A Trust-Based Adaptive Probability Marking and Storage Traceback Scheme for WSNs

Security is a pivotal issue for wireless sensor networks (WSNs), which are emerging as a promising platform that enables a wide range of military, scientific, industrial and commercial applications. Traceback, a key cyber-forensics technology, can play an important role in tracing and locating a malicious source to guarantee cybersecurity. In this work a trust-based adaptive probability marking and storage (TAPMS) traceback scheme is proposed to enhance security for WSNs. In a TAPMS scheme, the marking probability is adaptively adjusted according to the security requirements of the network and can substantially reduce the number of marking tuples and improve network lifetime. More importantly, a high trust node is selected to store marking tuples, which can avoid the problem of marking information being lost. Experimental results show that the total number of marking tuples can be reduced in a TAPMS scheme, thus improving network lifetime. At the same time, since the marking tuples are stored in high trust nodes, storage reliability can be guaranteed, and the traceback time can be reduced by more than 80%.


Introduction
Wireless sensor networks (WSNs), as one pivotal core components of the Internet of Things (IoT) [1][2][3][4], are emerging as a promising platform that enables a wide range of military [5], scientific [6], industrial and commercial applications, including monitoring of extended biological habitats, agriculture, industrial processes and human health-critical infrastructure [7][8][9][10]. However, sensor networks also face many security and privacy challenges due to the open nature of wireless communication in sensor networks and the limited capabilities of sensor nodes in terms of processing power, storage, bandwidth, and energy [9][10][11][12][13][14]. WSNs sense information with deployed sensor nodes and send the sensed information to a sink by multiple-hop paths [15]. In the process, the network might be subject to many attacks [16][17][18][19][20], for example, DDoS attacks, flood attacks, select forwarding attacks [16,17], injected false data attacks [18], and clone attacks [19]. Traceback is a security protection technology for WSNs [20][21][22][23][24]. One of the most important methods is packet marking [20][21][22][23], whose basic principle is that when the sensor nodes transmit data packets to the sink node, the sensor nodes add their ID information (called marking tuples) to the data packets. When the sink receives this information, it can reconstruct the path from the sink to the source nodes by analyzing these marking tuples. After the malicious source is determined, measures can be taken to block or remove the malicious sources to protect network security. Logging is also an effective traceback method [20,23,24]. In a logging scheme, when the number of marking tuples in the forwarded data packets reaches a predetermined threshold, those marking tuples can be stored in nodes. Therefore, the amount of data loaded by nodes near the sink can be reduced, and network lifetime can be improved. However, shortcomings still exist in the previous studies: (1) the marking probabilities of all nodes are the same and are determined in advance. Most nodes in the network are "good" nodes. The "good" nodes are usually considered credible, so those "good" nodes need not be marked, which can save energy; (2) the state of a node often changes; for example, if nodes are credible, the marking probability of nodes is low, but if nodes evaluated by the sink are untrusted, a high marking probability must be imposed for nodes to identify their status quickly. Therefore, in the process of network operation, the marking probability of nodes must be adjusted depending upon the extent to which nodes are trusted; (3) nodes are randomly selected to store marking tuples in previous schemes, so marking tuples could be stored in malicious nodes, which leads to the dropping of marking tuples which can prevent the malicious source node from being identified quickly. A better scheme should improve the energy efficiency, the method is that the system make full use of the remaining energy. The energy efficiency refers to the ratio of the used energy to the total energy. In order to guarantee better performance, the network lifetime should be improved, which is the time of rounds for operation. High network lifetime can ensure the reliability of a network, and it also can save energy for many applications [25,26]. Based on the above analysis, a trust-based adaptive probability marking and storage traceback (TAPMS) scheme is proposed to enhance security for WSNs. The main contributions of the TAPMS scheme are as follows: (1) In the TAPMS scheme, the marking probability of nodes is adaptively adjusted according to their trust. First, in data transmissions, the times a network is attacked can be detected by the sink; thus, the security level in the network can be evaluated by the sink. The process for evaluating the security level is that before beginning data transmission, the sink provides predetermined attack times. At the time of data transmission, if the attack time of the network is greater than the predetermined value, the security level in the network has not improved. Therefore, the security level in the network requires adjustment. After time slots τ, the security level in the network can be evaluated by the sink according to the difference between two consecutive time slots. If the attack time in this time slot is less than the attack times in the last time slot, the security level has become good, therefore, the security level of the network will be better in the next time slot τ. It is reasonable to set a low marking probability in a secure network to save energy, but to set a high marking probability in an insecure network to locate the source(s) of malicious nodes. Therefore, the marking probability can be set in the TAPMS scheme as follows: if the network is in a "safe" state, the baseline of the marking probability can be set low to reduce the number of marking tuples. In contrast, the baseline of the marking probability can be set high when the security level of the network is low. Second, if node trust is high, the marking probability of nodes can be reduced. Conversely, the marking probability of nodes with low trust should be high. Because most nodes are marked with low probability, it will be easy to determine that the average marking probability of nodes in TAPMS is lower, the traceback time is shorter, and network lifetime is longer. (2) In the TAPMS scheme, marking tuples are stored in high trust nodes to ensure stored marking tuples with high reliability. In previous schemes, nodes are randomly selected to store marking tuples. If marking tuples are stored in low trust nodes, those marking tuples can be dropped easily, which leads to a loss of marking tuples that are used to reconstruct the path from the sink to source nodes; therefore, the performance of the scheme is poor. In the TAPMS scheme, marking tuples are stored in high trust nodes, thus, the performance of this scheme has been improved. (3) The theoretical analysis and experimental analysis demonstrate that traceback time and lifetime in TAPMS are both improved. The results show that the number of total marking tuples can be reduced by 13.20%-73.70% in the TAPMS scheme compared with that in the probability marking (PM) scheme with marking probability equal to 1 to improve network lifetime, and the traceback time can be reduced by more than 80%.
The remainder of this paper is organized as follows: in Section 2, the related work is reviewed. The system model is described in Section 3. In Section 4, the details of a trust-based adaptive probability the system can locate a malicious sources through those information marks, which is similar to cyber-forensics technologies [20][21][22][23][24]28]. (3) The sink can assess the trust of each node based on the marking tuples.

Energy Consumption Model and Related Definitions
The typical energy consumption model is adopted [29][30][31][32][33], as reflected in the energy consumption for sending data in Equation (1) and for receiving data in Equation (2) Eelec in the formula represents the energy consumption per bit. If the transmission distance is less than the threshold d0, the consumption of power amplification adopts the free space model. If the transmisson distance is greater than the threshold d0, the power amplification consumption adopts the multipath attenuation model. εfs and εamp represent the energy required to amplify power in the two models. l denotes the number of bits of data.
In this paper, the parameters of the specific configuration in references [31,33,34] are shown in Table 1.

