDA) for the resource-constrained IoT networks. EFDA uses the packet forwarding evidences to detect malicious nodes, which achieves a high detection accuracy with a low cost. We conduct simulation experiments to systematically evaluate our detection algorithm. The experimental results show that EFDA provides better detection accuracy than ML-based algorithms.


### 1.2. Organization

The remainder of this paper is organized as follows. Section2 introduces the related work of the packet dropping attack detection in IoT. Section 3 formalizes the packet dropping attack. Section 4 details our detection algorithm, EFDA. Section 5 shows the results of the simulation experiments. Section 6 concludes this paper.


## 1.1. Motivation

In recent years, many traditional packet-dropping attack detection algorithms have been proposed, but they are not suitable for the emerging resource-constrained IoT networks. For instance, traditional machine learning (ML)-based detection algorithms [6–9] identify malicious nodes by training detection models. The performance of the detection models depends on the size of the training dataset. To get a large size of the training dataset, numerous labeled packets need to be injected into the IoT networks. However, it is heavyweight for energy-limited nodes to forward numerous injected packets. It is crucial to propose a lightweight algorithm for resource-constrained IoT networks. To overcome this problem, we propose a lightweight evidence fusion-based detection algorithm (EFDA), which uses the packet forwarding evidence (PFEs) to identify malicious nodes. The PFE is generated during the packet forwarding process. When a node in the network forwards a packet, it locally stores a packet forwarding record. Due to the broadcast characteristic of wireless communication in IoT networks, each neighbor of the node can sniff the packet and generate a PFE.As shown in Figure1, EFDA contains three phases.(1)
Getting the dropped packet set: the base station needs to find the dropped packets and their corresponding source nodes. For this purpose, the base station divides received packets into groups according to their source nodes. Then, the base station sorts the received packets in each group based on their sequence numbers. The dropped packets can be found because their sequence numbers are not in the groups. Figure1 shows an example that the base station divides the received packets into two groups according to two source nodes: N1 and N2. After sorting the packets in each group, it finds that the dropped packet is N1.Packet2, which is the identifier of the packet whose corresponding source node is N1.(2)
Collecting PFEs: for each dropped packet, the base station traces its routing path and finds the suspicious nodes. In Figure1, the base station sends a request to N1 to ask it for the next forwarding node of N1.Packet2; N1 searches its forwarding records and finds that the next forwarding node of N1.Packet2 is N2, on behalf of the base station, N1 asks N2 for the next forwarding node of the packet; N2 searches its forwarding records and finds that next forwarding node is N4; N2 continues to ask N4 for the next forwarding node of the packet; N4 reports the next forwarding node of the packet is N6. But after N4 asks N6, N6 reports that it has never received the packet. At this moment, the base station finds a logic conflict between N4 and N6, and then, it identifies N4 and N6 as suspicious nodes. To resolve the logic conflict and find the liar, the base station collects PFEs stored by the neighbors of N4, namely N2, N3, and N5.(3)
Fusing PFEs: the base station fuses the collected PFEs. BecauseN2, N3, and N5 provide PFEs to prove that N4 has forwarded N1.Packet2 to N6, the base station discovers that N6 lies to hide its dropping packet behavior.Figure 1
The process of EFDA.As mentioned above, EFDA does not need to inject extra packets to obtain the training dataset to train the detection model, and it utilizes the existing PFEs in the network to perform logical reasoning and identify malicious nodes.In summary, the contributions of this paper are as follows.We propose a lightweight evidence fusion based packet dropping attack detection algorithm (EFDA) for the resource-constrained IoT networks. EFDA uses the packet forwarding evidences to detect malicious nodes, which achieves a high detection accuracy with a low cost. We conduct simulation experiments to systematically evaluate our detection algorithm. The experimental results show that EFDA provides better detection accuracy than ML-based algorithms.


## 1.2. Organization

The remainder of this paper is organized as follows. Section2 introduces the related work of the packet dropping attack detection in IoT. Section 3 formalizes the packet dropping attack. Section 4 details our detection algorithm, EFDA. Section 5 shows the results of the simulation experiments. Section 6 concludes this paper.


## 2. Related Work

To resist the packet dropping attack, a wide variety of algorithms are proposed in recent researches, which can be divided into five categories: monitor-based algorithms, acknowledgment-based algorithms, camouflage-based algorithms, ML-based algorithms, and other algorithms.


### 2.1. Monitor-Based Algorithm

The core of monitor-based algorithms is to place monitoring nodes among communication nodes and classify them into “normal” and “abnormal” by the collected traffic data [10]. Watchdog [11] is a basic technology for the packet dropping attack detection, where a monitoring node sniffs the traffic of the next hop to detect the attacks of malicious nodes. Li et al. [12] applied the watchdog to monitor the behavior of nodes rather than traffic data, and they detected malicious nodes by comparing the interval of sending and receiving packets with the threshold. In the monitor-based detection (CMD) [13], each node monitors the packet loss rates of its preferred parent node and its one-hop neighbor nodes. By comparing the packet loss rate of its preferred parent and one-hop neighbor nodes, the monitoring node can find the abnormal behaviors of its preferred parent node.


### 2.2. Acknowledgment-Based Algorithms

The acknowledgment-based algorithms depend on the acknowledgment (ACK) packet to detect malicious nodes [14]. Each node is responsible for monitoring the forwarding behaviors of its next node and reporting it to the base station by sending ACK packets. In adaptive acknowledgment-based approach (AAA) [15], each node monitors its one-hop and two-hop downstream nodes. After forwarding a data packet, the node overhears the forwarding behavior of its one-hop downstream node and waits to receive an ACK packet from its two-hop downstream node. Once receiving no ACK packet, the node identifies its one-hop downstream node as a malicious node. In single checkpoint-based detection (SCAD) [16], the source node randomly selects an intermediate node on the routing path as the checkpoint node for each packet. After receiving the packet, both the sink node and checkpoint node need to reply an ACK packet to the source node. If receiving no ACK packet, other intermediate nodes will send an alarm packet to the source node to suspect their downstream nodes, which are identified as malicious nodes.


### 2.3. Camouflage-Based Algorithms

In the energy harvesting motivated networks (EHNets), some nodes called energy harvesting node need to periodically harvest energy from an immediate environment. In camouflage-based active detection (CAM) [17], each node actively disguises it as an energy harvesting node and pretends not to overhear its adjacent nodes. But actually, each node monitors any forwarding behaviors of its adjacent nodes. Once finding abnormal behaviors, they identify that adjacent node as a malicious node. In the EYES [18], each node not only actively disguises itself as an energy harvesting node to overhear the forwarding behaviors of its adjacent nodes but also validates any previous uncertain forwarding behavior to detect malicious nodes.


### 2.4. ML-Based Algorithms

Machine learning (ML) is a common and efficient technology, which has been widely used in malicious node detection. Akbani et al. [19] combined the ML with the reputation systems (RS), which automates the process of designing the RS model. Liu et al. [20] proposed a trust system, which calculated the trust of each node by the trust of each routing path. Based on the trusts of nodes, they were divided into malicious or benign group. Liu et al. [21] improved this scheme, and they used the method of linear regression to calculate the trust of nodes, which was more accurate than [20]. Also, they took into account the possibility that nodes launched the multiple-mix-attack. Yang et al. [22] considered a more fine-grained attack named selective-edge packet attack, and they argued that malicious nodes may be more intelligent to launch an attack selectively. Also, they selected the best scheme after sifting through various types of regression algorithms and clustering algorithms.


### 2.5. Other Algorithms

In [23], due to most of the detection algorithms are for the centralized networks, blockchain-based multimobile code-driven trust mechanism (BMCTM) is proposed to detect malicious nodes in decentralized networks. It combines the blockchain technology and trust system, which detects nodes as malicious nodes according to their low trusts. A secure routing framework is proposed in [24], which leverages a new type of packet called dummy packet to detect malicious nodes. The dummy packet scheme is used to find the critical routes and detect malicious nodes in the critical routes. In [25], considering malicious nodes may lie to attract and drop packets during route establishment phase, and a robust hybrid method is proposed to strengthen the route security.Most of the above algorithms are heavyweight for the emerging resource-constrained IoT networks. For monitor-based algorithms, acknowledgment-based algorithms, and camouflage-based algorithms, the energy-limited nodes need to monitor the forwarding behaviors of their neighbor nodes and to converge collected data all the times. For ML-based algorithms, the energy-limited nodes need to assist them to obtain the training dataset by forwarding numerous injected packets. They are heavyweight for energy-limited nodes. Therefore, in this paper, we propose a lightweight evidence fusion-based detection algorithm (EFDA) to achieve a high detection accuracy.


## 2.1. Monitor-Based Algorithm

The core of monitor-based algorithms is to place monitoring nodes among communication nodes and classify them into “normal” and “abnormal” by the collected traffic data [10]. Watchdog [11] is a basic technology for the packet dropping attack detection, where a monitoring node sniffs the traffic of the next hop to detect the attacks of malicious nodes. Li et al. [12] applied the watchdog to monitor the behavior of nodes rather than traffic data, and they detected malicious nodes by comparing the interval of sending and receiving packets with the threshold. In the monitor-based detection (CMD) [13], each node monitors the packet loss rates of its preferred parent node and its one-hop neighbor nodes. By comparing the packet loss rate of its preferred parent and one-hop neighbor nodes, the monitoring node can find the abnormal behaviors of its preferred parent node.


## 2.2. Acknowledgment-Based Algorithms

The acknowledgment-based algorithms depend on the acknowledgment (ACK) packet to detect malicious nodes [14]. Each node is responsible for monitoring the forwarding behaviors of its next node and reporting it to the base station by sending ACK packets. In adaptive acknowledgment-based approach (AAA) [15], each node monitors its one-hop and two-hop downstream nodes. After forwarding a data packet, the node overhears the forwarding behavior of its one-hop downstream node and waits to receive an ACK packet from its two-hop downstream node. Once receiving no ACK packet, the node identifies its one-hop downstream node as a malicious node. In single checkpoint-based detection (SCAD) [16], the source node randomly selects an intermediate node on the routing path as the checkpoint node for each packet. After receiving the packet, both the sink node and checkpoint node need to reply an ACK packet to the source node. If receiving no ACK packet, other intermediate nodes will send an alarm packet to the source node to suspect their downstream nodes, which are identified as malicious nodes.


