Distributed Faulty Node Detection in Delay Tolerant Networks: Design and Analysis

Propagation of faulty data is a critical issue. In case of Delay Tolerant Networks (DTN) in particular, the rare meeting events require that nodes are efficient in propagating only correct information. For that purpose, mechanisms to rapidly identify possible faulty nodes should be developed. Distributed faulty node detection has been addressed in the literature in the context of sensor and vehicular networks, but already proposed solutions suffer from long delays in identifying and isolating nodes producing faulty data. This is unsuitable to DTNs where nodes meet only rarely. This paper proposes a fully distributed and easily implementable approach to allow each DTN node to rapidly identify whether its sensors are producing faulty data. The dynamical behavior of the proposed algorithm is approximated by some continuous-time state equations, whose equilibrium is characterized. The presence of misbehaving nodes, trying to perturb the faulty node detection process, is also taken into account. Detection and false alarm rates are estimated by comparing both theoretical and simulation results. Numerical results assess the effectiveness of the proposed solution and can be used to give guidelines for the algorithm design.


INTRODUCTION
Delay Tolerant Networks (DTN) are challenging networks characterized by dynamic topology with frequent disconnections [1].Examples of DTNs include Vehicular DTNs (VDTNs) [2] where two nodes can communicate with each other only when they are closely located.This connection is intermittent as the nodes are moving vehicles.Due to this sparse and intermittent connectivity, inference and learning over DTNs is much more complicated than in traditional networks, see, e.g., [3]- [8].
This paper considers the problem of distributed faulty node detection (DFD) in DTNs.A node is considered as faulty when one of its sensors frequently reports erroneous measurements.The identification of such faulty nodes is very important to save communication resources and to prevent erroneous measurements polluting estimates provided by the DTN.This identification problem is quite complicated in DTNs when interactions are mainly between pairs of encountering nodes.Most of the classical DFD algorithms are using measurements of spatially-correlated physical quantities collected by many nodes to determine the presence of outliers and identify the nodes producing these outliers.In case of pairwise interactions, mismatch between measurements provided by two different nodes can still be detected, but identifying directly which node produces erroneous measurements is not possible.
This paper presents a fully distributed and easily implementable algorithm to allow each node of a DTN to determine whether its own sensors are defective.We assume as in [9] that nodes are not aware of the status (good or defective) of their sensors, while their computation and communication capabilities remain fine, even if some of their sensors are defective.Most of the nodes of the DTN are assumed to behave in a rational way and are willing to know the status of their sensors.Some nodes, however, may be misbehaving, trying to perturb the detection process.
As in [9]- [13], a Local Outlier Detection Test (LODT) is assumed to be able to detect the presence of outliers in a set of measurements, without necessarily being able to determine which are the outliers.This is a typical situation when only pairwise interactions are considered, where measurements from sensors of only two nodes are compared.The generic LODT is characterized by its probabilities of detection and false alarm.When two nodes meet, they exchange their local measurements and use them to perform the same LODT.The LODT results help both nodes to update their estimate of the status of their own sensors.When, for a given node, the proportion of meetings during which the LODT suggests the presence of outliers is larger than some threshold, this node decides its sensors may be defective.In this case, it becomes silent.Accordingly, it does not transmit any more its measurements to its neighbors, but keeps collecting measurements from nodes met and updates the estimate of the status of its sensors.It may then have the opportunity to change its estimate and communicate again.Although the LODT considered here are those of [9], this work differs significantly from [9] due to the communication conditions of DTNs, which require a totally different DFD algorithm.The analysis of the properties of the algorithm is also totally different.This paper shows that the behavior of the proposed DFD algorithm can be described using Markov models and tools borrowed from control theory and population dynamics.
More in depth, the belief of each node about the status of its sensors is quantized.The evolution of these quantized beliefs are then shown to follow two Markov chains.A continuous-time approximation of the evolution of the proportion of nodes with similar beliefs is then derived.Sufficient conditions on the decision parameters to ensure the existence and uniqueness of an equilibrium of the DFD algorithm are then provided.Given the characteristics of the LODT, upper and lower bounds of the detection rate, i.e., proportion of nodes which have effectively identified their sensors as defective, and of the false alarm rate, i.e., proportion of nodes which believe that their good sensors are in fact defective, are also obtained.The impact of misbehaving nodes, trying to perturb the results of the DFD algorithm, is also taken into account.These results provide guidelines to properly choose the parameters of the DFD algorithm.
The rest of the paper is organized as follows.Section 2 discusses some related work.Section 3 presents the system model and basic assumptions.Section 4 details the DFD algorithm for DTNs.Section 5 introduces the Markov model describing the behavior of the DFD algorithm and describes the transition probabilities between the node states.Section 6 develops the theoretical analysis of the macroscopic evolution of the proportion of nodes in different states.Section 7 analyzes the properties of the equilibrium obtained from the continuous-time state equations by approximating the stochastic evolution of the proportions of nodes with similar beliefs.Section 8 discusses the effect of having misbehaving nodes in the system.Section 9 provides some numerical results as well as a comparison with an alternative DFD algorithm and Section 10 concludes this paper.Notations are presented in Table 1.Proofs of propositions and lemmas are available in the Appendix.