Energy Consumption Model and Related Definitions
The typical energy consumption model is adopted [29][30][31][32][33], as reflected in the energy consumption for sending data in Equation (1) and for receiving data in Equation (2): E r plq " lE elec (2) E elec in the formula represents the energy consumption per bit. If the transmission distance is less than the threshold d 0 , the consumption of power amplification adopts the free space model. If the transmisson distance is greater than the threshold d 0 , the power amplification consumption adopts the multipath attenuation model. ε fs and ε amp represent the energy required to amplify power in the two models. l denotes the number of bits of data.
In this paper, the parameters of the specific configuration in references [31,33,34] are shown in Table 1.

Problem Statement
The focus of this paper is to design a new, effective TAPMS scheme to trace back all types of attacks in WSNs. The goal of the TAPMS scheme is to locate the malicious source(s) as soon as possible at lower cost, which can be categorized by the following aspects: (1) Network lifetime Γ is to be maximized.
The basic goal of this application requirement is to maximize network lifetime. Network lifetime can be defined as the elapsed time until the first node dies [7,14,33,34]. The death of the first node can affect the connectivity and coverage of the network severely, preventing the network from playing a proper role. The end-to-end connectivity refers to the correct transmission from one node to the final destination, which characterizes the ability of every node to report to the fusion center, thus it is important to ensure a high probability of connectivity [35]. Hence, the definition of network lifetime in this paper is consistent with references [7,14] and is defined as the time elapsed until the first sensor node in the network depletes its energy. We denote e i as the energy consumption of node v i in one round. E i is the total energy of node v i . The formula of maximizing network lifetime Γ can be expressed as follows: max pΓq " min max iPt1..mu (2) The scheme can locate attack sources quickly while defending against attacks.
The spent time T for determining a malicious source is evaluated by the amount of marking information stored in attack paths. Obviously, in the process of reconstructing the attack paths, if the traceback scheme marks many data packets in the attack path, the system can collect much marking information quickly; then, the malicious node can be rapidly determined. Therefore, min pTq means to maximize marking information. b i denotes the amount of marking information of node v i in a unit time; thus: (3) The average credibility of nodes, which is used to store marking tuples, is to be maximized.
When the produced data packet is sent to the sink, the marking information of nodes can be added to the data packet. However, when the length of marking information reaches a certain value, the marking information can be stored in nodes. If marking tuples are stored in a malicious node, those marking tuples can be dropped or tampered with. Therefore, one goal of the TAPMS scheme is to maximize the average trust of nodes that store marking tuples. Consider that the trust of node v i is c i . The number of marking tuples stored in node v i is S i , as shown in Equation (5): In summary, the optimization purpose of the scheme in this paper is:

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to detect malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant parameters are listed in Table 2.

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to detect malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant parameters are listed in Table 2. (1) In previous traceback schemes, after the system sets baseline marking probability (BMP) , the marking probability is a constant . The following problems result: (1) when the network is in a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low MP in this situation can reduce marking tuples routing in the path to improve network performance. However, when the network is not in a safe state, the system should adopt a high marking probability to determine the location of malicious sources in a very short period, thus contributing to network security. Therefore, using a fixed MP cannot optimize network performance. An adaptive probability-marking scheme is proposed in this paper. For instance, the change in an attack behavior situation in different periods is provided in Figure 2.

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to detect malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant parameters are listed in Table 2. (1) In previous traceback schemes, after the system sets baseline marking probability (BMP) , the marking probability is a constant . The following problems result: (1) when the network is in a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low MP in this situation can reduce marking tuples routing in the path to improve network performance. However, when the network is not in a safe state, the system should adopt a high marking probability to determine the location of malicious sources in a very short period, thus contributing to network security. Therefore, using a fixed MP cannot optimize network performance. An adaptive probability-marking scheme is proposed in this paper. For instance, the change in an attack behavior situation in different periods is provided in Figure 2.

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the abilit malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant para listed in Table 2. (1) In previous traceback schemes, after the system sets baseline marking probability the marking probability is a constant . The following problems result: (1) when the ne a "safe" state, the probability that the system is attacked by malicious nodes is small. Setti in this situation can reduce marking tuples routing in the path to improve network pe However, when the network is not in a safe state, the system should adopt a high marking to determine the location of malicious sources in a very short period, thus contr network security.
Therefore, using a fixed MP cannot optimize network performance. An probability-marking scheme is proposed in this paper. For instance, the change in behavior situation in different periods is provided in Figure 2.  (1) In previous traceback schemes, after the system sets baseline marking probability (BMP) P 0 , the marking probability is a constant P 0 . The following problems result: (1) when the network is in a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low MP P 0 in this situation can reduce marking tuples routing in the path to improve network performance. However, when the network is not in a safe state, the system should adopt a high marking probability to determine the location of malicious sources in a very short period, thus contributing to network security. Therefore, using a fixed MP cannot optimize network performance. An adaptive probability-marking scheme is proposed in this paper. For instance, the change in an attack behavior situation in different periods is provided in Figure 2.