## 2.3. Camouflage-Based Algorithms

In the energy harvesting motivated networks (EHNets), some nodes called energy harvesting node need to periodically harvest energy from an immediate environment. In camouflage-based active detection (CAM) [17], each node actively disguises it as an energy harvesting node and pretends not to overhear its adjacent nodes. But actually, each node monitors any forwarding behaviors of its adjacent nodes. Once finding abnormal behaviors, they identify that adjacent node as a malicious node. In the EYES [18], each node not only actively disguises itself as an energy harvesting node to overhear the forwarding behaviors of its adjacent nodes but also validates any previous uncertain forwarding behavior to detect malicious nodes.


## 2.4. ML-Based Algorithms

Machine learning (ML) is a common and efficient technology, which has been widely used in malicious node detection. Akbani et al. [19] combined the ML with the reputation systems (RS), which automates the process of designing the RS model. Liu et al. [20] proposed a trust system, which calculated the trust of each node by the trust of each routing path. Based on the trusts of nodes, they were divided into malicious or benign group. Liu et al. [21] improved this scheme, and they used the method of linear regression to calculate the trust of nodes, which was more accurate than [20]. Also, they took into account the possibility that nodes launched the multiple-mix-attack. Yang et al. [22] considered a more fine-grained attack named selective-edge packet attack, and they argued that malicious nodes may be more intelligent to launch an attack selectively. Also, they selected the best scheme after sifting through various types of regression algorithms and clustering algorithms.


## 2.5. Other Algorithms

In [23], due to most of the detection algorithms are for the centralized networks, blockchain-based multimobile code-driven trust mechanism (BMCTM) is proposed to detect malicious nodes in decentralized networks. It combines the blockchain technology and trust system, which detects nodes as malicious nodes according to their low trusts. A secure routing framework is proposed in [24], which leverages a new type of packet called dummy packet to detect malicious nodes. The dummy packet scheme is used to find the critical routes and detect malicious nodes in the critical routes. In [25], considering malicious nodes may lie to attract and drop packets during route establishment phase, and a robust hybrid method is proposed to strengthen the route security.Most of the above algorithms are heavyweight for the emerging resource-constrained IoT networks. For monitor-based algorithms, acknowledgment-based algorithms, and camouflage-based algorithms, the energy-limited nodes need to monitor the forwarding behaviors of their neighbor nodes and to converge collected data all the times. For ML-based algorithms, the energy-limited nodes need to assist them to obtain the training dataset by forwarding numerous injected packets. They are heavyweight for energy-limited nodes. Therefore, in this paper, we propose a lightweight evidence fusion-based detection algorithm (EFDA) to achieve a high detection accuracy.


## 3. Network and Attack Model

In this section, the network model is introduced, and the packet-dropping attack is formalized. Table1 exhibits a list of notations for later reference.Table 1
Notations.
SymbolMeaningNThe set of nodes in a networkNiA node inNSThe base station in a networkPThe set of routing paths in a networkPathjA routing path inPNi.PacketkThe identifier of a packet whose source node isNiPdThe attack probability of a node


### 3.1. Network Model

In this paper, the IoT network is a multihop wireless network consisting of sensor nodes, which communicate with each other through the routing protocol for low-power and lossy networks (RPL). The sensor nodes collect data and encapsulate them into packets. The packets are forwarded by relay nodes to the base station. A typical IoT network is shown in Figure2.Figure 2
A typical IoT network.A node is represented asNii∈1,M, and the base station is represented as S. Each node has at least one routing path to the base station S. A routing path is represented as Pathjj∈1,K, which is expressed as(1)Pathj=N1⟶N2⟶⋯⟶Ni⟶S,where it represents a packet which is sent from N1, forwarded through N2,…,Ni in a sequence, and finally received by the base station S.Then, the network is expressed as(2)Network=N,S,P,N=N1,N2,…,Ni,…,NM,P=Path1,Path2,…,Pathj,…,PathK,where N is the set of nodes in the network, and P is the set of routing paths in the network, Network is the network consisting of the sensor nodes, the base station, and the routing paths.


### 3.2. Packet Dropping Attack Model

If there are no malicious nodes, a packet will arrive at the base station. However, the packet may be discarded halfway if there are malicious nodes.As shown in Figure3, the malicious node N6 drops the packet N1.Packet2. In this paper, the malicious nodes may launch the packet-dropping attack with a certain probability PdPd∈0,1. We use Ni.Pd to represent the probability that Ni launches a packet-dropping attack. Considering the harmfulness of the packet-dropping attack and the constrained resources of the IoT network, the malicious nodes should be detected with a high accuracy and a low overhead.Figure 3
A network with malicious nodes.


### 3.3. PFE Model

The packet forwarding evidences (PFEs) are generated during the packet transmission. Due to the broadcast characteristic of wireless communication, when a nodeNf forwards a packet Ni.Packetj, all neighbors of Nf can sniff the packet. The receiving node Nr will receive the packet, and other neighbors of Nf generate PFEs to record the forwarding behavior of Nf. The generated PFE can be represented as(3)PFE=Nf,Ni.Packetj,Nr,where it represents the neighbors of Nf witness that Nf has forwarded the packet N1.Packetj to Nr.As shown in Figure4, N4 wants to forward the packet N1.Packet2 to N6. Due to the broadcast characteristic of wireless communication, all neighbors of N4 can sniff the packet. N6 receives the packet, and the other neighbors (N2, N3, N5, N10) of N4 generate a PFE, namely N4,N1.Packet2,N6.Figure 4
An example of the PFEs generated.During packet transmission, each node generates numerous PFEs according to the forwarding packet behaviors of its neighbors. We design a table named PFE Table (PFET) for each node to store the PFEs. PFET is shown in Table2.where there are four fields: Packet-ID, Forwarding Node, Receiving Node, and Capacity. Packet-ID means the identifier of the forwarded packet; Forwarding Node means the node that forwards the packet; Receiving Node means the node that receives the packet; Capacity means the number of PFEs that a node can store. We assume that a node’s total capacity is C, and it is divided equally to its neighbors. According to Table 2, we can know that N10 has generated three PFEs about N4, which, respectively, represent N4 has forwarded N1.Packet2 to N6, N1.Packet3 to N5, and N2.Packet1 to N3.Table 2
PFET ofN10.
Packet-IDForwarding nodeReceiving nodeCapacityN1.Packet2N4N6C/2N1.Packet3N5N2.Packet1N3N4.Packet1N6N5C/2N4.Packet2N7N5.Packet1N7To avoid PFE being faked or tampered, we apply the signcryption in [26] to transfer the PFE. The signcryption generalized-CLSC (gCLSC) is secure and lightweight, which can be used in the resource-constrained IoT network. Before sending a PFE to the base station, the sending node encrypts and signs the PFE with gCLSC. After receiving the encrypted and signed PFE, the base station verifies the sending node’s signature and decrypts the PFE with gCLSC.


## 3.1. Network Model

In this paper, the IoT network is a multihop wireless network consisting of sensor nodes, which communicate with each other through the routing protocol for low-power and lossy networks (RPL). The sensor nodes collect data and encapsulate them into packets. The packets are forwarded by relay nodes to the base station. A typical IoT network is shown in Figure2.Figure 2
A typical IoT network.A node is represented asNii∈1,M, and the base station is represented as S. Each node has at least one routing path to the base station S. A routing path is represented as Pathjj∈1,K, which is expressed as(1)Pathj=N1⟶N2⟶⋯⟶Ni⟶S,where it represents a packet which is sent from N1, forwarded through N2,…,Ni in a sequence, and finally received by the base station S.Then, the network is expressed as(2)Network=N,S,P,N=N1,N2,…,Ni,…,NM,P=Path1,Path2,…,Pathj,…,PathK,where N is the set of nodes in the network, and P is the set of routing paths in the network, Network is the network consisting of the sensor nodes, the base station, and the routing paths.


## 3.2. Packet Dropping Attack Model

If there are no malicious nodes, a packet will arrive at the base station. However, the packet may be discarded halfway if there are malicious nodes.As shown in Figure3, the malicious node N6 drops the packet N1.Packet2. In this paper, the malicious nodes may launch the packet-dropping attack with a certain probability PdPd∈0,1. We use Ni.Pd to represent the probability that Ni launches a packet-dropping attack. Considering the harmfulness of the packet-dropping attack and the constrained resources of the IoT network, the malicious nodes should be detected with a high accuracy and a low overhead.Figure 3
A network with malicious nodes.


## 3.3. PFE Model

The packet forwarding evidences (PFEs) are generated during the packet transmission. Due to the broadcast characteristic of wireless communication, when a nodeNf forwards a packet Ni.Packetj, all neighbors of Nf can sniff the packet. The receiving node Nr will receive the packet, and other neighbors of Nf generate PFEs to record the forwarding behavior of Nf. The generated PFE can be represented as(3)PFE=Nf,Ni.Packetj,Nr,where it represents the neighbors of Nf witness that Nf has forwarded the packet N1.Packetj to Nr.As shown in Figure4, N4 wants to forward the packet N1.Packet2 to N6. Due to the broadcast characteristic of wireless communication, all neighbors of N4 can sniff the packet. N6 receives the packet, and the other neighbors (N2, N3, N5, N10) of N4 generate a PFE, namely N4,N1.Packet2,N6.Figure 4
An example of the PFEs generated.During packet transmission, each node generates numerous PFEs according to the forwarding packet behaviors of its neighbors. We design a table named PFE Table (PFET) for each node to store the PFEs. PFET is shown in Table2.where there are four fields: Packet-ID, Forwarding Node, Receiving Node, and Capacity. Packet-ID means the identifier of the forwarded packet; Forwarding Node means the node that forwards the packet; Receiving Node means the node that receives the packet; Capacity means the number of PFEs that a node can store. We assume that a node’s total capacity is C, and it is divided equally to its neighbors. According to Table 2, we can know that N10 has generated three PFEs about N4, which, respectively, represent N4 has forwarded N1.Packet2 to N6, N1.Packet3 to N5, and N2.Packet1 to N3.Table 2
PFET ofN10.
Packet-IDForwarding nodeReceiving nodeCapacityN1.Packet2N4N6C/2N1.Packet3N5N2.Packet1N3N4.Packet1N6N5C/2N4.Packet2N7N5.Packet1N7To avoid PFE being faked or tampered, we apply the signcryption in [26] to transfer the PFE. The signcryption generalized-CLSC (gCLSC) is secure and lightweight, which can be used in the resource-constrained IoT network. Before sending a PFE to the base station, the sending node encrypts and signs the PFE with gCLSC. After receiving the encrypted and signed PFE, the base station verifies the sending node’s signature and decrypts the PFE with gCLSC.