RELATED WORK
DFD is a well-investigated topic when considering Wireless Sensor Networks (WSNs) (see [14]- [16] and references therein).The WSNs considered in most of the papers are dense and have a static topology.DFD in DTNs is much less investigated.Classical DFD algorithms usually consist of two phases.First, an LODT is performed using data collected from neighboring nodes.LODTs (based on majority voting [10], the median [11], or the mean [12] of the measurements, the modified three-sigma edit test [13], etc.) aim to decide which data is erroneous.Second, the outcomes of the LODTs are disseminated to improve the decision accuracy.
Nevertheless, when LODTs have to process measurements from two or three nodes only, it becomes difficult to identify the defective nodes.It may, however, still be possible to detect inconsistencies among measurements due to the presence of a node producing outliers.This is a typical situation in DTNs when there are mainly pairwise interactions: two nodes meet, take measurements, and share these measurements.Applying directly classical DFD algorithms in DTNs may thus be quite ineffective.Moreover, usually the performance of DFD algorithms is characterized experimentally.A theoretical analysis of the equilibrium and convergence properties of these algorithms is seldom performed.
In the context of distributed estimation via consensus in a WSN, [17]- [20] have considered the simultaneous estimation of a common quantity from measurements corrupted by different levels of bias or of variance.A distributed ranking among nodes is performed according to the performance of their sensor.The proposed solution allows an identification of defective nodes with sensors producing measurements of high bias or high variance.Nevertheless, the proposed solution highly relies on the measurement models and on the communication conditions.
A problem related to DFD in DTNs has been considered in [21] in the context of VDTN.A large number of sensor nodes are fixed and some vehicles, called mobile carriers (MC) collect data from these sensors.The sensor nodes can only communicate with the MCs in their vicinity.A MC needs to collect enough measurements to perform a test to decide which have been produced by defective sensors.Once a node is deemed defective by a MC, it is added to its blacklist.The MC provides information to sensors about their status.MCs also exchange their blacklists to accelerate the faulty node detection.
In [22], a related problem of distributed malware detection in DTNs is addressed.Each node evaluates after a meeting with another node whether the latter has performed suspicious actions (malware transmission trial).When after several meetings with Node j, Node i detects for a given number of times suspicious activities, a cut-off decision is performed against Node j, which is ignored in next meetings.The main drawback of this approach is the long time required to identify and isolate misbehaving nodes.Misbehavior detection in DTNs is also considered in [6], [23], where the DTN is perturbed by routing misbehavior caused by selfish or malicious nodes.The identification approach in [6] is not distributed, since a trusted authority periodically checks the forwarding history of nodes to identify possible misbehavior.A collaborative approach is proposed in [23], where each node can detect whether the encountered node is selfish using a local watchdog.The detection result is disseminated over the network to increase the detection precision and to reduce the delay.Trust/Reputation management is another important aspect to help DTNs to resist various potential threats.For example, [24] provides an iterative trust management mechanism to fight against Byzantine attacks in which several nodes are totally controlled by the adversary.In [25], a defense against Sybil attacks [26] is introduced, which is based on the physical feature of the wireless propagation channel.A trust model in the scenario of underwater acoustic sensor networks is presented in [27] to take into account several trust metrics such as link trust, data trust, and node trust.
In this paper, differently from previous works in the field, we consider that in a distributed way each node performs a self-determination on whether its sensors are producing outliers in the context of DTNs.In this case, new issues arise, mainly related to the limited proximity time approximate value of X cm,cd θ at equilibrium of DTN nodes and the sporadic contacts which call for the consideration of the history of contacts in the identification process.Also, we provide a mathematical characterization of the problem and prove the convergence of the algorithm.

SYSTEM MODEL
Consider a set S of n S moving nodes equipped with sensors.S can be partitioned into three subsets, S 0 , S 1 , and S 2 .S 0 contains all nodes with good sensors.S 1 is the subset of nodes with defective sensors producing outliers, i.e., measurements corrupted by a noise which has characteristics significantly different from those of the noise corrupting measurements provided by good sensors.Finally, S 2 represents the set of misbehaving nodes, trying to voluntarily perturb the behavior of the network.
The status of node i is θ i (t) = 0 (good node) if all its sensors are good, θ i (t) = 1 (defective node) if at least one of them is defective, and by convention θ i (t) = 2 (misbehaving node).The proportion and number of nodes with status θ are respectively p θ and the number of nodes in status θ is n θ = p θ n S , with p 0 + p 1 + p 2 = 1.All nodes, except misbehaving nodes, are not aware of their own status.In what follows, we assume that over the time horizon of the experiment, the status of sensors does not change, i.e., θ i (t) = θ i .
Misbehaving nodes aim at disrupting network operations by causing congestion along paths, unreliable packet delivery, or erroneous data delivery [6], [24], [28].Here, we assume that misbehaving nodes always transmit data to their neighbors indicating that their sensors are good.Moreover, they try to provide measurements to the encountered nodes so that the LODTs performed by these nodes lead to the outcome of identifying outliers.
Our aim is (i) to design a distributed algorithm so that each node i rapidly evaluates an accurate estimate θ i of its own status θ i despite the presence of misbehaving nodes, (ii) to provide a theoretical analysis of the behavior of this algorithm.