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to detect malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant parameters are listed in Table 2. (1) In previous traceback schemes, after the system sets baseline marking probability (BMP) , the marking probability is a constant . The following problems result: (1) when the network is in a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low MP in this situation can reduce marking tuples routing in the path to improve network performance. However, when the network is not in a safe state, the system should adopt a high marking probability to determine the location of malicious sources in a very short period, thus contributing to network security. Therefore, using a fixed MP cannot optimize network performance. An adaptive probability-marking scheme is proposed in this paper. For instance, the change in an attack behavior situation in different periods is provided in Figure 2. Thus, the number of attacks is different at different times. Usually, when the attacks are sparse; it is unnecessary to adopt high a MP to avoid damage to the network lifetime. However, when Thus, the number of attacks is different at different times. Usually, when the attacks are sparse; it is unnecessary to adopt high a MP P 0 to avoid damage to the network lifetime. However, when the network is attacked by many malicious nodes, using a low MP P 0 cannot satisfy the network security requirement. TAPMS is used to improve network performance at a lower cost. The MP under different schemes is provided in Figure 3; a fixed MP P 0 is adopted in previous traceback schemes. However, the systems use different MP P b under different network security states in the TAPMS scheme. The average MP in the TAPMS scheme and other schemes with a fixed MP is provided in Figure 4. Because the network is in a safe state for most of the time, the average MP in the TAPMS scheme is lower than that in the other schemes; therefore, the total number of marking tuples in the TAPMS scheme is smaller than that in previous schemes (see Figure 4). Therefore, the TAPMS scheme can improve network lifetime. the network is attacked by many malicious nodes, using a low MP cannot satisfy the network security requirement. TAPMS is used to improve network performance at a lower cost. The MP under different schemes is provided in Figure 3; a fixed MP is adopted in previous traceback schemes. However, the systems use different MP under different network security states in the TAPMS scheme. The average MP in the TAPMS scheme and other schemes with a fixed MP is provided in Figure 4. Because the network is in a safe state for most of the time, the average MP in the TAPMS scheme is lower than that in the other schemes; therefore, the total number of marking tuples in the TAPMS scheme is smaller than that in previous schemes (see Figure 4). Therefore, the TAPMS scheme can improve network lifetime.   The number of detected malicious nodes is provided in Figure 5. When the network is in a safe state, the number of malicious node in the network is smaller, so the number of detected malicious nodes is smaller. However, when the network is not in a safe state, the TAPMS scheme adopts a higher MP.   the network is attacked by many malicious nodes, using a low MP cannot satisfy the network security requirement. TAPMS is used to improve network performance at a lower cost. The MP under different schemes is provided in Figure 3; a fixed MP is adopted in previous traceback schemes. However, the systems use different MP under different network security states in the TAPMS scheme. The average MP in the TAPMS scheme and other schemes with a fixed MP is provided in Figure 4. Because the network is in a safe state for most of the time, the average MP in the TAPMS scheme is lower than that in the other schemes; therefore, the total number of marking tuples in the TAPMS scheme is smaller than that in previous schemes (see Figure 4). Therefore, the TAPMS scheme can improve network lifetime.   The number of detected malicious nodes is provided in Figure 5. When the network is in a safe state, the number of malicious node in the network is smaller, so the number of detected malicious nodes is smaller. However, when the network is not in a safe state, the TAPMS scheme adopts a higher MP.  The number of detected malicious nodes is provided in Figure 5. When the network is in a safe state, the number of malicious node in the network is smaller, so the number of detected malicious nodes is smaller. However, when the network is not in a safe state, the TAPMS scheme adopts a higher MP.
Thus, the probability of detecting malicious nodes is high, resulting in the total number of detected malicious nodes in the TAPMS scheme being greater than that in previous traceback schemes. Therefore, using the TAPMS scheme can improve network security. The number of detected malicious nodes is provided in Figure 5. When the network is in a safe state, the number of malicious node in the network is smaller, so the number of detected malicious nodes is smaller. However, when the network is not in a safe state, the TAPMS scheme adopts a higher MP.  (2) Security for storing marking tuples The distribution of node trust in the network is shown in Figure 6. Many studies show that the distribution of node trust in a network is subject to a logarithmic normal distribution [4]. That is, the trust of most nodes in the network is high, which is consistent with the practice network [6]. Previous schemes do not focus on whether nodes that store marking tuples are safe. If marking tuples are stored in malicious nodes, those marking tuples can be dropped easily, resulting in traceback scheme failure. In the TAPMS scheme, most marking tuples are stored in high trust nodes. Thus, the security of storing marking tuples can be improved, thereby improving the effectiveness of the scheme. This improvement is shown in Figure 7. In previous schemes, the probabilities for storing marking tuples in all nodes are the same. In the TAPMS scheme, the probability of storing marking tuples in low trust nodes is low, and the probability of storing marking tuples in high trust nodes is high. The number of received available marking tuples after a period is provided in Figure 8. Figure 8 shows that the number of received available marking tuples in the TAPMS scheme is greater than that in other schemes, showing the effectiveness of the TAPMS scheme. There are two main differences in the TAPMS scheme compared with previous schemes: (1) the use of adaptive marking probability. Marking probability (MP) is low when network security is high but is large when network security is low.
This scheme can improve network security while reducing the number of transmitted marking tuples, thereby improving network lifetime; (2) nodes with high trust can be selected to store marking tuples to protect the validity of marking tuples. The TAPMS scheme is designed based on these two factors. Thus, the probability of detecting malicious nodes is high, resulting in the total number of detected malicious nodes in the TAPMS scheme being greater than that in previous traceback schemes. Therefore, using the TAPMS scheme can improve network security.
(2) Security for storing marking tuples The distribution of node trust in the network is shown in Figure 6. Many studies show that the distribution of node trust in a network is subject to a logarithmic normal distribution [4]. That is, the trust of most nodes in the network is high, which is consistent with the practice network [6]. Previous schemes do not focus on whether nodes that store marking tuples are safe. If marking tuples are stored in malicious nodes, those marking tuples can be dropped easily, resulting in traceback scheme failure. In the TAPMS scheme, most marking tuples are stored in high trust nodes. Thus, the security of storing marking tuples can be improved, thereby improving the effectiveness of the scheme. This improvement is shown in Figure 7. In previous schemes, the probabilities for storing marking tuples in all nodes are the same. In the TAPMS scheme, the probability of storing marking tuples in low trust nodes is low, and the probability of storing marking tuples in high trust nodes is high. The number of received available marking tuples after a period is provided in Figure 8. Figure 8 shows that the number of received available marking tuples in the TAPMS scheme is greater than that in other schemes, showing the effectiveness of the TAPMS scheme. There are two main differences in the TAPMS scheme compared with previous schemes: (1) the use of adaptive marking probability. Marking probability (MP) is low when network security is high but is large when network security is low. f(x)

Trust
The distribution of nodes trust Figure 6. Distribution of node trust. Figure 6. Distribution of node trust.    This scheme can improve network security while reducing the number of transmitted marking tuples, thereby improving network lifetime; (2) nodes with high trust can be selected to store marking tuples to protect the validity of marking tuples. The TAPMS scheme is designed based on these two factors.

Trust-Based Adaptive Marking Probability Approach
In the TAPMS scheme, the marking probability is divided into two types: (1) when the network is safe, the system adopts a lower MP. This MP is called the baseline marking probability (BMP) p ; (2) When the network is not safe, that is, network security is in a bad situation, the system uses MP p . The marking probability can be calculated through obtaining the status of the network and then broadcast to each node in the network. The marking probability adopted in the network updates occurs every τ. Time slots can be denoted as ≜ { = , , , … , }. Let , denote the trust of node in time slot , which is evaluated by the sink. The trust of all nodes calculated in time slot is as follows: The trust of nodes in the last time slots can be calculated as follows: Then, the average trust of the network can be calculated as follows: where ( ) is an attenuation function that can be shown as follows: When the system calculates the network's trust, it considers the most recent time's evaluation results. ( ) ensures that the recent trust evaluation results have a higher weight [6]. In the TAPMS