## 4. Algorithm

In this section, we introduce our evidence fusion-based detection algorithm (EFDA), which is divided into three phases. (1) Getting the dropped packet set: the base station finds the dropped packet set and the source node of each dropped packet. (2) Collecting PFEs: for each dropped packet, the base station traces its routing path and finds the suspicious nodes. PFEs stored by neighbors of suspicious nodes are collected. (3) Fusing PFEs: the base station fuses the collected PFEs to detect malicious nodes.


### 4.1. Getting the Dropped Packet Set

The source nodes collect data from the environment, encapsulate them into packets, and then upload the packets to the base station. After receiving the packets, the base station divides the received packets into different groupsGii∈1,M according to their source nodes Ni. For each group, the base station sorts the packets according to their sequence numbers. After grouping and sorting the received packets, the base station can find the dropped packets and their corresponding source nodes.As Figure5 shows, the base station divides the received packets into M groups and sorts the packets for each group. For the first group of the source node N1, the base station receives the packets with sequence number N1.Packet1, N1.Packet2, and N1.Packet4 except N1.Packet2. So it finds that N1.Packet2 is dropped. After checking all groups, the base station can obtain the dropped packet set.Figure 5
The process of getting the dropped packets set.


### 4.2. Collecting PFEs

After finding all the dropped packets, the base station traces the routing path of each dropped packet. In the process of tracing, the base station investigates the nodes on the routing path hop by hop. In the final hop, it can find two suspicious nodes that may drop the packet. To judge the suspicious nodes, PFEs about them are collected at the base station. We propose an evidence collection protocol (ECP) to trace the routing path and collecting PFEs.In order to assist ECP to trace the routing path of each dropped packet, each node in the network needs to generate records about its packet forwarding behaviors. Each node maintains a packet forwarding record table (PFRT) to store the records, which is shown in Table3. It contains three fields: Last Node, Packet-ID, and Next Node. Last Node means the last node that forwards the packet, Packet-ID means the identifier of the forwarded packet, and Next Node means the next node where the packet is forwarded. After a node receives a packet and forwards the packet to another node, it will update its PFRT to record the forwarding behavior.Table 3
Packet forwarding record table ofN4.
Last nodePacket-IDNext nodeN2N1.Packet2N6As shown in Figure6, during the transmission of the packet N1.Packet2, N4 receives the packet from N2 and forwards it to N6. To record this forwarding behavior, N4 inserts a record N2,N1.Packet2,N6 into its PFRT. Besides, malicious nodes may not update their PFRTs because they drop packets instead of forwarding them.Figure 6
An example of updating the PFRT.Based on the packet forwarding records stored by nodes, ECP can trace the routing path of each dropped packet. For a dropped packetNi.Packetj, the process of tracing the packet can be described as follows.The base station finds the dropped packetNi.Packetj and its corresponding source node Ni. It constructs a TM message (shown in Table 4) tm {“Packet-ID”: “Ni.Packetj”} and sends it to Ni. The message tm is used to ask Ni for the next forwarding node of Ni.Packetj. After that, the base station initializes the tracing progress as Ni. Once receiving tm, node Ni searches its PFRT for the packet forwarding record about the packet. It finds the next forwarding node is Ns. It constructs a RM message (shown in Table 5) rm {“Successor”: “Ns”} and sends it to the base station. The message rm is used to report the tracing progress to the base station. Besides, Ni forwards tm to Ns to ask it to continue to trace the routing path of the packet. When the base station receives rm, it updates the tracing progress as Ni⟶Ns. After receiving tm, node Ns repeats the operations like Ni to continue to trace the routing path. After several steps of tracing, the tracing progress is updated to Ni⟶Ns⟶⋯⟶Nk⟶Nm, and a malicious node Nm receives tm.Table 4
Tracing message (TM).
FieldDescriptionPacket-IDThe identifier of a dropped packetTable 5
Reporting message (RM).
FieldDescriptionSuccessorThe next forwarding node of the dropped packetAs shown in Figure7, the base station finds the dropped packet N1.Packet2 and its corresponding source node N1. Then, it sends a TM message tm to N1 and initializes the tracing progress as N1. Once receiving tm, node N1 searches its PFRT and finds the next forwarding node is N2. It sends a RM message rm1 to the base station and forwards tm to N2. When the base station receives rm1, it updates the tracing process as N1⟶N2. Once receiving tm, node N2 continues to trace the routing path of the packet. After several steps of tracing, the tracing progress is updated to N1⟶N2⟶N4⟶N6, and N6 receives tm from N4. We assume that node N6 is a malicious node.Figure 7
An example of ECP.When a malicious nodeNm receives tm, there are three possible cases as follows.Case 1.
The malicious node does not respond to the base station.
The continued tracing process is described as follows.
After receivingtm, the malicious node Nm does not respond to the base station. Once receiving no response from Nm, the base station identifies Nm as a malicious node.
As shown in Case1 of Figure 7, N6 has received tm from N4, but it does not respond to the base station. The base station identifies N6 as a malicious node.Case 2.
The malicious node responds that it has never received the packet forwarded by its predecessor.
The continued tracing process is described as follows:
After receivingtm, the malicious node Nm denies that it has received Ni.Packetj from Nk. So, it constructs an IM message (shown in Table 6) im {“Packet-ID”: “Ni.Packetj,” “Impeaching-Node”: “Nm,” “Impeached-Node”: “Nk”} and sends it to the base station. The message im is used to report the base station that Nm has never received Ni.Packetj from Nk. When the base station receives im, it finds a logic conflict between Nk and Nm. It identifies Nk and Nm as suspicious nodes.
As shown in Case2 of Figure 7, N6 denies that it has received N1.Packet2 from N4. Then, it sends an IM message im1 to the base station. After receiving im1, the base station identifies N4 and N6 as suspicious nodes.Table 6
Impeaching message (IM).
FieldDescriptionPacket-IDThe identifier of a dropped packetImpeaching-nodeThe node impeaches that impeached nodehas not forwarded the packet to itImpeached-nodeThe node is impeachedCase 3.
The malicious node responds that it has forwarded the packet to a neighbor, but actually not.
The continued tracing process is described as follows:
After receivingtm, the malicious node Nm lies that it has forwarded Ni.Packetj to Nn. So, it sends rm {“Successor”: “Nn”} to the base station. Besides, it forwards tm to Nn. When the base station receives rm, it updates the tracing progress as Ni⟶Ns⟶⋯⟶Nk⟶Nm⟶Nn. Once receiving tm, node Nn searches its PFRT but finds no packet forwarding record about Ni.Packetj. So, it sends im {“Packet-ID”: “Ni.Packetj,” “Impeaching-Node”: “Nn,” “Impeached-Node”: “Nm”} to the base station to deny that it has received Ni.Packetj from Nm. When the base station receives im, it finds a logic conflict between Nm and Nn. It identifies Nm and Nn as suspicious nodes.
As shown in Case3 of Figure 7, N6 lies that the next forwarding node is N8. It sends rm4 to the base station and forwards tm to N8. When the base station receives rm4, it updates the tracing progress as N1⟶N2⟶N4⟶N6⟶N8. Once receiving tm, node N8 sends im2 to the base station to deny that it has received N1.Packet2 from N6. When the base station receives im2, it identifies N6 and N8 as suspicious nodes.
After the tracing process of a dropped packet likeNi.Packetj, the base station can get two suspicious nodes like Nk and Nm (Nm and Nn). To find the liar in them, the base station needs to collect PFEs about them as follows.
Without loss of generality, we suppose the suspicious nodes areNk and Nm.
The base station constructs aCEM message (shown in Table 7) cem {“Expected-PFE”: “Nk,Ni.Packetj,Nm”} and sends it to the precursor Nk of the suspicious nodes. The message cem is used to collect PFEs. Once receiving cem, Nk constructs a REM message (shown in Table 8) rem {“Expected-PFE”: “Nk,Ni.Packetj,Nm”} and sends it to its neighbors. The message rem is used to request the neighbors to send the relevant PFEs to the base station. When each neighbor of Nk receives rem, it searches its PFET for the PFE. Once getting the matched PFE, each neighbor constructs an EM message (shown in Table 9) em {“PFE”: “Nk,Ni.Packetj,Nm”} and sends it to the base station. But, the accomplice does not submit correct PFE by sending em {”PFE”: “(No Evidence)”} or submits a faked PFE to the base station. After receiving all EM messages, the base station extracts the PFEs in them.
As shown in Case2 of Figure 7, the base station finds the suspicious nodes N4 and N6. It sends a CEM message cem1 to the precursor N4. Once N4 receives cem1, it sends a REM message rem1 to its neighbors. When the neighbors (N2, N3, N5, and N10) receive rem1, benign neighbor N2 (N3, N5) searches its PFETs and sends the matched PFE by an EM message em1 (em2, em3) {“PFE”: N4,N1.Packet2,N6“(N4,N1.Packet2,N6)”} to the base station, but the accomplice N10 sends em4 {“PFE”: “(No Evidence)”} to the base station. After receiving all EM messages, the base station extracts all PFEs.
After tracing the routing path of a dropped packet by ECP, the base station can get two suspicious nodes and their relevant PFEs.Table 7
Collecting evidences message (CEM).
FieldDescriptionExpected-PFEThe PFE is expected by the base stationTable 8
Requesting evidence message (REM).
FieldDescriptionRequested-PFEThe PFE is requested by the sending nodeTable 9
Evidence message (EM).
FieldDescriptionPFEThe stored PFE is encrypted and signed bythe sending node, and it sends to the base station