Communication model
Nodes can exchange information only during the limited time interval in which they are in vicinity.As in [7], [8], [23], [29], we assume that the time interval between two successive meetings follows an exponential distribution with an inter-contact rate λ.Moreover, we assume that each meeting involves only two nodes.When more than two nodes meet simultaneously, processing is performed pair-by-pair.

Local outlier detection test
As in [9], we consider a family of LODTs able to detect the presence of outliers in a set of n data measurements M = {m 1 , . . ., m n } but unable to identify which data is an outlier.Denote y (M) the outcome of the LODT, i.e., y (M) = 1 if data corresponding to outliers are detected within M, otherwise, y (M) = 0.
LODTs can take various forms (see [9] and Example 1 below).The LODT is characterized by a false alarm probability q FA (the probability of having y (M) = 1 under the condition that none of the data in M are produced by defective sensors) and by a detection probability q D (the probability of having y (M) = 1 under the condition that some data in M are really produced by defective sensors).In M, let n 0 be the number of data produced by good sensors and n 1 be the number of data coming from defective sensors.We further assume that both q D and q FA in average depend only on the number of data involved in the LODT.As a consequence, we can denote q FA as q FA (n 0 ) and q D as q D (n 0 , n 1 ).Each node performing a LODT on a set of data has not to know n 0 and n 1 , but the performance of the LODT will depend on the actual values of n 0 and n 1 , which are used in the analysis of the DFD algorithm.Example 1.This example introduces a LODT inspired from bounded-error parameter estimation problem (see, e.g., [30]- [32]).It assumes that only pairwise interactions occur.Consider some sensor nodes taking temperature measurements in the same room, e.g., with actual value t = 25 • C. For a non-defective sensor, suppose that its measurement error is bounded, e.g., ±1 • C. Assume that two sensors provide t 1 = 25.6 • C and t 2 = 23.5 • C respectively.Assuming that none of the sensors is defective, and considering the bounded measurement noise, one deduces that t ∈ t 1 = [t 1 − 1, t 1 + 1] = [24.6, 26.6] and t ∈ t 2 = [22.5,24.5].Since t 1 ∩ t 2 = ∅, there exists at least one outlier, but one is unable to determine which sensor has produced an outlier.

Detection scenario
We assume that during each meeting of a pair of nodes (i, j) ∈ S, the nodes collect data with their sensors.Each node may or may not transmit its data to the other node, as detailed in the DFD algorithm description.If a node has received data from its neighbor, it may run a LODT involving its own data and those received from its neighbor.We assume that the spatial and temporal correlation between data is such that only data collected during the meeting of two nodes can be exploited by a LODT.Therefore, previously collected data are not exploited.As a consequence, contrary to [9], where n 0 and n 1 may be large, in the DTN scenario, a LODT will involve n 0 , n 1 ∈ {0, 1, 2}, with n 0 + n 1 = 2.In this paper, one furthermore assumes that q FA (2) < q D (1, 1) q D (0, 2), which is reasonable, since the outcome of a LODT is more likely to be 1 as the number of outliers involved increases.

DFD ALGORITHM
In the proposed DFD algorithm, each (good or defective) node i manages two counters c m,i (t) and c d,i (t) initialized at 0 at t = 0. Using c m,i (t), node i counts the number of meetings during which it has received data from its neighbor, and has been able to perform a LODT.Using c d,i (t), it counts the number of LODT resulting in the detection of outliers.When c d,i (t)/c m,i (t) ν, where ν is some constant decision threshold, node i considers itself as carrying defective sensors, i.e., it sets its own estimate θ i (t) = 1.Otherwise, it considers that its sensors are good, i.e., θ i (t) = 0.
When a node with θ i (t) = 1 encounters another node, it still takes measurements, but it does not send these data to the other node to avoid infecting the network with outliers.Any node, upon receiving data from another node, performs a LODT and updates c m,i (t) and c d,i (t).As a consequence, a node which meets another node considering itself as defective, transmits its data, but since it does not receive any data, it does not update c m,i (t) and c d,i (t) at the end of the meeting.Algorithm 1 summarizes the proposed DFD technique for an arbitrary reference node i.
The vector x i (t) = (θ i , c m,i (t), c d,i (t)) represents the (microscopic) state of each node i.As t → ∞, one has c m,i (t) → ∞, which leads to an infinite number of possible values for x i (t) and the global (macroscopic) behavior of the algorithm is difficult to analyze.To limit the number of possible states, we have chosen to consider the evolution of c m,i (t) and c d,i (t) over a sliding time window containing the time instants of the last M meetings during which node i has performed a LODT.Algorithm 2 is a modified version of Algorithm 1 accounting for this limited horizon.It involves an additional counter µ for the number of LODT performed by node i.As long as µ < M, (5) is equivalent to (3).
Algorithm 2 is analyzed in the next sections.

EVOLUTION OF THE STATE OF A NODE
In this section, to simplify the presentation, the presence of misbehaving nodes is not taken into account.The impact of such nodes on the behavior of Algorithm 2 will be detailed in Section 8. Consider the state the number of values that may be taken by the state of a Algorithm 1 DFD algorithm for node i until the κ-th meeting occurs at time t = t κ i with Node j κ ∈ S \ {i}.
c) Update θ i as follows Algorithm 2 Sliding-Window DFD algorithm for node i 1)-( 2) until the κ-th meeting occurs at time t κ i with Node j κ ∈ S \ {i}.