Trust-Based Adaptive Marking Probability Approach
In the TAPMS scheme, the marking probability is divided into two types: (1) when the network is safe, the system adopts a lower MP. This MP is called the baseline marking probability (BMP) p 0 ; (2) When the network is not safe, that is, network security is in a bad situation, the system uses MP p a . The marking probability can be calculated through obtaining the status of the network and then broadcast to each node in the network. The marking probability adopted in the network updates occurs every τ. Time slots can be denoted as t fi tt " t 0 , t 1 , t 2 , . . . , t n u. Let c i,j denote the trust of node v i in time slot t j , which is evaluated by the sink. The trust of all nodes calculated in time slot t j is as follows: The trust of nodes in the last w time slots can be calculated as follows: C fi tc 1 , c 2 , . . . , c w u Then, the average trust of the network can be calculated as follows: where h pkq is an attenuation function that can be shown as follows: When the system calculates the network's trust, it considers the most recent w time's evaluation results. h pkq ensures that the recent trust evaluation results have a higher weight [6]. In the TAPMS scheme, the marking probability of the network is calculated according to the network trust. The marking probability function has the following properties: when the network's trust is above a certain threshold, the network adopts baseline marking-probability (BMP)P 0 ; otherwise, the system adopts a high marking probability according to the network's trust. In the TAPMS scheme, the conversion function from the network's trust to the marking probability is as follows: The trust of nodes in the last time slots can be calculated as follows: Then, the average trust of the network can be calculated as follows: where ( ) is an attenuation function that can be shown as follows: When the system calculates the network's trust, it considers the most recent time's evaluation results. ( ) ensures that the recent trust evaluation results have a higher weight [6]. In the TAPMS scheme, the marking probability of the network is calculated according to the network trust. The marking probability function has the following properties: when the network's trust is above a certain threshold, the network adopts baseline marking-probability (BMP) ; otherwise, the system adopts a high marking probability according to the network's trust. In the TAPMS scheme, the conversion function from the network's trust to the marking probability is as follows: where is the baseline trust, is the max trust, and is the result of the network's trust evaluation at the current time; where C 0 is the baseline trust, C h is the max trust, and C is the result of the network's trust evaluation at the current time; hich is evaluated by the sink. The trust of all nodes calculated in time slot is = ∑ , ⁄ des in the last time slots can be calculated as follows: C ≜ , , … , ge trust of the network can be calculated as follows: tenuation function that can be shown as follows: m calculates the network's trust, it considers the most recent time's evaluation es that the recent trust evaluation results have a higher weight [6]. In the TAPMS g probability of the network is calculated according to the network trust. The function has the following properties: when the network's trust is above a certain ork adopts baseline marking-probability (BMP) ; otherwise, the system adopts bability according to the network's trust. In the TAPMS scheme, the conversion twork's trust to the marking probability is as follows: seline trust, is the max trust, and is the result of the network's trust broadcast to each node in the network. The marking probability adopted in the network updates occurs every τ. Time slots can be denoted as ≜ = , , , … , . Let , denote the trust of node in time slot , which is evaluated by the sink. The trust of all nodes calculated in time slot is as follows: = ∑ , ⁄ The trust of nodes in the last time slots can be calculated as follows: Then, the average trust of the network can be calculated as follows: where ( ) is an attenuation function that can be shown as follows: When the system calculates the network's trust, it considers the most recent time's evaluation results. ( ) ensures that the recent trust evaluation results have a higher weight [6]. In the TAPMS scheme, the marking probability of the network is calculated according to the network trust. The marking probability function has the following properties: when the network's trust is above a certain threshold, the network adopts baseline marking-probability (BMP) ; otherwise, the system adopts a high marking probability according to the network's trust. In the TAPMS scheme, the conversion function from the network's trust to the marking probability is as follows: where is the baseline trust, is the max trust, and is the result of the network's trust evaluation at the current time; The major function of the marking probability controller is to adjust the marking probability of the network, which makes the probability equal to the probability calculated by Equation (9). Considering that the trust evaluation result of the network in time slot t j is C j , the calculated marking probability based on Equation (9) is L`C j˘. In fact, the marking probability of the current network is P j ; if L`C j˘ą P j , the system can increase the marking probability of the network. Otherwise, the system decreases the marking probability. In the TAPMS scheme, the adjustment function of the marking probability controller is a simple dynamic model; the change rate of the marking probability of the network is directly proportional to the gradient of the utility function: This scheme can improve network security while reducing the number of transmitted marking tuples, thereby improving network lifetime; (2) nodes with high trust can be selected to store marking tuples to protect the validity of marking tuples. The TAPMS scheme is designed based on these two factors.

Trust-Based Adaptive Marking Probability Approach
In the TAPMS scheme, the marking probability is divided into two types: (1) when the network is safe, the system adopts a lower MP. This MP is called the baseline marking probability (BMP) p ; (2) When the network is not safe, that is, network security is in a bad situation, the system uses MP p . The marking probability can be calculated through obtaining the status of the network and then broadcast to each node in the network. The marking probability adopted in the network updates occurs every τ. Time slots can be denoted as ≜ = , , , … , . Let , denote the trust of node in time slot , which is evaluated by the sink. The trust of all nodes calculated in time slot is as follows: = ∑ , ⁄ The trust of nodes in the last time slots can be calculated as follows: Then, the average trust of the network can be calculated as follows: where ( ) is an attenuation function that can be shown as follows: When the system calculates the network's trust, it considers the most recent time's evaluation results. ( ) ensures that the recent trust evaluation results have a higher weight [6]. In the TAPMS scheme, the marking probability of the network is calculated according to the network trust. The marking probability function has the following properties: when the network's trust is above a certain threshold, the network adopts baseline marking-probability (BMP) ; otherwise, the system adopts a high marking probability according to the network's trust. In the TAPMS scheme, the conversion function from the network's trust to the marking probability is as follows: where is the baseline trust, is the max trust, and is the result of the network's trust evaluation at the current time; The characteristics of the utility functions guarantee that there is an optimum value [6]. In the time interval between the current time t j and the next period t j`1 , the iterative equation of the marking probability of the network can be expressed as follows: The major function of the marking probability controller is to adjust the marking probability of the network, which makes the probability equal to the probability calculated by Equation (9). Considering that the trust evaluation result of the network in time slot is , the calculated marking probability based on Equation (9) is ℒ . In fact, the marking probability of the current network is ; if ℒ > , the system can increase the marking probability of the network. Otherwise, the system decreases the marking probability. In the TAPMS scheme, the adjustment function of the marking probability controller is a simple dynamic model; the change rate of the marking probability of the network is directly proportional to the gradient of the utility function: The characteristics of the utility functions guarantee that there is an optimum value [6]. In the time interval between the current time and the next period , the iterative equation of the marking probability of the network can be expressed as follows: where > 0 indicates the adjustment step of the marking probability of the network; therefore, the marking probability of the network in the next period can be expressed as follows: When the difference between the measured trust and the adopted trust of the marking probability of the network exceeds predetermined threshold ∆, the sink node notifies the nodes that its marking probability should be updated by Equation (13). Therefore, the average marking probability of the entire network is as follows: ( ) is the distribution function of the network's trust. As proved in [16], the amount of data assumed by the nodes at l = hr x + away from the sink is as follows: The number of total marking tuples is as follows: where 10 of 24 of the marking probability controller is to adjust the marking probability of kes the probability equal to the probability calculated by Equation (9). st evaluation result of the network in time slot is , the calculated d on Equation (9) is ℒ . In fact, the marking probability of the current > , the system can increase the marking probability of the network. ecreases the marking probability. In the TAPMS scheme, the adjustment probability controller is a simple dynamic model; the change rate of the e network is directly proportional to the gradient of the utility function: f the utility functions guarantee that there is an optimum value [6]. In the e current time and the next period , the iterative equation of the e network can be expressed as follows: e adjustment step of the marking probability of the network; therefore, the e network in the next period can be expressed as follows: e between the measured trust and the adopted trust of the marking k exceeds predetermined threshold ∆, the sink node notifies the nodes that should be updated by Equation (13). Therefore, the average marking etwork is as follows: nction of the network's trust. As proved in [16], the amount of data assumed away from the sink is as follows: marking tuples is as follows: i > 0 indicates the adjustment step of the marking probability of the network; therefore, the marking probability of the network in the next period can be expressed as follows: The major function of the marking probability controller is to adjust the marking probability of the network, which makes the probability equal to the probability calculated by Equation (9). Considering that the trust evaluation result of the network in time slot is , the calculated marking probability based on Equation (9) is ℒ . In fact, the marking probability of the current network is ; if ℒ > , the system can increase the marking probability of the network. Otherwise, the system decreases the marking probability. In the TAPMS scheme, the adjustment function of the marking probability controller is a simple dynamic model; the change rate of the marking probability of the network is directly proportional to the gradient of the utility function: The characteristics of the utility functions guarantee that there is an optimum value [6]. In the time interval between the current time and the next period , the iterative equation of the marking probability of the network can be expressed as follows: where > 0 indicates the adjustment step of the marking probability of the network; therefore, the marking probability of the network in the next period can be expressed as follows: When the difference between the measured trust and the adopted trust of the marking probability of the network exceeds predetermined threshold ∆, the sink node notifies the nodes that its marking probability should be updated by Equation (13). Therefore, the average marking probability of the entire network is as follows: is the distribution function of the network's trust. As proved in [16], the amount of data assumed by the nodes at l = hr x + away from the sink is as follows:  This scheme can improve network security while reducing the number of transmitted marking tuples, thereby improving network lifetime; (2) nodes with high trust can be selected to store marking tuples to protect the validity of marking tuples. The TAPMS scheme is designed based on these two factors.