### 4.3. Fusing PFEs

After the base station finds the suspicious nodes and collects their relevant PFEs by ECP, we propose an evidence fusion algorithm (EFA) to fuse these PFEs and detect malicious nodes.The evidence fusion is actually a voting process. For the suspicious nodesNk and Nm about Ni.Packetj, Nk’s neighbors send either PFE (Nk, Ni.Packetj, Nm) or PFE No Evidence to the base station. PFE (Nk, Ni.Packetj, Nm) means a neighbor witnesses Nk has forwarded Ni.Packetj to Nm, and it votes for Nk. PFE No Evidence means a neighbor regards Nk as the liar, and it votes for Nm. The number of votes for a node is represented as v, and vkvm is the number of votes for NkNm. Malicious neighbors may submit a faked PFE to vote for its accomplices. To mitigate the effects of the collusion among malicious nodes, we use nodes’ weights to multiply nodes’ votes. The weight of Ni is represented as ωi, and it is the ratio of Ni’s trust to the initial value, namely ωi=ti/T. The trust of Nii∈1,M is represented as ti, and the initial value of ti is T. The base station maintains a trust and weight table (TWT) to record the trusts and weights of all nodes.As the votes are weighted, the number of votes for a node is the sum of the weights of the neighbors that have voted for it. After fusing PFEs, the base station identifies the node with fewer votes as the liar and punishes it by decreasing its trust.For the dropped packetN1.Packet2 in Case 2 of Figure 7, the base station gets four PFEs {N2:N4,N1.Packet2,N6, N3:N4,N1.Packet2,N6, N5:N4,N1.Packet2,N6, N10:No Evidence }. N2, N3, and N5 witness that N4 has forwarded N1.Packet2 to N6, and they regard N4 as a benign node and vote for it. But N10 denies that N4 has forwarded the packet to N6, and it regards N6 as a benign node and votes for it. Because ω2, ω3, ω5, and ω10 are initialized as 1, v4=ω2+ω3+ω5=3 and v6=ω10=1. By comparing v4 with v6, the base station identifies N6 as the liar and decreases its trust.For a dropped packet, ECP traces its routing path to find two suspicious nodes and the relevant PFEs, and EFA fuses these PFEs to discover the liar and decreases its trust. After ECP traces all dropped packets and EFA punishes all liars over, the final trusts of nodes can be obtained. Based on the final nodes’ trusts, the K-means clustering is used to cluster nodes into two groups: malicious group (MG) and benign group (BG).As shown in Algorithm 1, EFDA contains three steps.(1)
Getting the dropped packet set: the base station divides the received packets into different groupsGi according to their source nodes (line 3–5) and sorts the packets according to their sequence numbers for each group (line 6-7). After grouping and sorting the received packets, the base station can find the dropped packet set, namely DPS (line 8–12).(2)
Collecting PFEs: for each dropped packet, the base stationS sends a TM message to the source node Ni to start a tracing process (line 14–15). The current node Ncur finds the successor Ns and continues the tracing process until the base station finds two suspicious nodes Nk, Nm (line 17–23). The base station collets PFEs about Nk, Nm to judge them (line 24–28).(3)
Fusing PFEs: for two suspicious nodes, the base station fuses their relevant PFEs to update their votes (line 29–35). The node with fewer votes is punished by decreasing its trust (line 36–41). Based on the final nodes’ trusts, the K-means clustering is used to cluster nodes to BG and MG (line 43).Algorithm 1: EFDA algorithm.
Input: RPS (Received Packet Set)Output: BG (Benign Group), MG (Malicious Group)(1)
InitializeBG=∅,MG=∅;Step1 Getting the dropped packet set:(2)
Initialize allGi=∅,DPS=∅ ;(3)
foreachNi.Packetj∈RPSdo(4)
Gi=Gi∪Ni.Packetj;(5)
end(6)
fori=1;i≤M;i ++ do(7)
Gi sorts inner Ni.Packetj in ascending order of j;(8)
forj=1;j≤jmax;j ++ do(9)
ifNi.Packetj∉Githen(10)
DPS=DPS∪Ni.Packetj;(11)
end(12)
end(13)
endStep2 Collecting PFEs:(14)
foreachNi.Packetj∈DPSdo(15)
S⟶TMNi, Process  =  Ni;(16)
Ncur  =  Ni;(17)
whileFind no suspicious nodesdo(18)
Ncur finds next forwarding node is Ns;(19)
Ncur⟶RMS, Ncur⟶TMNs;(20)
Ncur  =  Ns;(21)
Process  = Process∪Ns;(22)
end(23)
S finds two suspicious nodes Nk,Nm;(24)
S⟶CEMNk;(25)
Nk⟶REMNk′sneighbors;(26)
foreachneighbor∈Nk′sneighborsdo(27)
neighbor⟶PFES;(28)
endStep3 Fusing PFEs:(29)
foreachPFE∈PFEsdo(30)
ifPFE==Nk,Ni.Packetj,Nmthen(31)
Vk ++;(32)
else(33)
Vm ++;(34)
end(35)
end(36)
ifVk>Vmthen(37)
DecreaseNm’s trust;(38)
end(39)
ifVk<Vmthen(40)
DecreaseNk’s trust;(41)
end(42)
end(43)
Based on nodes’ trusts, K-means clusters nodes toBG and MG;(44)
return (BG, MG);


### 4.4. Algorithm Analysis

#### 4.4.1. Algorithm Complexity Analysis

According to the pseudocode in Algorithm 1, the proposed approach contains three steps: (1) getting the dropped packet set: in order to get the dropped packet set, EFDA needs to traverse the received packet setRPS. The complexity of the first step is O1=sizeRPS, where sizeRPS means to find the size of the set RPS. (2) Collecting PFEs: in order to collect PFEs, EFDA needs to traverse the dropped packet set DPS. For each dropped packet, EFDA needs to trace the routing path of the dropped packet. The complexity of the second step is O2=sizeDPS×sizePath, where Path means the traced routing path. (3) Fusing PFEs: in order to fuse PFEs, EFDA needs to traverse the PFEs for each dropped packet. The complexity of the third step is O3=sizeDPS×sizePFEs. Therefore, the complexity of EFDA is represented as O=O1+O2+O3=sizeRPS+sizeDPS×sizePath+sizePFEs.


#### 4.4.2. Algorithm Overheads Analysis

(1) Energy Overheads of EFDA. EFDA detects malicious nodes by tracing the routing paths of dropped packets. In addition, it can get the detection results in a limited number of dropped packets. We assume that the limited number of dropped packets is L. For each tracing process, considering the worst case, all nodes on the routing path need to send a TM message and a RM message. Only some specified nodes need to send an IM message, a REM message, or an EM message. Therefore, each node sends no more than 3 extra messages for one tracing process. Because EFDA needs to trace L dropped packets, each node sends no more than 3×L extra messages for one time detection. Moreover, since the sizes of the above messages are small, the energy overheads of sending them are small.(2) Storage Overheads of EFDA. In EFDA, each node needs to store the packet forwarding records and PFEs, and we estimate the storage overheads of EFDA to prove its feasibility. The storage overheads of a node are affected by the sizes of its PFRT and PFET. A general IoT device forwards 1200messages/minute according to the study in [27]. Assuming that EFDA is executed every hour to detect malicious nodes. During this period, there are 72000 messages forwarded and 72000 packet forwarding records stored by a node. For a packet forwarding record, it contains three fields, and its storage overheads are 3Bytes. The storage overheads of PFRT are 72000×3=216000Bytes≈210kB. For PFET, its capacity C (shown in Table 2) is approximate to the number of forwarded packets, namely 72000. For a PFE, it contains three fields, and its storage overheads are 3Bytes. The storage overheads of PFET are 72000×3=216000Bytes≈210kB. So, the storage overheads of a node are 210+210=420kB, which is far less than a general IoT device’s storage 2GB [28].


#### 4.4.3. Distinction between EFDA and ML-Based Algorithms

In this section, we analyze the distinction between EFDA and ML-based algorithms. For each injected packet, ML-based algorithms use it to calculate the trust of its routing path by mathematical reasoning. Then, they use the routing path’s trust to estimate the nodes’ trusts on the routing path. However, in order to estimate the nodes’ trusts more accurately, numerous packets need to be injected to get more routing path’s trusts, which are used as the input of the ML-based algorithms.On the contrary, EFDA detects malicious nodes without injecting packets. It can trace the routing path of each dropped packet and find the suspicious nodes. The PFEs around suspicious nodes are collected to the base station, and EFDA fuses them to find the malicious nodes. A potential constraint for EFDA is how to resist collusive attacks. Suppose that a benign node is surrounded by many malicious nodes, they submit faked PFEs that cause the base station to misidentify the benign node as a malicious node. A possible extension is to use the causal inference algorithm to solve the problem.


## 4.1. Getting the Dropped Packet Set

The source nodes collect data from the environment, encapsulate them into packets, and then upload the packets to the base station. After receiving the packets, the base station divides the received packets into different groupsGii∈1,M according to their source nodes Ni. For each group, the base station sorts the packets according to their sequence numbers. After grouping and sorting the received packets, the base station can find the dropped packets and their corresponding source nodes.As Figure5 shows, the base station divides the received packets into M groups and sorts the packets for each group. For the first group of the source node N1, the base station receives the packets with sequence number N1.Packet1, N1.Packet2, and N1.Packet4 except N1.Packet2. So it finds that N1.Packet2 is dropped. After checking all groups, the base station can obtain the dropped packet set.Figure 5
The process of getting the dropped packets set.