3) Perform local measurement of data m
c) Update θ i using (4).
node is (M + 1) (M + 2) /2.The evolution of x i (t), conditioned by its status θ i , follows a Markov model with state transition diagram of the kind shown in Figure 1 for M = 4.
In particular, there are two chains, one conditioned by θ i = 0 and the other conditioned by θ i = 1.Both are characterized by a transient phase for state values with c m,i (t) < M ; then, a permanent regime starts when

Analysis of some random events
In order to estimate the transition probability from a generic state of the Markov chain to another, one first calculates the probability a given node meets an other node believing its status good or its status is bad.One also evaluates the probability to perform a LODT outcome concluding in the absence or in the presence of outliers.

Probability of meeting a node believing its status is good/defective
Assume that at time t, some reference node i meets an other node which index is represented by the random variable J and define the random event E 1 (t) = θ J (t) = 0 , representing the event that the node met believes its status is good.As illustrated in (4), among the nodes with status θ, the proportion of nodes that believe themselves as good is 1 where p 10 (t) is in fact the non-detection rate (NDR) of the nodes with defective sensors at time t and X cm,c d θ (t) represents the proportion of nodes in state (θ, c m , c d ) defined as where and | • | denotes the cardinality of a set.
Assuming that the nodes are randomly spread, the probability that node J believes it has only good sensors conditioned to its true status is and then Similarly, introduce E * 1 (t) = { θ J (t) = 1}, representing the event that the node met believes its status is defective.Among the nodes with sensors in status θ, the proportion of nodes with θ j (t) = 1 is 1.For the sake of simplicity, the dependency of p θ0 (t) in ν is omitted, as ν is constant during the DFD algorithm.
where p 01 (t) and p 11 (t) represent the false alarm rate (FAR) and the detection rate (DR) respectively.From (10), one gets

Probability of detecting the presence of an outlier
Since node i performs an LODT only when it meets a node J with θ J (t) = 0, one introduces the random event for the reference node with actual status θ.As discussed in Section 3.2, the statistical properties of the outcome Y i (t) of the LODT depend only on θ i and θ j .For example, when node i has good sensors, one has In (12-a), one uses the fact that the LODT outcome is not influenced by the estimate of the status of a node and that in P θ J = ϕ | θ i = 0, θ J (t) = 0 , the status of node J, does not depend on θ i .In (12-b), Moreover, .
If node i has defective sensors, one has Similarly, one may introduce the random event

Transition probabilities
One evaluates now the transition probabilities for the state of a node.More specifically, define as π δm,δ d Thus, (δ m , δ d ) ∈ {(0, 0) , (0, 1) , (0, −1) (1, 0) , (1, 1) , (1, −1)}.Note that π δm,δ d θ depends on the current state of the reference node, but also on the current proportion of active (good and defective) nodes.Therefore, the transition probabilities are denoted as π δm,δ d θ (t, c m , c d ), where t is the time instant, c m,i (t) = c m , and c d,i (t) = c d .Depending on the value of c m , two different cases are considered in Section 5.2.1 and in Section 5.2.2, respectively corresponding to the transient and permanent regimes.
In the transient regime, when c m,i (t) < M , c m,i (t) and c d,i (t) are updated according to (3) whenever node J with θ J (t) = 0 is met.The only possibility that leads to δ m = 0 is the event E * 1 , i.e., node i meets node J with θ J (t) = 1.As a consequence, no LODT is performed by node i.Therefore, for any θ ∈ {0, 1}, where p θ1 (t) is defined by (10).

Case II, c m,i (t) = M
In the permanent regime, c m,i (t) = M and does not increase any more, thus δ m = 0.In Algorithm 2, µ is the number of LODTs performed by node i up to time t.When µ M , only the last M LODT outcomes are considered: LODT outcomes y m i with m µ − M are no more considered.
To determine the value taken by δ d ∈ {−1, 0, 1} after the µ-th LODT, consider the random event which corresponds to a situation where one knows that c d LODTs where positive among the last M tests and the LODT that will be ignored, once the new LODT outcome is available, also concluded in the presence of defective sensors.P E 1 4 (t) is relatively complex to evaluate, since P {Y n i = 1} is time-varying according to (12)(13)(14).In what follows, we assume that LODT outcomes with Y m i = 1 are independently distributed over the time horizon corresponding to m = µ − M, . . ., µ − 1.One obtains then This approximation is exact in steady-state, when the X cm,c d θ s do not vary any more.
Similarly, define Considering the same assumption used to get ( 21), one has Assume that the (µ − M )-th LODT performed by node i occurred at time t, then y µ−M i can also be denoted as y i t and the transition related to c d,i is such that To have (δ m , δ d ) = (0, 1), three independent events have to occur: 1) the encountered node J believes it is good at time t, i.e., E 1 (t); 2) y i (t) = 1, i.e., E θ 3 (t) (t); 3) y i t = 0, i.e., E 0 4 (t).Thus the transition probability may be expressed as Using ( 9), ( 12), (14), and ( 21) in (24), one gets Consider now (δ m , δ d ) = (0, −1).To have such transition, the three following independent events should occur: 1) E 1 (t); 2) y i (t) = 0, i.e., E θ 3 (t) (t); 3) y i t = 1, i.e., E 1 4 (t).Thus, the transition probability is Finally, by substituting eqs.(25)(26) it is possible to calculate π 0,0 θ (t, M, c d ) which is given by Proposition 2. The evolution of the DTN state components, i.e., the expected proportion of nodes X cm,c d θ (t) in the states (θ, c m , c d ), with θ ∈ {0, 1}, c m = 0, . . ., M , and c d c m is described by Proof: See Appendix A Kurtz's theorem [33], [34] can then be used to show that for all ε > 0, there exists α 1 0 and α 2 (ε) > 0 such that As a consequence, X θ (t) converges in probability to X θ (t) as n θ goes to infinity.This is typically the approximation performed in the seminal work [35] where the SIR model was proposed.This model is the one used to characterize most widely studied classes of epidemic models.Accordingly, analogously to what was presented for example in [7], [35]- [40], the proposed system consists of ordinary differential equations approximating jump Markov processes.The state equations in (28) are nonlinear, since each π δm,δ d θ depends on X cm,c d θ , see ( 6) and (10).

