{'fraction_non_alphanumeric': 0.019815994338287332, 'fraction_numerical': 0.0, 'mean_word_length': 5.017021276595744, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Detecting Abnormal Nodes in Cluster-tree Networks via the Likelihood Ratio Test of Packet Losses

While packet loss rate is a crucial indicator of network reliability, abnormal nodes dropping the transit traffic lead to higher packet loss rates. One significant challenge is to efficiently distinguish the abnormal nodes from those with normal packet losses. To address this issue, this paper presents a new detection scheme based on the Likelihood Ratio Test (LRT) for cluster-tree networks - a typical architecture of wireless networks. Due to the hierarchical structure of the networks, LRT is implemented in two phases, i.e., the local detection phase at the non-root nodes and the overall detection phase at the root node. The observed forwarding behaviors of the monitored node are modeled and quantified as log-likelihood ratios where the packet loss rate in the alternative hypothesis is a default value. In this way, the log-likelihood ratios are compared with a threshold under the maximum a posteriori probability criterion to identify the anomalies. The correctness of the proposed scheme is theoretically proved if the packet loss rate in the abnormal node exceeds a critical detection point - whose expression is also formally derived. Simulation results validate the critical detection point and demonstrate the superiority of the proposed detection scheme compared to the state-of-the-art methods.