## 4.2. Collecting PFEs

After finding all the dropped packets, the base station traces the routing path of each dropped packet. In the process of tracing, the base station investigates the nodes on the routing path hop by hop. In the final hop, it can find two suspicious nodes that may drop the packet. To judge the suspicious nodes, PFEs about them are collected at the base station. We propose an evidence collection protocol (ECP) to trace the routing path and collecting PFEs.In order to assist ECP to trace the routing path of each dropped packet, each node in the network needs to generate records about its packet forwarding behaviors. Each node maintains a packet forwarding record table (PFRT) to store the records, which is shown in Table3. It contains three fields: Last Node, Packet-ID, and Next Node. Last Node means the last node that forwards the packet, Packet-ID means the identifier of the forwarded packet, and Next Node means the next node where the packet is forwarded. After a node receives a packet and forwards the packet to another node, it will update its PFRT to record the forwarding behavior.Table 3
Packet forwarding record table ofN4.
Last nodePacket-IDNext nodeN2N1.Packet2N6As shown in Figure6, during the transmission of the packet N1.Packet2, N4 receives the packet from N2 and forwards it to N6. To record this forwarding behavior, N4 inserts a record N2,N1.Packet2,N6 into its PFRT. Besides, malicious nodes may not update their PFRTs because they drop packets instead of forwarding them.Figure 6
An example of updating the PFRT.Based on the packet forwarding records stored by nodes, ECP can trace the routing path of each dropped packet. For a dropped packetNi.Packetj, the process of tracing the packet can be described as follows.The base station finds the dropped packetNi.Packetj and its corresponding source node Ni. It constructs a TM message (shown in Table 4) tm {“Packet-ID”: “Ni.Packetj”} and sends it to Ni. The message tm is used to ask Ni for the next forwarding node of Ni.Packetj. After that, the base station initializes the tracing progress as Ni. Once receiving tm, node Ni searches its PFRT for the packet forwarding record about the packet. It finds the next forwarding node is Ns. It constructs a RM message (shown in Table 5) rm {“Successor”: “Ns”} and sends it to the base station. The message rm is used to report the tracing progress to the base station. Besides, Ni forwards tm to Ns to ask it to continue to trace the routing path of the packet. When the base station receives rm, it updates the tracing progress as Ni⟶Ns. After receiving tm, node Ns repeats the operations like Ni to continue to trace the routing path. After several steps of tracing, the tracing progress is updated to Ni⟶Ns⟶⋯⟶Nk⟶Nm, and a malicious node Nm receives tm.Table 4
Tracing message (TM).
FieldDescriptionPacket-IDThe identifier of a dropped packetTable 5
Reporting message (RM).
FieldDescriptionSuccessorThe next forwarding node of the dropped packetAs shown in Figure7, the base station finds the dropped packet N1.Packet2 and its corresponding source node N1. Then, it sends a TM message tm to N1 and initializes the tracing progress as N1. Once receiving tm, node N1 searches its PFRT and finds the next forwarding node is N2. It sends a RM message rm1 to the base station and forwards tm to N2. When the base station receives rm1, it updates the tracing process as N1⟶N2. Once receiving tm, node N2 continues to trace the routing path of the packet. After several steps of tracing, the tracing progress is updated to N1⟶N2⟶N4⟶N6, and N6 receives tm from N4. We assume that node N6 is a malicious node.Figure 7
An example of ECP.When a malicious nodeNm receives tm, there are three possible cases as follows.Case 1.
The malicious node does not respond to the base station.
The continued tracing process is described as follows.
After receivingtm, the malicious node Nm does not respond to the base station. Once receiving no response from Nm, the base station identifies Nm as a malicious node.
As shown in Case1 of Figure 7, N6 has received tm from N4, but it does not respond to the base station. The base station identifies N6 as a malicious node.Case 2.
The malicious node responds that it has never received the packet forwarded by its predecessor.
The continued tracing process is described as follows:
After receivingtm, the malicious node Nm denies that it has received Ni.Packetj from Nk. So, it constructs an IM message (shown in Table 6) im {“Packet-ID”: “Ni.Packetj,” “Impeaching-Node”: “Nm,” “Impeached-Node”: “Nk”} and sends it to the base station. The message im is used to report the base station that Nm has never received Ni.Packetj from Nk. When the base station receives im, it finds a logic conflict between Nk and Nm. It identifies Nk and Nm as suspicious nodes.
As shown in Case2 of Figure 7, N6 denies that it has received N1.Packet2 from N4. Then, it sends an IM message im1 to the base station. After receiving im1, the base station identifies N4 and N6 as suspicious nodes.Table 6
Impeaching message (IM).
FieldDescriptionPacket-IDThe identifier of a dropped packetImpeaching-nodeThe node impeaches that impeached nodehas not forwarded the packet to itImpeached-nodeThe node is impeachedCase 3.
The malicious node responds that it has forwarded the packet to a neighbor, but actually not.
The continued tracing process is described as follows:
After receivingtm, the malicious node Nm lies that it has forwarded Ni.Packetj to Nn. So, it sends rm {“Successor”: “Nn”} to the base station. Besides, it forwards tm to Nn. When the base station receives rm, it updates the tracing progress as Ni⟶Ns⟶⋯⟶Nk⟶Nm⟶Nn. Once receiving tm, node Nn searches its PFRT but finds no packet forwarding record about Ni.Packetj. So, it sends im {“Packet-ID”: “Ni.Packetj,” “Impeaching-Node”: “Nn,” “Impeached-Node”: “Nm”} to the base station to deny that it has received Ni.Packetj from Nm. When the base station receives im, it finds a logic conflict between Nm and Nn. It identifies Nm and Nn as suspicious nodes.
As shown in Case3 of Figure 7, N6 lies that the next forwarding node is N8. It sends rm4 to the base station and forwards tm to N8. When the base station receives rm4, it updates the tracing progress as N1⟶N2⟶N4⟶N6⟶N8. Once receiving tm, node N8 sends im2 to the base station to deny that it has received N1.Packet2 from N6. When the base station receives im2, it identifies N6 and N8 as suspicious nodes.
After the tracing process of a dropped packet likeNi.Packetj, the base station can get two suspicious nodes like Nk and Nm (Nm and Nn). To find the liar in them, the base station needs to collect PFEs about them as follows.
Without loss of generality, we suppose the suspicious nodes areNk and Nm.
The base station constructs aCEM message (shown in Table 7) cem {“Expected-PFE”: “Nk,Ni.Packetj,Nm”} and sends it to the precursor Nk of the suspicious nodes. The message cem is used to collect PFEs. Once receiving cem, Nk constructs a REM message (shown in Table 8) rem {“Expected-PFE”: “Nk,Ni.Packetj,Nm”} and sends it to its neighbors. The message rem is used to request the neighbors to send the relevant PFEs to the base station. When each neighbor of Nk receives rem, it searches its PFET for the PFE. Once getting the matched PFE, each neighbor constructs an EM message (shown in Table 9) em {“PFE”: “Nk,Ni.Packetj,Nm”} and sends it to the base station. But, the accomplice does not submit correct PFE by sending em {”PFE”: “(No Evidence)”} or submits a faked PFE to the base station. After receiving all EM messages, the base station extracts the PFEs in them.
As shown in Case2 of Figure 7, the base station finds the suspicious nodes N4 and N6. It sends a CEM message cem1 to the precursor N4. Once N4 receives cem1, it sends a REM message rem1 to its neighbors. When the neighbors (N2, N3, N5, and N10) receive rem1, benign neighbor N2 (N3, N5) searches its PFETs and sends the matched PFE by an EM message em1 (em2, em3) {“PFE”: N4,N1.Packet2,N6“(N4,N1.Packet2,N6)”} to the base station, but the accomplice N10 sends em4 {“PFE”: “(No Evidence)”} to the base station. After receiving all EM messages, the base station extracts all PFEs.
After tracing the routing path of a dropped packet by ECP, the base station can get two suspicious nodes and their relevant PFEs.Table 7
Collecting evidences message (CEM).
FieldDescriptionExpected-PFEThe PFE is expected by the base stationTable 8
Requesting evidence message (REM).
FieldDescriptionRequested-PFEThe PFE is requested by the sending nodeTable 9
Evidence message (EM).
FieldDescriptionPFEThe stored PFE is encrypted and signed bythe sending node, and it sends to the base station


## 4.3. Fusing PFEs

After the base station finds the suspicious nodes and collects their relevant PFEs by ECP, we propose an evidence fusion algorithm (EFA) to fuse these PFEs and detect malicious nodes.The evidence fusion is actually a voting process. For the suspicious nodesNk and Nm about Ni.Packetj, Nk’s neighbors send either PFE (Nk, Ni.Packetj, Nm) or PFE No Evidence to the base station. PFE (Nk, Ni.Packetj, Nm) means a neighbor witnesses Nk has forwarded Ni.Packetj to Nm, and it votes for Nk. PFE No Evidence means a neighbor regards Nk as the liar, and it votes for Nm. The number of votes for a node is represented as v, and vkvm is the number of votes for NkNm. Malicious neighbors may submit a faked PFE to vote for its accomplices. To mitigate the effects of the collusion among malicious nodes, we use nodes’ weights to multiply nodes’ votes. The weight of Ni is represented as ωi, and it is the ratio of Ni’s trust to the initial value, namely ωi=ti/T. The trust of Nii∈1,M is represented as ti, and the initial value of ti is T. The base station maintains a trust and weight table (TWT) to record the trusts and weights of all nodes.As the votes are weighted, the number of votes for a node is the sum of the weights of the neighbors that have voted for it. After fusing PFEs, the base station identifies the node with fewer votes as the liar and punishes it by decreasing its trust.For the dropped packetN1.Packet2 in Case 2 of Figure 7, the base station gets four PFEs {N2:N4,N1.Packet2,N6, N3:N4,N1.Packet2,N6, N5:N4,N1.Packet2,N6, N10:No Evidence }. N2, N3, and N5 witness that N4 has forwarded N1.Packet2 to N6, and they regard N4 as a benign node and vote for it. But N10 denies that N4 has forwarded the packet to N6, and it regards N6 as a benign node and votes for it. Because ω2, ω3, ω5, and ω10 are initialized as 1, v4=ω2+ω3+ω5=3 and v6=ω10=1. By comparing v4 with v6, the base station identifies N6 as the liar and decreases its trust.For a dropped packet, ECP traces its routing path to find two suspicious nodes and the relevant PFEs, and EFA fuses these PFEs to discover the liar and decreases its trust. After ECP traces all dropped packets and EFA punishes all liars over, the final trusts of nodes can be obtained. Based on the final nodes’ trusts, the K-means clustering is used to cluster nodes into two groups: malicious group (MG) and benign group (BG).As shown in Algorithm 1, EFDA contains three steps.(1)
Getting the dropped packet set: the base station divides the received packets into different groupsGi according to their source nodes (line 3–5) and sorts the packets according to their sequence numbers for each group (line 6-7). After grouping and sorting the received packets, the base station can find the dropped packet set, namely DPS (line 8–12).(2)
Collecting PFEs: for each dropped packet, the base stationS sends a TM message to the source node Ni to start a tracing process (line 14–15). The current node Ncur finds the successor Ns and continues the tracing process until the base station finds two suspicious nodes Nk, Nm (line 17–23). The base station collets PFEs about Nk, Nm to judge them (line 24–28).(3)
Fusing PFEs: for two suspicious nodes, the base station fuses their relevant PFEs to update their votes (line 29–35). The node with fewer votes is punished by decreasing its trust (line 36–41). Based on the final nodes’ trusts, the K-means clustering is used to cluster nodes to BG and MG (line 43).Algorithm 1: EFDA algorithm.
Input: RPS (Received Packet Set)Output: BG (Benign Group), MG (Malicious Group)(1)
InitializeBG=∅,MG=∅;Step1 Getting the dropped packet set:(2)
Initialize allGi=∅,DPS=∅ ;(3)
foreachNi.Packetj∈RPSdo(4)
Gi=Gi∪Ni.Packetj;(5)
end(6)
fori=1;i≤M;i ++ do(7)
Gi sorts inner Ni.Packetj in ascending order of j;(8)
forj=1;j≤jmax;j ++ do(9)
ifNi.Packetj∉Githen(10)
DPS=DPS∪Ni.Packetj;(11)
end(12)
end(13)
endStep2 Collecting PFEs:(14)
foreachNi.Packetj∈DPSdo(15)
S⟶TMNi, Process  =  Ni;(16)
Ncur  =  Ni;(17)
whileFind no suspicious nodesdo(18)
Ncur finds next forwarding node is Ns;(19)
Ncur⟶RMS, Ncur⟶TMNs;(20)
Ncur  =  Ns;(21)
Process  = Process∪Ns;(22)
end(23)
S finds two suspicious nodes Nk,Nm;(24)
S⟶CEMNk;(25)
Nk⟶REMNk′sneighbors;(26)
foreachneighbor∈Nk′sneighborsdo(27)
neighbor⟶PFES;(28)
endStep3 Fusing PFEs:(29)
foreachPFE∈PFEsdo(30)
ifPFE==Nk,Ni.Packetj,Nmthen(31)
Vk ++;(32)
else(33)
Vm ++;(34)
end(35)
end(36)
ifVk>Vmthen(37)
DecreaseNm’s trust;(38)
end(39)
ifVk<Vmthen(40)
DecreaseNk’s trust;(41)
end(42)
end(43)
Based on nodes’ trusts, K-means clusters nodes toBG and MG;(44)
return (BG, MG);


