Table 1 Rule definition

When a packet is not forwarded as it should,

Packet drop rate

Selective forwarding and black hole attacks [34]

increase a counter. When this counter reaches a

threshold t after MP rounds, raise an alarm.

When a packet does not originate from a

Packet origin address

Hello flood and sinkhole attacks [35]

node with a distance no longer than the radio range

of a single hop, raise an alarm.

When the distance measurements between multiple,

Distance matching criterion

Sybil [36] attacks

at least two, distinct nodes match, raise an alarm.