Trust-Based Adaptive Marking Probability Approach
In the TAPMS scheme, the marking probability is divided into two types: (1) when the network is safe, the system adopts a lower MP. This MP is called the baseline marking probability (BMP) p ; (2) When the network is not safe, that is, network security is in a bad situation, the system uses MP p . The marking probability can be calculated through obtaining the status of the network and then broadcast to each node in the network. The marking probability adopted in the network updates occurs every τ. Time slots can be denoted as ≜ = , , , … , . Let , denote the trust of node in time slot , which is evaluated by the sink. The trust of all nodes calculated in time slot is as follows: = ∑ , ⁄ The trust of nodes in the last time slots can be calculated as follows: Then, the average trust of the network can be calculated as follows: where ( ) is an attenuation function that can be shown as follows: When the system calculates the network's trust, it considers the most recent time's evaluation results. ( ) ensures that the recent trust evaluation results have a higher weight [6]. In the TAPMS scheme, the marking probability of the network is calculated according to the network trust. The marking probability function has the following properties: when the network's trust is above a certain threshold, the network adopts baseline marking-probability (BMP) ; otherwise, the system adopts a high marking probability according to the network's trust. In the TAPMS scheme, the conversion function from the network's trust to the marking probability is as follows: where is the baseline trust, is the max trust, and is the result of the network's trust evaluation at the current time; When the difference between the measured trust and the adopted trust of the marking probability of the network exceeds predetermined threshold ∆, the sink node notifies the nodes that its marking probability should be updated by Equation (13). Therefore, the average marking probability of the entire network is as follows: f pcq is the distribution function of the network's trust. As proved in [16], the amount of data assumed by the nodes at l = hr`x away from the sink is as follows: The number of total marking tuples is as follows:

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to detect malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant parameters are listed in Table 2. (1) In previous traceback schemes, after the system sets baseline marking probability (BMP) , the marking probability is a constant . The following problems result: (1) when the network is in a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low MP in this situation can reduce marking tuples routing in the path to improve network performance. However, when the network is not in a safe state, the system should adopt a high marking probability to determine the location of malicious sources in a very short period, thus contributing to network security.
Therefore, using a fixed MP cannot optimize network performance. An adaptive probability-marking scheme is proposed in this paper. For instance, the change in an attack behavior situation in different periods is provided in Figure 2. Thus, the number of attacks is different at different times. Usually, when the attacks are sparse; it is unnecessary to adopt high a MP to avoid damage to the network lifetime. However, when where ρ is the node density. From Equation (16)

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability t malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant param listed in Table 2. . The following problems result: (1) when the netw a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting in this situation can reduce marking tuples routing in the path to improve network perfo However, when the network is not in a safe state, the system should adopt a high marking pro to determine the location of malicious sources in a very short period, thus contrib network security.
Therefore, using a fixed MP cannot optimize network performance. An probability-marking scheme is proposed in this paper. For instance, the change in a behavior situation in different periods is provided in Figure 2. Thus, the number of attacks is different at different times. Usually, when the attacks ar it is unnecessary to adopt high a MP to avoid damage to the network lifetime. Howeve in different traceback schemes is only related to P. The value of P depends of f pcq and L pcq; f pcq is the node trust-distribution function and is determined by physical properties of the network. The important parameters in L pcq depend on the value of P 0 . The following discusses how to select optimized P 0 . In this paper, many conclusions are obtained; the utility function between obtained payoff and the number of marking tuples (cost) is a non-linear function [6]. The non-linear function is consistent with the characteristics of the network. That is, when the number of collected marking tuples is small, payoff rises quickly as the number of collected marking tuples increases; therefore, the payoff's utility is high. However, when the number of collected marking tuples reaches a certain point, the system increases the number of collected marking tuples; the growth of the payoff is very small, and its utility is small. Following Ref. [6], Equation (17) is adopted as a utility function for TAPMS:

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to detect malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant parameters are listed in Table 2. , the marking probability is a constant . The following problems result: (1) when the network is in a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low MP in this situation can reduce marking tuples routing in the path to improve network performance.
However, when the network is not in a safe state, the system should adopt a high marking probability to determine the location of malicious sources in a very short period, thus contributing to network security.
Therefore, using a fixed MP cannot optimize network performance. An adaptive probability-marking scheme is proposed in this paper. For instance, the change in an attack behavior situation in different periods is provided in Figure 2.

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the abilit malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant para listed in Table 2. . The following problems result: (1) when the ne a "safe" state, the probability that the system is attacked by malicious nodes is small. Setti in this situation can reduce marking tuples routing in the path to improve network pe However, when the network is not in a safe state, the system should adopt a high marking to determine the location of malicious sources in a very short period, thus contr network security.
Therefore, using a fixed MP cannot optimize network performance. An probability-marking scheme is proposed in this paper. For instance, the change in behavior situation in different periods is provided in Figure 2.