## 4.4. Algorithm Analysis

### 4.4.1. Algorithm Complexity Analysis

According to the pseudocode in Algorithm 1, the proposed approach contains three steps: (1) getting the dropped packet set: in order to get the dropped packet set, EFDA needs to traverse the received packet setRPS. The complexity of the first step is O1=sizeRPS, where sizeRPS means to find the size of the set RPS. (2) Collecting PFEs: in order to collect PFEs, EFDA needs to traverse the dropped packet set DPS. For each dropped packet, EFDA needs to trace the routing path of the dropped packet. The complexity of the second step is O2=sizeDPS×sizePath, where Path means the traced routing path. (3) Fusing PFEs: in order to fuse PFEs, EFDA needs to traverse the PFEs for each dropped packet. The complexity of the third step is O3=sizeDPS×sizePFEs. Therefore, the complexity of EFDA is represented as O=O1+O2+O3=sizeRPS+sizeDPS×sizePath+sizePFEs.


### 4.4.2. Algorithm Overheads Analysis

(1) Energy Overheads of EFDA. EFDA detects malicious nodes by tracing the routing paths of dropped packets. In addition, it can get the detection results in a limited number of dropped packets. We assume that the limited number of dropped packets is L. For each tracing process, considering the worst case, all nodes on the routing path need to send a TM message and a RM message. Only some specified nodes need to send an IM message, a REM message, or an EM message. Therefore, each node sends no more than 3 extra messages for one tracing process. Because EFDA needs to trace L dropped packets, each node sends no more than 3×L extra messages for one time detection. Moreover, since the sizes of the above messages are small, the energy overheads of sending them are small.(2) Storage Overheads of EFDA. In EFDA, each node needs to store the packet forwarding records and PFEs, and we estimate the storage overheads of EFDA to prove its feasibility. The storage overheads of a node are affected by the sizes of its PFRT and PFET. A general IoT device forwards 1200messages/minute according to the study in [27]. Assuming that EFDA is executed every hour to detect malicious nodes. During this period, there are 72000 messages forwarded and 72000 packet forwarding records stored by a node. For a packet forwarding record, it contains three fields, and its storage overheads are 3Bytes. The storage overheads of PFRT are 72000×3=216000Bytes≈210kB. For PFET, its capacity C (shown in Table 2) is approximate to the number of forwarded packets, namely 72000. For a PFE, it contains three fields, and its storage overheads are 3Bytes. The storage overheads of PFET are 72000×3=216000Bytes≈210kB. So, the storage overheads of a node are 210+210=420kB, which is far less than a general IoT device’s storage 2GB [28].


### 4.4.3. Distinction between EFDA and ML-Based Algorithms

In this section, we analyze the distinction between EFDA and ML-based algorithms. For each injected packet, ML-based algorithms use it to calculate the trust of its routing path by mathematical reasoning. Then, they use the routing path’s trust to estimate the nodes’ trusts on the routing path. However, in order to estimate the nodes’ trusts more accurately, numerous packets need to be injected to get more routing path’s trusts, which are used as the input of the ML-based algorithms.On the contrary, EFDA detects malicious nodes without injecting packets. It can trace the routing path of each dropped packet and find the suspicious nodes. The PFEs around suspicious nodes are collected to the base station, and EFDA fuses them to find the malicious nodes. A potential constraint for EFDA is how to resist collusive attacks. Suppose that a benign node is surrounded by many malicious nodes, they submit faked PFEs that cause the base station to misidentify the benign node as a malicious node. A possible extension is to use the causal inference algorithm to solve the problem.


## 4.4.1. Algorithm Complexity Analysis

According to the pseudocode in Algorithm 1, the proposed approach contains three steps: (1) getting the dropped packet set: in order to get the dropped packet set, EFDA needs to traverse the received packet setRPS. The complexity of the first step is O1=sizeRPS, where sizeRPS means to find the size of the set RPS. (2) Collecting PFEs: in order to collect PFEs, EFDA needs to traverse the dropped packet set DPS. For each dropped packet, EFDA needs to trace the routing path of the dropped packet. The complexity of the second step is O2=sizeDPS×sizePath, where Path means the traced routing path. (3) Fusing PFEs: in order to fuse PFEs, EFDA needs to traverse the PFEs for each dropped packet. The complexity of the third step is O3=sizeDPS×sizePFEs. Therefore, the complexity of EFDA is represented as O=O1+O2+O3=sizeRPS+sizeDPS×sizePath+sizePFEs.


## 4.4.2. Algorithm Overheads Analysis

(1) Energy Overheads of EFDA. EFDA detects malicious nodes by tracing the routing paths of dropped packets. In addition, it can get the detection results in a limited number of dropped packets. We assume that the limited number of dropped packets is L. For each tracing process, considering the worst case, all nodes on the routing path need to send a TM message and a RM message. Only some specified nodes need to send an IM message, a REM message, or an EM message. Therefore, each node sends no more than 3 extra messages for one tracing process. Because EFDA needs to trace L dropped packets, each node sends no more than 3×L extra messages for one time detection. Moreover, since the sizes of the above messages are small, the energy overheads of sending them are small.(2) Storage Overheads of EFDA. In EFDA, each node needs to store the packet forwarding records and PFEs, and we estimate the storage overheads of EFDA to prove its feasibility. The storage overheads of a node are affected by the sizes of its PFRT and PFET. A general IoT device forwards 1200messages/minute according to the study in [27]. Assuming that EFDA is executed every hour to detect malicious nodes. During this period, there are 72000 messages forwarded and 72000 packet forwarding records stored by a node. For a packet forwarding record, it contains three fields, and its storage overheads are 3Bytes. The storage overheads of PFRT are 72000×3=216000Bytes≈210kB. For PFET, its capacity C (shown in Table 2) is approximate to the number of forwarded packets, namely 72000. For a PFE, it contains three fields, and its storage overheads are 3Bytes. The storage overheads of PFET are 72000×3=216000Bytes≈210kB. So, the storage overheads of a node are 210+210=420kB, which is far less than a general IoT device’s storage 2GB [28].


## 4.4.3. Distinction between EFDA and ML-Based Algorithms

In this section, we analyze the distinction between EFDA and ML-based algorithms. For each injected packet, ML-based algorithms use it to calculate the trust of its routing path by mathematical reasoning. Then, they use the routing path’s trust to estimate the nodes’ trusts on the routing path. However, in order to estimate the nodes’ trusts more accurately, numerous packets need to be injected to get more routing path’s trusts, which are used as the input of the ML-based algorithms.On the contrary, EFDA detects malicious nodes without injecting packets. It can trace the routing path of each dropped packet and find the suspicious nodes. The PFEs around suspicious nodes are collected to the base station, and EFDA fuses them to find the malicious nodes. A potential constraint for EFDA is how to resist collusive attacks. Suppose that a benign node is surrounded by many malicious nodes, they submit faked PFEs that cause the base station to misidentify the benign node as a malicious node. A possible extension is to use the causal inference algorithm to solve the problem.


## 5. Performance Evaluation

In this section, we evaluate the performance of our proposed EFDA and compare it with two typical ML-based algorithms, namely HD [20] and PDE [21].Both HD and PDE need to inject numerous labeled packets into the network and collect them at the base station. Each labeled packet has a routing path, and each routing path has abundant labeled packets. For each routing path, not all labeled packets on the routing path can be collected by the base station due to the malicious nodes. HD and PDE define the trust of the routing path as a ratio, which is the number of collected labeled packets to the total number of labeled packets on the routing path. According to whether a node is on the routing path, the relationship between the trust of nodes and the trust of the routing path can be formalized as a mathematical equation. The mathematical equation can be solved by machine learning algorithms, and the trust of nodes can be obtained. Based on the trust of nodes, the clustering algorithm classifies them into benign group and malicious group.We evaluate accuracy and error rate to compare detection performance. As shown in Table10, the accuracy is defined as Pa=TP+TN/P+N, and the error rate is defined as Fa=FP/FP+TN.Table 10
Experimental evaluation.
Detection resultNegativePositiveTotalActual resultNegativeTrue positive (TP)False negative (FN)P (actual negative)PositiveFalse positive (FP)True negative (TN)N (actual positive)TotalP′ (detect negative)N′ (detect positive)P + N


### 5.1. Experimental Environment

#### 5.1.1. Environmental Settings

In our environment, all nodes are evenly distributed in a rectangle area of100×100m2, and each node’s communication range is 10m. Our IoT network is generated randomly, and there is at least one routing path from each source node to the base station.To avoid bias, we run our simulation for each experiment in 10 rounds with 10 different networks generated randomly. The average value of 10 rounds’ result is calculated as the final experimental result of each experiment. In particular, we use the simulator in [21] and add our EFDA to it. Both EFDA and the ML-based algorithms are deployed at the base station.