ANALYSIS OF THE DTN STATE EQUATIONS
In what follows, the asymptotic behavior of the DTN state equations ( 28) is characterized.Algorithm 2 may drive X cm,c d θ to an equilibrium X cm,c d θ at which the proportions of nodes in different states X cm,c d θ (t) do not vary any more.As a consequence, p θ0 (t) defined in (6) also tends to an equilibrium p θ0 .Proof: See Appendix B. From Proposition 3, the only possible value at equilibrium of X cm,c d θ (t) when c m < M is 0. Thus p θ0 may be written as Denote p = p 00 , p 10 ∈ P 0 with and consider the functions and The following proposition provides a non-linear equation that has to be satisfied by p.
The various X M,c d θ at equilibrium are easily deduced from the solutions of the mentioned equation.Proposition 4. Assume that the dynamic system described by (28) admits some equilibrium X cm,c d θ , then p ∈ P 0 is the solution of and for any θ ∈ {0, 1} and c d c m , Proof: See Appendix C.

Existence and uniqueness of the equilibrium point
Now we investigate the existence and the uniqueness of the solution of (34), which is rewritten in detail in (36) at the top of the next page.
One first shows the existence of an equilibrium using Brouwer's fixed-point theorem [41] in the following proposition.
in (40).For any p = p 00 , p 10 ∈ P n , one can prove using Lemma 6 that F (p) ∈ P n .Thus F maps P n to P n .Applying Brouwer's fixed-point theorem, F admits a fixed point and Proposition 5 is proved.Sufficient conditions on p 0 , p 1 , q D , q FA , M and ν are then provided to ensure the uniqueness of this equilibrium by applying Banach's fixed-point theorem [42].
Proof: See Appendix E. Due to the monotonicity of p θ0 min (n) and p θ0 max (n) shown in Lemma 6, c θ decreases with n.Hence, if a given ν satisfies (42) for some N , then ν will satisfy (42) for all n N and the equilibrium is unique.If the values of p 1 , q D , q FA , and M are fixed, then one may deduce sufficient conditions on the value of ν to have a unique equilibrium point.See Example 8.

Equilibrium point as M → ∞
Both p 00 and p 10 can be seen as functions of M .As M → ∞, Algorithm 2 turns into Algorithm 1.In this situation, if ν is properly chosen, the probabilities of false alarm and nondetection tend to zero, as shown in Proposition 9.

Approximations of the Equilibrium
Closed-form expressions for p 00 and p 10 are difficult to obtain from (36).This section introduces an approximation of ( 36) from which some insights may be obtained on the way ν should be chosen.Since p 10 represents the expected proportion of nodes with defective sensors that have not detected their status, the value of p 10 should be small.From (31)(32) one sees that lim p 10 →0 h 0 = q FA (2) and lim p 10 →0 h 1 = q D (1, 1), thus one may consider the following approximations Therefore, (36) may be rewritten as from which one deduces approximate values X M,c d 0 of X M,c d 0 at equilibrium from eq. ( 35) For any fixed value of M , q FA (2), and q D (1, 1), the values of detection rate (p 11 ) and false alarm rate (p 01 ) at equilibrium can be predicted using (45), since p 01 = 1 − p 00 and p 11 = 1−p 10 .Consider for example M = 10, q FA (2) = 0.05, and q D (1, 1) = 0.8. Figure 3 presents p 11 as a function of p 01 for different values of ν.This figure is helpful to choose the value of ν to meet different performance requirements.The actual values of p 11 and p 01 are also shown in Figure 3, which are very close to p 11 and p 01 , in the region where p 11 is close to 1.