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, th malicious nodes and lifetime; (2) the security for storing marking tuples. Releva listed in Table 2. . The following problems result: (1) when a "safe" state, the probability that the system is attacked by malicious nodes is sma in this situation can reduce marking tuples routing in the path to improve netw However, when the network is not in a safe state, the system should adopt a high m to determine the location of malicious sources in a very short period, thu network security.
Therefore, using a fixed MP cannot optimize network performan probability-marking scheme is proposed in this paper. For instance, the cha behavior situation in different periods is provided in Figure 2. Thus, the number of attacks is different at different times. Usually, when the it is unnecessary to adopt high a MP to avoid damage to the network lifetim (17) where α, β are constant parameters. The obtained payoff is the difference between utility function and cost. The system pays an energy consumption price to send marking tuples; the cost can be obtained from Equations (1) and (2)

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to detect malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant parameters are listed in Table 2. , the marking probability is a constant . The following problems result: (1) when the network is in a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low MP in this situation can reduce marking tuples routing in the path to improve network performance.
However, when the network is not in a safe state, the system should adopt a high marking probability to determine the location of malicious sources in a very short period, thus contributing to network security.
Therefore, using a fixed MP cannot optimize network performance. An adaptive probability-marking scheme is proposed in this paper. For instance, the change in an attack behavior situation in different periods is provided in Figure 2.
, γ, which are constant coefficients. The payoff function of this system can be expressed as follows: K " αlog p1S

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant paramete listed in Table 2. . The following problems result: (1) when the network a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting lo in this situation can reduce marking tuples routing in the path to improve network perform However, when the network is not in a safe state, the system should adopt a high marking proba to determine the location of malicious sources in a very short period, thus contributi network security.
Therefore, using a fixed MP cannot optimize network performance. An ada probability-marking scheme is proposed in this paper. For instance, the change in an behavior situation in different periods is provided in Figure 2. q`β

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the abi malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant pa listed in Table 2. . The following problems result: (1) when the a "safe" state, the probability that the system is attacked by malicious nodes is small. Se in this situation can reduce marking tuples routing in the path to improve network However, when the network is not in a safe state, the system should adopt a high markin to determine the location of malicious sources in a very short period, thus co network security.
Therefore, using a fixed MP cannot optimize network performance. A probability-marking scheme is proposed in this paper. For instance, the change behavior situation in different periods is provided in Figure 2.

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, t malicious nodes and lifetime; (2) the security for storing marking tuples. Relev listed in Table 2. . The following problems result: (1) whe a "safe" state, the probability that the system is attacked by malicious nodes is sm in this situation can reduce marking tuples routing in the path to improve ne However, when the network is not in a safe state, the system should adopt a high m to determine the location of malicious sources in a very short period, th network security.
Therefore, using a fixed MP cannot optimize network performa probability-marking scheme is proposed in this paper. For instance, the ch behavior situation in different periods is provided in Figure 2.

Research on Motivation
This study considers two factors: (1) the marking probability of nod malicious nodes and lifetime; (2) the security for storing marking tuples.
listed in Table 2. . The following problems result: (1 a "safe" state, the probability that the system is attacked by malicious nodes in this situation can reduce marking tuples routing in the path to improv However, when the network is not in a safe state, the system should adopt a to determine the location of malicious sources in a very short perio network security.
Therefore, using a fixed MP cannot optimize network perfo probability-marking scheme is proposed in this paper. For instance, t behavior situation in different periods is provided in Figure 2.
to maximize its payoff is provided in Equation (19)

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to detect malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant parameters are listed in Table 2. , the marking probability is a constant . The following problems result: (1) when the network is in a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low MP in this situation can reduce marking tuples routing in the path to improve network performance.
However, when the network is not in a safe state, the system should adopt a high marking probability to determine the location of malicious sources in a very short period, thus contributing to network security.
Therefore, using a fixed MP cannot optimize network performance. An adaptive probability-marking scheme is proposed in this paper. For instance, the change in an attack behavior situation in different periods is provided in Figure 2.

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to detect malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant parameters are listed in Table 2. , the marking probability is a constant . The following problems result: (1) when the network is in a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low MP in this situation can reduce marking tuples routing in the path to improve network performance.
However, when the network is not in a safe state, the system should adopt a high marking probability to determine the location of malicious sources in a very short period, thus contributing to network security.
Therefore, using a fixed MP cannot optimize network performance. An adaptive probability-marking scheme is proposed in this paper. For instance, the change in an attack behavior situation in different periods is provided in Figure 2.

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to detect malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant parameters are listed in Table 2. , the marking probability is a constant . The following problems result: (1) when the network is in a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low MP in this situation can reduce marking tuples routing in the path to improve network performance.
However, when the network is not in a safe state, the system should adopt a high marking probability to determine the location of malicious sources in a very short period, thus contributing to network security.
Therefore, using a fixed MP cannot optimize network performance. An adaptive probability-marking scheme is proposed in this paper. For instance, the change in an attack behavior situation in different periods is provided in Figure 2.
in the system is a bounded closed set in Euclidean space. The payoff function Equation (18) of the system is continuous on the strategy space [6]. The following proves that the payoff function is a concave function; therefore, there is an optimum value. The first-and second-order derivatives of Equation (18)

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to detect malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant parameters are listed in Table 2. , the marking probability is a constant . The following problems result: (1) when the network is in a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low MP in this situation can reduce marking tuples routing in the path to improve network performance.
However, when the network is not in a safe state, the system should adopt a high marking probability to determine the location of malicious sources in a very short period, thus contributing to network security.

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to detect malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant parameters are listed in Table 2. , the marking probability is a constant . The following problems result: (1) when the network is in a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low MP in this situation can reduce marking tuples routing in the path to improve network performance.
However, when the network is not in a safe state, the system should adopt a high marking probability

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant paramet listed in Table 2.

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to detect malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant parameters are listed in Table 2.