#### 5.1.2. Environmental Variables

In the following experiments, we investigate the impact of the variables (shown in Table11) on the detection performance. Unless otherwise specified, all experimental variables will remain the default, which is set as follows.Table 11
Variables and description.
VariablesDescriptionThe number of uploaded packetsThe number of packets that are uploaded to the base station will influence the detection accuracyThe number of nodesIt means the number of nodes deployed in the network, which can affect the scale of the network and the detection accuracyThe percentage of malicious nodesIt means that how many nodes are malicious in the network, which can affect the detection resultThe probability of attackMalicious nodes launch the packet-dropping attack with a probability, and less probability means that the node is more difficult to be detected. It can influence the detection accuracyThe diversity of networkIt essentially indicates the ratio of available routing paths that could be chosen by source nodes to upload packets. The diversity of network reflects the routing paths’ complexity, and it influences the detection accuracyThe number of uploaded packets is 500. The number of nodes is 15. The probability of an attack is 0.3. The percentage of malicious nodes is 0.3. The diversity of the network is 1.


### 5.2. HD vs PDE vs EFDA

In this section, we explore the performance comparison among HD, PDE, and EFDA through experiments.


#### 5.2.1. Impact of the Number of Uploaded Packets

The results in Figure8 show that EFDA performs better than HD and PDE. When the number of uploaded packets is small, HD and PDE get a low Pa. As the number of uploaded packets increases, HD and PDE can get a higher Pa. EFDA gets a stale Pa in all cases. This is because as the number of uploaded packets increases, HD and PDE can calculate more routing path’s trust to estimate nodes’ trusts. Once more collected information is used to estimate nodes’ trusts, HD and PDE can get more exact nodes’ trusts and get more accurate detection results. EFDA can trace the routing path to find the suspicious nodes and detect malicious nodes in a smaller detection range. EFDA hardly needs abundant routing path’s information to estimate nodes’ trusts, so it can get a stable detection results.Figure 8
The impact of the number of uploaded packets. (a) Impact of the number of uploaded packets onPa. (b) Impact of the number of uploaded packets on Fa.
(a)(b)


#### 5.2.2. Impact of the Number of Nodes

The results in Figure9 show that when the number of nodes is small, all algorithms get a high Pa and a low Fa; but when the number of nodes increases, the accuracy Pa of all algorithms decreases, and the error rate Fa of them increases. EFDA still performs better than HD and PDE in all cases. This is because when the number of nodes is 5, the network topology is simple, and malicious nodes are more easily to be detected; when the number of nodes increases and the network topology becomes more complex, the malicious nodes are more likely to hide their abnormal behaviors, and it is difficult to identify all malicious nodes. However, no matter how complex the network topology becomes, EFDA still reaches higher accuracy than HD and PDE.Figure 9
The impact of the number of nodes. (a) Impact of the number of nodes onPa. (b) Impact of the number of nodes on Fa.
(a)(b)


#### 5.2.3. Impact of the Percentage of Malicious Nodes

The results in Figure10 show that EFDA gets the better results than the other two detection algorithms; but with the percentage of malicious nodes increases, the accuracy Pa of EFDA is getting lower and the error rate Fa of EFDA is getting higher, while the trends of HD and PD remain stable. This is because when the percentage of malicious nodes increases, the number of malicious nodes in the network will also increase that leads to more malicious nodes cooperate to resist EFDA. Assuming that most of the neighbors around a benign node are malicious, the malicious neighbors vote for its accomplice, which causes the benign node to be misidentified as the liar, and its trust is decreased by EFDA. Because EFDA misidentified the benign node as a malicious node, it gets a lower Pa and a higher Fa. Although we have optimizations for the collusion among malicious nodes, it is difficult to resist the collusion attacks from many malicious nodes.Figure 10
The impact of the percentage of malicious nodes. (a) Impact of the percentage of malicious nodes onPa. (b) Impact of the percentage of malicious nodes on Fa.
(a)(b)


#### 5.2.4. Impact of the Probability of Attack

The results in Figure11 show that EFDA performs better than HD and PDE. When the probability of attack is small, EFDA gets a small Pa and a large Fa. However, when the probability of attack increases, the accuracy Pa of EFDA begins to increase, and the error rate Fa of EFDA begins to decrease. The trends of HD and PDE are similar, but their accuracy Pa is lower than that of EFDA, and their error rate Fa is higher than that of EFDA. This is because when the probability of attack is small, malicious nodes intend to hide their attack behaviors that make EFDA more difficult to detect them. However, when the probability of attack becomes larger, malicious nodes are more likely to launch a packet dropping attack that makes EFDA find more dropped packets. EFDA traces more routing paths of the dropped packets and finds more suspicious nodes, and it gets more accurate detection results.Figure 11
The impact of the probability of attack. (a) Impact of the probability of attack onPa. (b) Impact of the probability of attack on Fa.
(a)(b)


#### 5.2.5. Impact of the Diversity of Network

The results in Figure12 show that when the diversity of network is low, both HD and PDE get a low Pa and a high Fa. With the diversity of network increases, their accuracy Pa becomes higher, and their error rate Fa becomes lower. However, EFDA gets stable accuracy Pa and error rate Fa in all cases, and they are better than those of HD and PDE. This is because when the diversity of network is low, there are few routing paths for source nodes to upload packets to the base station. It means HD and PDE obtain few routing paths’ information to estimate the nodes’ trusts, and that causes HD and PDE to get the inaccurate nodes’ trusts. Therefore, they get negative detection results. As the diversity of network becomes larger, HD and PDE obtain more routing paths’ information to estimate the nodes’ trusts, and they get positive detection results. However, EFDA does not need more different routing paths’ information to estimate the nodes’ trusts. It can trace the path of dropped packet and accurately find the suspicious nodes on the path, and it only decreases the liar’s trust. So, EFDA detects malicious nodes more efficiently than HD and PDE.Figure 12
The impact of the diversity of network. (a) Impact of the diversity of network onPa. (b) Impact of the diversity of network on Fa.
(a)(b)


### 5.3. Discussion and Limitations

In the experiments, we explore the performance comparison between HD, PDE, and EFDA on five variables, which are the number of uploaded packets, the number of nodes, the percentage of malicious nodes, the probability of attack, and the diversity of the network. Overall, it is observed that EFDA can achieve better detection performance compared with HD and PDE. EFDA can improve the detection rate by around20% to 30%.Although EFDA performs better than HD and PDE, there are some limitations that can be addressed in our future work. When the percentage of malicious nodes exceeds50%, the detection performance of EFDA declines significantly, which indicates that EFDA is difficult to resist the collusion of numerous malicious nodes. In our future work, we plan to investigate how to resist the collusion of numerous malicious nodes.


## 5.1. Experimental Environment

### 5.1.1. Environmental Settings

In our environment, all nodes are evenly distributed in a rectangle area of100×100m2, and each node’s communication range is 10m. Our IoT network is generated randomly, and there is at least one routing path from each source node to the base station.To avoid bias, we run our simulation for each experiment in 10 rounds with 10 different networks generated randomly. The average value of 10 rounds’ result is calculated as the final experimental result of each experiment. In particular, we use the simulator in [21] and add our EFDA to it. Both EFDA and the ML-based algorithms are deployed at the base station.


### 5.1.2. Environmental Variables

In the following experiments, we investigate the impact of the variables (shown in Table11) on the detection performance. Unless otherwise specified, all experimental variables will remain the default, which is set as follows.Table 11
Variables and description.
VariablesDescriptionThe number of uploaded packetsThe number of packets that are uploaded to the base station will influence the detection accuracyThe number of nodesIt means the number of nodes deployed in the network, which can affect the scale of the network and the detection accuracyThe percentage of malicious nodesIt means that how many nodes are malicious in the network, which can affect the detection resultThe probability of attackMalicious nodes launch the packet-dropping attack with a probability, and less probability means that the node is more difficult to be detected. It can influence the detection accuracyThe diversity of networkIt essentially indicates the ratio of available routing paths that could be chosen by source nodes to upload packets. The diversity of network reflects the routing paths’ complexity, and it influences the detection accuracyThe number of uploaded packets is 500. The number of nodes is 15. The probability of an attack is 0.3. The percentage of malicious nodes is 0.3. The diversity of the network is 1.


## 5.1.1. Environmental Settings

In our environment, all nodes are evenly distributed in a rectangle area of100×100m2, and each node’s communication range is 10m. Our IoT network is generated randomly, and there is at least one routing path from each source node to the base station.To avoid bias, we run our simulation for each experiment in 10 rounds with 10 different networks generated randomly. The average value of 10 rounds’ result is calculated as the final experimental result of each experiment. In particular, we use the simulator in [21] and add our EFDA to it. Both EFDA and the ML-based algorithms are deployed at the base station.


## 5.1.2. Environmental Variables

In the following experiments, we investigate the impact of the variables (shown in Table11) on the detection performance. Unless otherwise specified, all experimental variables will remain the default, which is set as follows.Table 11
Variables and description.
VariablesDescriptionThe number of uploaded packetsThe number of packets that are uploaded to the base station will influence the detection accuracyThe number of nodesIt means the number of nodes deployed in the network, which can affect the scale of the network and the detection accuracyThe percentage of malicious nodesIt means that how many nodes are malicious in the network, which can affect the detection resultThe probability of attackMalicious nodes launch the packet-dropping attack with a probability, and less probability means that the node is more difficult to be detected. It can influence the detection accuracyThe diversity of networkIt essentially indicates the ratio of available routing paths that could be chosen by source nodes to upload packets. The diversity of network reflects the routing paths’ complexity, and it influences the detection accuracyThe number of uploaded packets is 500. The number of nodes is 15. The probability of an attack is 0.3. The percentage of malicious nodes is 0.3. The diversity of the network is 1.


## 5.2. HD vs PDE vs EFDA

In this section, we explore the performance comparison among HD, PDE, and EFDA through experiments.