INFLUENCE OF MISBEHAVING NODES
A LODT involving data coming from a misbehaving node will always result in the detection of an outlier.Thus, when a node i with state x i (t) = (θ, c m,i (t) , c d,i (t)) meets a misbehaving node, the possible transitions are such that Then, in the evaluation of the probability of the events E * 1 (t), E θ 2 (t), and E θ 3 (t) introduced in Section 5, one has to account for the probability of meeting a misbehaving node.For example, (11) can be rewritten as The transition probabilities introduced in Sections 5.2.1 and 5.2.2 have to be updated accordingly.The form of the DTN state equations ( 28) remains the same.Finally, the effect misbehaving nodes can be taken into account in (45) for the computation of the approximate expressions of p 00 and p 10 .More specifically,

NUMERICAL RESULTS
In this Section we provide results aimed at assessing the convergence of the theoretical framework (Section 10.1), the appropriateness and accuracy of the framework also in case of specific mobility models such as the Brownian motion (Section 10.2) or other more realistic mobility models derived from user traces (Section 10.3), as well as to compare the proposed DFD methodology to other state-of-the-art solutions (Section 10.4).Finally, in Section 10.5 we investigate on the stability and accuracy of the Algorithm upon varying some key parameters.

Numerical verification of theoretical results
This section presents first the solution of the state equation (28) describing the evolution of the proportion of nodes in various states.Algorithm 2 is simulated considering a random displacement of nodes without any constraint on their speed.This allows to verify the correctness of the theoretical results presented in this paper.
by solving (28).Note that ∆t represents the duration of a unit time slot used in the simulation.One observes that the proportion of nodes in each state becomes almost constant as t/∆t 15.For the nodes with θ = 0, only X 4,0 0 and X 4,1 0 are larger than 0.05, while the others are very close to 0. For the nodes with θ = 1, only X 4, 4  1 , X 4,3 1 , and X 4,2 1 are relatively large as compared to the other states.Consider the two sets of c d s for which X M,c d 0 and X M,c d 1 are large.These sets have no common c d and it is thus easy to choose a decision threshold to distinguish both sets.The accuracy of the algorithm is then very good.With ν = 0.4, one has p 00 = 0.985 and p 10 = 0.027.Only 1.5% of the good nodes believe they are carrying defective sensors.Less than 3% of the nodes with defective sensors have not been detected.
Consider now a set S of n S = 1000 moving nodes uniformly distributed over a square of unit area.In the first displacement model (jump motion model): node i randomly chooses its location at time instant (k + 1) ∆t, independently from its previous location at time k∆t.Two nodes communicate only at discrete time instants k∆t when their distance is less than r 0 .Node i has its neighbors in the set N i = {j ∈ S : 0 < r i,j ≤ r 0 }, where r i,j is the distance between Nodes i and j.Furthermore, if |N i | > 1, we assume that node i communicates only with its closest neighbor.Denote ρ = πr 2 0 n S as the average value of |N i |.The cardinality of N i approximately follows a Poisson distribution as n S is large enough, the inter-contact probability is thus In the Monte-Carlo simulations, we set r 0 = 0.014, so that ρ ≈ 0.6 and λ∆t ≈ 0.33.Using the same values of p θ , M , ν, q D , and q FA as in Figure 4, the simulation results for this jump motion model are shown in Figure 5. Comparing Figure 4 and Figure 5, one remarks that the state evolution in the transient phase has similar shape but with different convergence speed, which depends mainly on λ. Figure 6 shows a good match between theory and simulation for the proportions of states at equilibrium.The approximation of X 4,c d θ using ( 46) is also presented in Figure 6, which is very close to its actual value.Note that the difference between the approximated value and those obtained through theory and simulation is less than 0.1%.

Simulations with Brownian motion model
Consider now a Brownian motion model where each node is moving with a random speed.Each node changes its Fig. 5. Evolution of X cm,cd 0 (t) (left) and X cm,cd 1 (t) (right) by simulations with the jump model, when q FA (0, 2) = 0.05, q D (1, 1) = 0.8, q D (0, 2) = 0.9, M = 4, ν = 0.4, and λ∆t = 0.33.orientation when it reaches the boundary of the unit square.Let χ i = χ i 1 , χ i 2 be the location of Agent i.Consider a first-order Brownian mobility model where η i 1 (k∆t) ∼ N 0, (σr 0 ) Consider σ ∈ {0.1, 1}, q FA (2) = 0.05, q D (1, 1) = 0.8, q D (0, 2) = 0.9, M = 10, and ν = 0.4.Figure 7 compares the evolution of p 01 and p 10 as functions of time for the jump motion model and the Brownian motion model, with fixed ρ ≈ 0.6.At equilibrium, the performance obtained for both models is quite close.However, the convergence speed depends on the inter-contact rate λ.When σ = 0.1, the algorithm converges slowly in the Brownian motion model.When σ = 1, which results in a larger value of λ, the evolution of p 01 and p 10 with the Brownian motion model are close to the jump motion model.
At the beginning of the algorithm, each node believes that its sensors are good, thus p 01 (0) = 0 and p 10 (0) = 1.During the algorithm, p 10 (t) decreases in the transient phase until it reaches the equilibrium.Whereas, p 01 (t) increases at first and then decreases to the equilibrium.This comes from the fact that p 10 (t) is large at the beginning and the LODT performed on a good node often detects outliers.Fig. 7. Evolution of p 01 and p 10 for the two moving models, with σ ∈ {0.1, 1}, q FA (2) = 0.05, q D (1, 1) = 0.8, q D (0, 2) = 0.9, M = 10 and ν = 0.4.