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant param listed in Table 2.  (1) In previous traceback schemes, after the system sets baseline marking probability (BMP) , the marking probability is a constant . The following problems result: (1) when the network is in a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low MP in this situation can reduce marking tuples routing in the path to improve network performance. However, when the network is not in a safe state, the system should adopt a high marking probability to determine the location of malicious sources in a very short period, thus contributing to network security.
Therefore, using a fixed MP cannot optimize network performance. An adaptive probability-marking scheme is proposed in this paper. For instance, the change in an attack behavior situation in different periods is provided in Figure 2. (1) In previous traceback schemes, after the system sets baseline marking probability (BM the marking probability is a constant . The following problems result: (1) when the netwo a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting in this situation can reduce marking tuples routing in the path to improve network perfor However, when the network is not in a safe state, the system should adopt a high marking pro to determine the location of malicious sources in a very short period, thus contribu network security.
Therefore, using a fixed MP cannot optimize network performance. An a probability-marking scheme is proposed in this paper. For instance, the change in an behavior situation in different periods is provided in Figure 2. (1) In previous traceback schemes, after the system sets baseli the marking probability is a constant . The following problems a "safe" state, the probability that the system is attacked by malicio in this situation can reduce marking tuples routing in the path However, when the network is not in a safe state, the system should to determine the location of malicious sources in a very sh network security.
Therefore, using a fixed MP cannot optimize netwo probability-marking scheme is proposed in this paper. For in behavior situation in different periods is provided in Figure 2.  Table 2. (1) In previous traceback schemes, after the system sets baseline marking probability (BMP) the marking probability is a constant . The following problems result: (1) when the network is i a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low M in this situation can reduce marking tuples routing in the path to improve network performance However, when the network is not in a safe state, the system should adopt a high marking probabilit to determine the location of malicious sources in a very short period, thus contributing t network security.
Therefore, using a fixed MP cannot optimize network performance. An adaptiv probability-marking scheme is proposed in this paper. For instance, the change in an attac behavior situation in different periods is provided in Figure 2. Thus, the number of attacks is different at different times. Usually, when the attacks are sparse it is unnecessary to adopt high a MP to avoid damage to the network lifetime. However, whe q be equal to 0, i.e., β´γ " α 1` listed in Table 2. (1) In previous traceback schemes, after the system sets b the marking probability is a constant . The following prob a "safe" state, the probability that the system is attacked by m in this situation can reduce marking tuples routing in the However, when the network is not in a safe state, the system s to determine the location of malicious sources in a ver network security.
Therefore, using a fixed MP cannot optimize n probability-marking scheme is proposed in this paper. F behavior situation in different periods is provided in Figure 2   (1) In previous traceback schemes, after the system s the marking probability is a constant . The following a "safe" state, the probability that the system is attacked b in this situation can reduce marking tuples routing in However, when the network is not in a safe state, the syste to determine the location of malicious sources in a network security.
Therefore, using a fixed MP cannot optimiz probability-marking scheme is proposed in this pape behavior situation in different periods is provided in Figu   Figure 2. Attack times of the e Thus, the number of attacks is different at different t it is unnecessary to adopt high a MP to avoid damag " α β´γ´1 , which leads to Equation (19).

Based on optimized
This study considers two factors: (1) the marking probability of nodes, the ability to detect malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant parameters are listed in Table 2. (1) In previous traceback schemes, after the system sets baseline marking probability (BMP) , the marking probability is a constant . The following problems result: (1) when the network is in a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low MP in this situation can reduce marking tuples routing in the path to improve network performance. However, when the network is not in a safe state, the system should adopt a high marking probability to determine the location of malicious sources in a very short period, thus contributing to network security.
Therefore, using a fixed MP cannot optimize network performance. An adaptive probability-marking scheme is proposed in this paper. For instance, the change in an attack behavior situation in different periods is provided in Figure 2. Thus, the number of attacks is different at different times. Usually, when the attacks are sparse; it is unnecessary to adopt high a MP to avoid damage to the network lifetime. However, when ˚a nd on Equations (9), (14) and (16), the optimized baseline marking probability (BMP) P 0 can be obtained. The Algorithm 1 of the TAPMS scheme is provided. First, all the network trusts are 0.5; as the network operates, the system can increase or decrease its marking probability for different nodes depending on the node trust to achieve an optimal probability.

Research on Motivation
This study considers two factors: (1) the marking probability of nodes, the ability to detect malicious nodes and lifetime; (2) the security for storing marking tuples. Relevant parameters are listed in Table 2. (1) In previous traceback schemes, after the system sets baseline marking probability (BMP) , the marking probability is a constant . The following problems result: (1) when the network is in a "safe" state, the probability that the system is attacked by malicious nodes is small. Setting low MP in this situation can reduce marking tuples routing in the path to improve network performance. However, when the network is not in a safe state, the system should adopt a high marking probability to determine the location of malicious sources in a very short period, thus contributing to network security. Therefore, using a fixed MP cannot optimize network performance. An adaptive probability-marking scheme is proposed in this paper. For instance, the change in an attack behavior situation in different periods is provided in Figure 2. Thus, the number of attacks is different at different times. Usually, when the attacks are sparse; it is unnecessary to adopt high a MP to avoid damage to the network lifetime. However, when according to Equation (19); 3: Compute p 0 according to Equations (9), (14) and (16); 4: Compute the network's trust; 5: Compute the marking probability by Equation (9) of the node; 6: Compute each node's P i`1 by Equation (13); 7: Broadcast each node's P i`1 ; 8: t Ð t`1; //next time t 9: End For

Trusted Storage Approach
The main innovation of the TAPMS scheme is that the marking tuples are stored in nodes with high trust to make stored marking tuples more credible, which can enhance the effectiveness of the network. In the traceback scheme, marking tuples are stored in nodes by logging; therefore, this goal can be reached through adjusting the logging probability. The specific method is that high trust nodes adopt a high logging probability, whereas low trust nodes adopt a low logging probability. In this paper, we assume that node trust can be obtained through monitoring the network (including the traceback scheme). After obtaining node trust, it is possible to implement the proposed TAPMS scheme. The TAPMS scheme uses a simple trust-grading logging method which can be seen from Algorithm 2. The method is that the logging probability of nodes is 0 when node trust is below a certain threshold c s , and nodes adopt low logging probability when node trust is in rc s , c z s. However, nodes adopt a high logging probability when node trust >c z . Marking tuples can be stored in high trust nodes through the above method, thereby enhancing the effectiveness of the traceback scheme. For each time t Do 2: The trust of each node tc 1,t, c 2,t , c 3,t , . . . , c m,t u at time t is computed by the Sink; 3: For each node v i Do 4: Case c i,t 5: r0, c s s : S pv i q " 0; // S pv i q is the logging probability of v i 6: rc s , c z s : S pv i q " ϕ x; // ϕ P p0, 1q is a constant 7: rc z , 1s : S pv i q " min pφx, 1q //φ ą 1 is a constant 8: End For; 9: For each packet B i received by node v i Do; 10: node v i logs marking tuples of packets B i with probability S pv i q;

Performance Analysis and Optimization
This section analyzes the performance of the TAPMS scheme. The performance of the TAPMS scheme primarily includes three parts: (1) Lifetime. The energy consumption is different in different schemes, so the lifetime is also different; (2) Probability of detecting malicious nodes. If the ability to find malicious nodes is stronger in the traceback scheme, the probability of finding malicious nodes is greater; thus, most malicious nodes can be eliminated to ensure the security of the network. The probability of finding a malicious node can be used as an important indicator to express the effectiveness of the scheme; (3) Security for storing marking tuples.