### 5.2.1. Impact of the Number of Uploaded Packets

The results in Figure8 show that EFDA performs better than HD and PDE. When the number of uploaded packets is small, HD and PDE get a low Pa. As the number of uploaded packets increases, HD and PDE can get a higher Pa. EFDA gets a stale Pa in all cases. This is because as the number of uploaded packets increases, HD and PDE can calculate more routing path’s trust to estimate nodes’ trusts. Once more collected information is used to estimate nodes’ trusts, HD and PDE can get more exact nodes’ trusts and get more accurate detection results. EFDA can trace the routing path to find the suspicious nodes and detect malicious nodes in a smaller detection range. EFDA hardly needs abundant routing path’s information to estimate nodes’ trusts, so it can get a stable detection results.Figure 8
The impact of the number of uploaded packets. (a) Impact of the number of uploaded packets onPa. (b) Impact of the number of uploaded packets on Fa.
(a)(b)


### 5.2.2. Impact of the Number of Nodes

The results in Figure9 show that when the number of nodes is small, all algorithms get a high Pa and a low Fa; but when the number of nodes increases, the accuracy Pa of all algorithms decreases, and the error rate Fa of them increases. EFDA still performs better than HD and PDE in all cases. This is because when the number of nodes is 5, the network topology is simple, and malicious nodes are more easily to be detected; when the number of nodes increases and the network topology becomes more complex, the malicious nodes are more likely to hide their abnormal behaviors, and it is difficult to identify all malicious nodes. However, no matter how complex the network topology becomes, EFDA still reaches higher accuracy than HD and PDE.Figure 9
The impact of the number of nodes. (a) Impact of the number of nodes onPa. (b) Impact of the number of nodes on Fa.
(a)(b)


### 5.2.3. Impact of the Percentage of Malicious Nodes

The results in Figure10 show that EFDA gets the better results than the other two detection algorithms; but with the percentage of malicious nodes increases, the accuracy Pa of EFDA is getting lower and the error rate Fa of EFDA is getting higher, while the trends of HD and PD remain stable. This is because when the percentage of malicious nodes increases, the number of malicious nodes in the network will also increase that leads to more malicious nodes cooperate to resist EFDA. Assuming that most of the neighbors around a benign node are malicious, the malicious neighbors vote for its accomplice, which causes the benign node to be misidentified as the liar, and its trust is decreased by EFDA. Because EFDA misidentified the benign node as a malicious node, it gets a lower Pa and a higher Fa. Although we have optimizations for the collusion among malicious nodes, it is difficult to resist the collusion attacks from many malicious nodes.Figure 10
The impact of the percentage of malicious nodes. (a) Impact of the percentage of malicious nodes onPa. (b) Impact of the percentage of malicious nodes on Fa.
(a)(b)


### 5.2.4. Impact of the Probability of Attack

The results in Figure11 show that EFDA performs better than HD and PDE. When the probability of attack is small, EFDA gets a small Pa and a large Fa. However, when the probability of attack increases, the accuracy Pa of EFDA begins to increase, and the error rate Fa of EFDA begins to decrease. The trends of HD and PDE are similar, but their accuracy Pa is lower than that of EFDA, and their error rate Fa is higher than that of EFDA. This is because when the probability of attack is small, malicious nodes intend to hide their attack behaviors that make EFDA more difficult to detect them. However, when the probability of attack becomes larger, malicious nodes are more likely to launch a packet dropping attack that makes EFDA find more dropped packets. EFDA traces more routing paths of the dropped packets and finds more suspicious nodes, and it gets more accurate detection results.Figure 11
The impact of the probability of attack. (a) Impact of the probability of attack onPa. (b) Impact of the probability of attack on Fa.
(a)(b)


### 5.2.5. Impact of the Diversity of Network

The results in Figure12 show that when the diversity of network is low, both HD and PDE get a low Pa and a high Fa. With the diversity of network increases, their accuracy Pa becomes higher, and their error rate Fa becomes lower. However, EFDA gets stable accuracy Pa and error rate Fa in all cases, and they are better than those of HD and PDE. This is because when the diversity of network is low, there are few routing paths for source nodes to upload packets to the base station. It means HD and PDE obtain few routing paths’ information to estimate the nodes’ trusts, and that causes HD and PDE to get the inaccurate nodes’ trusts. Therefore, they get negative detection results. As the diversity of network becomes larger, HD and PDE obtain more routing paths’ information to estimate the nodes’ trusts, and they get positive detection results. However, EFDA does not need more different routing paths’ information to estimate the nodes’ trusts. It can trace the path of dropped packet and accurately find the suspicious nodes on the path, and it only decreases the liar’s trust. So, EFDA detects malicious nodes more efficiently than HD and PDE.Figure 12
The impact of the diversity of network. (a) Impact of the diversity of network onPa. (b) Impact of the diversity of network on Fa.
(a)(b)


## 5.2.1. Impact of the Number of Uploaded Packets

The results in Figure8 show that EFDA performs better than HD and PDE. When the number of uploaded packets is small, HD and PDE get a low Pa. As the number of uploaded packets increases, HD and PDE can get a higher Pa. EFDA gets a stale Pa in all cases. This is because as the number of uploaded packets increases, HD and PDE can calculate more routing path’s trust to estimate nodes’ trusts. Once more collected information is used to estimate nodes’ trusts, HD and PDE can get more exact nodes’ trusts and get more accurate detection results. EFDA can trace the routing path to find the suspicious nodes and detect malicious nodes in a smaller detection range. EFDA hardly needs abundant routing path’s information to estimate nodes’ trusts, so it can get a stable detection results.Figure 8
The impact of the number of uploaded packets. (a) Impact of the number of uploaded packets onPa. (b) Impact of the number of uploaded packets on Fa.
(a)(b)


## 5.2.2. Impact of the Number of Nodes

The results in Figure9 show that when the number of nodes is small, all algorithms get a high Pa and a low Fa; but when the number of nodes increases, the accuracy Pa of all algorithms decreases, and the error rate Fa of them increases. EFDA still performs better than HD and PDE in all cases. This is because when the number of nodes is 5, the network topology is simple, and malicious nodes are more easily to be detected; when the number of nodes increases and the network topology becomes more complex, the malicious nodes are more likely to hide their abnormal behaviors, and it is difficult to identify all malicious nodes. However, no matter how complex the network topology becomes, EFDA still reaches higher accuracy than HD and PDE.Figure 9
The impact of the number of nodes. (a) Impact of the number of nodes onPa. (b) Impact of the number of nodes on Fa.
(a)(b)


## 5.2.3. Impact of the Percentage of Malicious Nodes

The results in Figure10 show that EFDA gets the better results than the other two detection algorithms; but with the percentage of malicious nodes increases, the accuracy Pa of EFDA is getting lower and the error rate Fa of EFDA is getting higher, while the trends of HD and PD remain stable. This is because when the percentage of malicious nodes increases, the number of malicious nodes in the network will also increase that leads to more malicious nodes cooperate to resist EFDA. Assuming that most of the neighbors around a benign node are malicious, the malicious neighbors vote for its accomplice, which causes the benign node to be misidentified as the liar, and its trust is decreased by EFDA. Because EFDA misidentified the benign node as a malicious node, it gets a lower Pa and a higher Fa. Although we have optimizations for the collusion among malicious nodes, it is difficult to resist the collusion attacks from many malicious nodes.Figure 10
The impact of the percentage of malicious nodes. (a) Impact of the percentage of malicious nodes onPa. (b) Impact of the percentage of malicious nodes on Fa.
(a)(b)


## 5.2.4. Impact of the Probability of Attack

The results in Figure11 show that EFDA performs better than HD and PDE. When the probability of attack is small, EFDA gets a small Pa and a large Fa. However, when the probability of attack increases, the accuracy Pa of EFDA begins to increase, and the error rate Fa of EFDA begins to decrease. The trends of HD and PDE are similar, but their accuracy Pa is lower than that of EFDA, and their error rate Fa is higher than that of EFDA. This is because when the probability of attack is small, malicious nodes intend to hide their attack behaviors that make EFDA more difficult to detect them. However, when the probability of attack becomes larger, malicious nodes are more likely to launch a packet dropping attack that makes EFDA find more dropped packets. EFDA traces more routing paths of the dropped packets and finds more suspicious nodes, and it gets more accurate detection results.Figure 11
The impact of the probability of attack. (a) Impact of the probability of attack onPa. (b) Impact of the probability of attack on Fa.
(a)(b)


## 5.2.5. Impact of the Diversity of Network

The results in Figure12 show that when the diversity of network is low, both HD and PDE get a low Pa and a high Fa. With the diversity of network increases, their accuracy Pa becomes higher, and their error rate Fa becomes lower. However, EFDA gets stable accuracy Pa and error rate Fa in all cases, and they are better than those of HD and PDE. This is because when the diversity of network is low, there are few routing paths for source nodes to upload packets to the base station. It means HD and PDE obtain few routing paths’ information to estimate the nodes’ trusts, and that causes HD and PDE to get the inaccurate nodes’ trusts. Therefore, they get negative detection results. As the diversity of network becomes larger, HD and PDE obtain more routing paths’ information to estimate the nodes’ trusts, and they get positive detection results. However, EFDA does not need more different routing paths’ information to estimate the nodes’ trusts. It can trace the path of dropped packet and accurately find the suspicious nodes on the path, and it only decreases the liar’s trust. So, EFDA detects malicious nodes more efficiently than HD and PDE.Figure 12
The impact of the diversity of network. (a) Impact of the diversity of network onPa. (b) Impact of the diversity of network on Fa.
(a)(b)


## 5.3. Discussion and Limitations

In the experiments, we explore the performance comparison between HD, PDE, and EFDA on five variables, which are the number of uploaded packets, the number of nodes, the percentage of malicious nodes, the probability of attack, and the diversity of the network. Overall, it is observed that EFDA can achieve better detection performance compared with HD and PDE. EFDA can improve the detection rate by around20% to 30%.Although EFDA performs better than HD and PDE, there are some limitations that can be addressed in our future work. When the percentage of malicious nodes exceeds50%, the detection performance of EFDA declines significantly, which indicates that EFDA is difficult to resist the collusion of numerous malicious nodes. In our future work, we plan to investigate how to resist the collusion of numerous malicious nodes.


## 6. Conclusion

Due to the distributed nature of the IoT networks, they are vulnerable to the packet-dropping attack. There are abundant detection algorithms to detect the packet dropping attack; however, most of them are heavyweight for the resource-constrained IoT network. In this paper, we propose a lightweight evidence fusion-based detection algorithm, namely EFDA. It uses packet forwarding evidence to detect malicious nodes. In EFDA, the received packets are grouped and sorted to find the dropped packets. For each dropped packet, the base station traces its routing path, finds the suspicious nodes, and collects evidence. The collected evidences are fused to find the liar, and EFDA punishes the liar by decreasing its trust. Based on nodes’ trusts, the K-means clustering is used to cluster nodes and detect malicious nodes.Our experimental results demonstrate that EFDA has better detection performance than two typical ML-based algorithms: HD and PDE. EFDA detects malicious nodes without injecting packets, and it can improve the detection accuracy by around20% to 30%.



---

*Source: 1028251-2022-07-09.xml*