Simulations with real databases
In this section, Algorithm 2 is executed using some experimental databases instead of motion models.These databases, provided by the MIT Reality Mining Project [43] and the Haggle Project [44], have been used in several previous works, e.g., [4].In this work, we use the following databases: • Reality, where n S = 97, lasts more than 200 days with about 111 inter-contacts per day.
More specifically, one is interested in the inter-contact trace, i.e., which pair of nodes have a meeting at which time.The traces were taken from [45], which are converted from the original databases [43], [44].Consider again the following parameters: q FA (2) = 0.05, q D (1, 1) = 0.8, q D (0, 2) = 0.9, M = 10, and ν = 0.4.Monte-Carlo simulations are performed 500 times for each database.In each test, n 1 nodes with random index are chosen to be defective.One sets n 1 = 10 in Infocom05 and n 1 = 20 in Reality.Two cases are considered.First, no misbehaving node is introduced, i.e., n 2 = 0.In a second case, n 2 = 1 in Infocom05 and n 2 = 2 in Reality.At the top of Figure 8, the index of the active nodes (which have contact with the others) are presented at each time to show the frequency of the inter-contacts at different epochs.The evolution of p 10 and p 01 is plotted at the bottom of Figure 8.Interestingly, in absence of misbehaving nodes, both p 10 and p 01 , obtained with both databases, decrease to 10 −3 after a sufficiently long time.One also observes that the convergence speed of p 10 and p 01 is highly related to the intercontact rate (reflected by the density of points in the subfigures at the top).Considering Infocom05, Table 2 further shows the influence of misbehaving nodes for various n 2 .In presence of misbehaving nodes, the performance of the DFD algorithms worsens, but remains satisfying if the value of ν is properly chosen.
When n 2 = 0, Figure 9 represents the states at equilibrium X M,c d θ obtained with the databases Reality and Info-  at the equilibrium obtained using the Reality database, the Infocom05 database, and predicted by the approximation (46).com05, and also considering the approximation (46).There is an excellent match between the values at equilibrium predicted by theory and those obtained in practice.Note that the difference between the approximated value and those obtained through theory and simulation is less than 0.05%.

Comparison with state-of-the-art solutions
This section compares the proposed DFD algorithm to some closely related scheme in the literature.As mentioned in Section 2, classical DFD algorithms are difficult to apply in the context of DTN and no solutions have been presented so far in the literature for this specific scenario.Accordingly, in order to perform a meaningful comparison between our algorithm and a state-of-the-art approach, we have considered the gossip algorithm discussed in [18] which represents the most robust and efficient methodology in the context of classification and distributed estimation in dynamic scenarios like DTNs.
In [18] , n S nodes are assumed to get a measurement of a common quantity c, where v i. are realizations of independent zero-mean Gaussian random variables with variance σ 2 and θ i. ∈ {0, 1} denotes the bias of each node.Each node is interested in the joint estimation of c and θ i .Since the measurements produced by the sensors with nonzero bias are more likely to have larger values, [18] proposes a estimator of θ i based on a distributed ranking of the nodes according to their measurement m i .Nodes with a large rank get an estimate θ i = 1, while nodes with a small rank have θ i = 0.
In order to apply the proposed DFD algorithm to this problem, consider the following LODT where δ is a threshold that results in different values of probabilities q FA (2), q D (1, 1), and q D (0, 2); then the proper value of ν can be set accordingly.Consider again Infocom05 for the simulation with n 1 = 10 nodes chosen randomly with θ = 1 and without misbehaving node.Two scenarios are considered.In the first case, all nodes take a single measurement of c at initialization.In the second case, nodes take measurements at each meeting.Results are obtained as the average of 200 independent Monte-Carlo simulations.Figure 10 compares the results when σ = 0.2 and σ = 0.3.The classification error and the estimation error are defined as E c = θ i − θ i /n S and E e = |c − c i | /n S .If nodes take a single measurement, the performance of the proposed algorithm is close to the reference method in terms of E c and E e .When nodes take new measurements at each meeting, the proposed DFD algorithm performs better than the reference method: the value of E c decreases faster and turns to be much smaller.This is mainly due to the node ranking algorithm used in [18], which becomes less efficient when nodes update at each meeting the quantity according to which they are ranked.

Influence of the parameters
This section characterizes the influence of the parameters, such as p 1 , q D (1, 1) , and M , on the performance of Algorithm 2. The jump motion model is used throughout this section to describe the displacement of the nodes.
For each case, the value of ν is chosen such that it minimizes p 01 + p 10 .One observes that a large M leads to a better performance at equilibrium.The price to be paid is a longer time required to reach equilibrium.When M = 10, both p 10 and p 01 are around 10 −3 .The proportion of the nodes with defective sensors has also an impact on the convergence speed of the algorithm.For example, when p 1 is large, more time is needed to achieve a given level of performance (in terms of p 10 and p 01 ).
Figure 12 shows partition of the (q D (1, 1) , q FA (2)) triangle in four areas, represented in different colors.The ratio of defective nodes in the network has not a significant impact Fig. 12. Achievable p 10 or p 01 for different values of the pair (q D (1, 1) , q FA (2)) when p 1 = 0.1 (left) and for p 1 = 0.5 (right) and p 2 = 0.
on the performance at the equilibrium, even when 50% of nodes are defective.This assesses the robustness of the approach.

CONCLUSION
This paper presents a fully distributed algorithm allowing each node of a DTN to estimate the status of its own sensors using LODT performed during the meeting of nodes.The DFD algorithm is analyzed considering a Markov model of the evolution of the proportion of nodes with a given belief in their status.This model is then used to derive a system of ordinary differential equations approximating the evolution of the proportions of the nodes in different states.The existence and uniqueness of an equilibrium is discussed.Interestingly, the proportions at the equilibrium follow a binomial distribution.The approximations of these proportions of nodes at equilibrium provide insight to properly choose the decision parameter of the DFD algorithm.In the simulations, a jump motion model, a Brownian motion model, as well as databases containing traces of inter-contact time instants are considered.The results show a good match with theory.The convergence speed of the DFD algorithm depends on the inter-contact rate and on the proportion of nodes with defective sensors p 1 .Nevertheless, p 1 has not a significant impact on the non-detection and false alarm rates at equilibrium, showing the robustness of the approach also in case of a large number of defective nodes.The impact of the presence of misbehaving nodes has also been considered, showing the robustness of the proposed DFD algorithm.
Similar derivations can be made for the remaining DTN state components to obtain (28).

APPENDIX B PROOF OF PROPOSITION 3
For the proof, one considers first the following lemmas.then p 0 p 00 (t) + p 1 p 10 (t) > 0 for all t ∈ R + .
Proof: First, consider z ∈ [ν, 1].In (71), each i in the sum is such that i M < ν z.From Lemma 13, f i (z) is a decreasing function for any i M < z, thus g(z) is also decreasing with z.Now, consider z ∈ [0, ν], one rewrites (71) as in which each i in the sum is such that z < ν i M .Applying again Lemma 13, since f i (z) is an increasing function for any z i M , the sum in (72) is also increasing with z and g (z) is decreasing.Thus g(z) decreases over [0, 1].
Proof: The proof of obtained by combining Lemma 12 and Lemma 14.

APPENDIX E PROOF OF PROPOSITION 7
As seen in the proof of Proposition 5, ∀n ∈ N * , F (p) maps P n to P n , with P n = p 00 min (n) , p 00 max (n) × p 10 min (n) , p 10 max (n) .In order to apply Banach's fixed-point theorem [42] to prove Proposition 7, it suffices to show that F is contracting, i.e., that for any pairs p = (x, y) ∈ P n and p + δ = (x + δ x , y + δ y ) ∈ P n , one has A sufficient condition to have (74) is that the eigenvalues of the matrix As in Appendix D, denote α = q FA (2), β = q D (1, 1) and γ = q D (0, 2).First, one evaluates ∂x , using the partial derivatives calculated in the proof of Lemma 12.Then, the solutions of (75) are z 1 = ∂F0 ∂x + ∂F1 ∂y and z 2 = 0. Hence, it suffices to prove that |z 1 | < 1.
We begin with the evaluation of an upper bound of the partial derivative of F 0 (x, y) with respect to x

APPENDIX F PROOF OF PROPOSITION 9
First, one shows that if ν < q D (1, 1), then for any ε > 0, there exists M > M , such that p 10 < ε.
c m,i (t) = M .With c m,i (t) = c m and c d,i (t) = c d , the transitions from State (θ, c m , c d ) to State (θ, c m , c d ) are analyzed in the following.

Fig. 1 .
Fig. 1.Example of Markov model for the evolution of the state θ, c m,i (t) , c d,i (t) of a node when M = 4.

θ
the transition probability from State (θ, c m , c d ) to State (θ, c m + δ m , c d + δ d ), where θ ∈ {0, 1}.One has δ m ∈ {0, 1} since c m may either increase (δ m = 1) in the transient regime or remain constant (δ m = 0) in the permanent regime.One has δ d ∈ {−1, 0, 1}, depending on the value of the last LODT outcome and on the value of the M + 1-th last LODT outcome, which is no more considered in the permanent regime.

7. 1 Proposition 3 .
Equilibrium of X cm,cd θ One investigates first the evolution of X cm,c d θ (t) when c m < M .As shown in the following proposition, the DTN state always reaches the permanent regime.For any c m < M and c d c m , lim t→∞ X cm,c d θ (t) = 0.

Fig. 3 .
Fig. 3. Approximate p 11 as a function of approximate p 01 , for various ν and fixed M = 10 .

Fig. 14 .
Fig. 14.Permanent regime: Possible state transitions from and to State (θ, M, c d ) when 0 < c d < M
A = ∂F 0 (x,y) ∂x ∂F 0 (x,y) ∂y ∂F 1 (x,y) ∂x ∂F 1 (x,y) ∂y have module less than 1.The eigenvalues of A are the solutions of

TABLE 1
Symbols used in this paper S 0 , S 1 , S 2 sets of good, defect., and misbehav.nodes i state of node i, containing θ i , c m,i , and c d,i π δm,δd θ (t, cm, c d ) transition probability from state (θ, cm, c d ) to state (θ, cm + δm, c d F 1 p 00 , p 10 = c d :c d /M <ν 10 max (n) , where p θ0 min (n) and p θ0 max (n) are defined

TABLE 2
Values of p 01 and p 10 at the end of simulations for different number of misbehaving nodes Fig. 13.Transient regime: Possible state transitions from and to state (θ, cm, c d ) when 0 < cm < M and 0 < c d < cm θ (t).