Energy Consumption and Network Lifetime
For a determined wireless sensor network, the energy consumption of a node is primarily composed of two parts. One part is the energy consumption for forwarding data. The other part is the energy consumption for forwarding marking tuples. For different traceback schemes, the energy consumption for forwarding data is the same. Therefore, analyzing the number of marking tuples in different schemes is equivalent to analyzing energy consumption in different schemes. To analyze the number of transmitting marking tuples in different traceback schemes, we assume that the attack times of malicious nodes obey a logarithmic normal distribution [36]. In other words, the attack times of malicious nodes are sparse most of the time (see Figure 9). The logarithmic normal distribution function is shown as Equation (20): The feature density of the logarithmic normal distribution is concentrated in the vicinity of the expectation value, whereas the density in other areas is small. Thus, the function is suited to describing a network in which the time of an attack launched by malicious nodes is usually short. µ determines the concentration degree of attack times; µ being larger shows that the attack behavior is concentrated in a small period. Considering that the marking probability in the MP scheme is , according to [37], node , whose distance from the sink is m, forwards data packets from nodes whose distance from the sink is , + , + 2 , + 3 , … , + | = ( − ) ⁄ . For data packets from nodes whose distance from the sink is + , a marking tuple can be added to the data packet at probability when a data packet is transmitted from one node to another node. The data packet must be transmitted hops from nodes whose distance from the sink is + to node ; then, node forwards the data packet to the next hop. Therefore, the number of marking tuples is ( + 1) . The number of data packets forwarded from nodes whose distance from the sink is + by node , whose distance from the sink is , is ( + ) ⁄ . Therefore, the total number of forwarding marking tuples is ( + 1) ( + ) ⁄ . The total number of forwarding marking tuples of node is shown as Equation (21): Considering that the marking probability in the MP scheme is P mp , according to [37], node v k , whose distance from the sink is l m, forwards data packets from nodes whose distance from the sink is l, l`r, l`2r, l`3r, . . . , l`zr | z " pR´lq {r . For data packets from nodes whose distance from the sink is l`ir, a marking tuple can be added to the data packet at probability P mp when a data packet is transmitted from one node to another node. The data packet must be transmitted i hops from nodes whose distance from the sink is l`ir to node v k ; then, node v k forwards the data packet to the next hop. Therefore, the number of marking tuples is pi`1q P mp .
The number of data packets forwarded from nodes whose distance from the sink is l`ir by node v k , whose distance from the sink is l, is pl`irq {l. Therefore, the total number of forwarding marking tuples is pi`1q P mp pl`irq {l. The total number of forwarding marking tuples of node v k is shown as Equation (21): In the TAPMS scheme, the average marking probability of each node is Equation (22): In Equation (23), N p f pxqq is the function used to convert the attack density function of a node to the density function of network trust. L pCq is the function used to convert trust to marking probability. Obviously, the number of marking tuples forwarded by node v k is given by Equation (23): because network lifetime depends on the lifetime of the node with maximum energy consumption in the network, that is, " E init {E max . The energy consumption of a node includes the energy consumption for forwarding data and the energy consumption for forwarding marking tuples. According to Equation (15), the number of forwarded data packets of the node whose distance from the sink is l m is d l . Because the energy consumption of the node nearest the Sink is maximum, set the distance of the node nearest the sink to l min . Therefore, network lifetime in the MP scheme can be expressed as follows: mp " E init {´e pa d l min`e ma m l min ,mp¯ ( 24) where e pa and e ma represent energy consumption for forwarding a data packet and a marking tuple, respectively. Network lifetime in the TAPMS scheme can be expressed as follows: tapms " E init {´e pa d l min`e ma m l min ,tapms¯ ( 25) In the two schemes represented by Equations (24) and (25), the marking probabilities P mp and P tamps are different. If the network is in a safe state most of the time, the average marking probability P tamps < P mp ; therefore, the network lifetime in the TAPMS scheme is greater than that in previous schemes. Obviously, if the attack times in the network are greater, the network lifetime in TAPMS is the same as the network lifetime in other schemes. Conversely, the marking probability affects not only the network lifetime but also the effectiveness of the security. Thus, reducing the marking probability to a certain value can affect network security. Therefore, the safety effectiveness of the TAPMS scheme is analyzed theoretically in the next section.

Detection Probability Analysis
Recognizing that the probability of malicious nodes is a linear relationship with MP, a higher MP is associated with a higher probability of identifying malicious nodes. At the same time, the probability of identifying malicious nodes is also associated with attack frequency. More-frequent attacks in the network are associated with a higher probability of identifying malicious nodes. As mentioned previously, the network security state can be described by a logarithmic normal distribution. Thus, if MP is P mp , the expectations value for detecting malicious nodes is as follows: where u is an adjustment factor that is used to convert MP P mp to a recognition rate, and v is a coefficient between attack times and the probability of finding malicious nodes. The probability of identifying malicious nodes in TAPMS is as follows:

Average Trust of Storage
Another important difference of the TAPMS scheme compared with previous schemes is that marking tuples are stored on nodes with high trust. Consider that node trust obeys a beta distribution [38]. The mathematical form of the Beta distribution is shown as Equation (28); the variable x ranges from 0-1. Therefore, x can describe node trust in the range (0, 1). When a and b in the Beta distribution are greater than 0, the two parameters determine the shape of the distribution function, as shown in Figure 10: where B pa, bq " ş 1 0 x a´1 p1´xq b´1 dx.  The expectations value of the Beta distribution is shown as Equation (29): In a Beta distribution function, if the value of a is larger and the value of b is smaller, the Beta function can be used to express the distribution of node trust. That is, the trust of most nodes is high, so the average trust of a node is greater than 0.5. The distribution function of node trust is shown in Figure 11. Thus, if the system adopts a conventional storage scheme, namely, that marking tuples are randomly stored on any node, then the average trust of nodes that store marking tuples under this scheme is as follows: If the system adopts the method in which nodes whose trust is less than threshold do not store marking tuples, the average trust of nodes that store marking tuples is as follows: In the TAPMS scheme, nodes with high trust adopt a high probability of storing marking tuples. Because the probability of storing marking tuples is ( ) with representing node trust, using piecewise functions to express node trust can be shown as follows: ( )= 0 , 0 < < , ≤ < , 0 < < 1 min( , 1) , ≤ < 1, 1 < < 3 The average node trust is as follows: If nodes whose trust is less than do not store marking tuples, only is variable in Equation (34). If the storage reliability is , then can satisfy equation Equation (35): Nodes with different trust have different reliabilities for storing marking tuples because trust and reliability satisfy the positive correlation functions. Because R i is the reliability of node v i , the trust of node v i is c i , and γ is a constant, we have the following: Thus, if the system adopts a conventional storage scheme, namely, that marking tuples are randomly stored on any node, then the average trust of nodes that store marking tuples under this scheme is as follows: If the system adopts the method in which nodes whose trust is less than threshold c s do not store marking tuples, the average trust of nodes that store marking tuples is as follows: In the TAPMS scheme, nodes with high trust adopt a high probability of storing marking tuples. Because the probability of storing marking tuples is S pxq with x representing node trust, using piecewise functions to express node trust can be shown as follows: The average node trust is as follows: If nodes whose trust is less than c s do not store marking tuples, only c z is variable in Equation (34). If the storage reliability is A, then c z can satisfy equation Equation (35):

Experimental Results
OMNET++ is used for experimental verification [39]. In the experiment, the setup is as follows: the network radius R = 400, there are 1000 nodes in the network, and there are 100 malicious nodes.

Marking Probability and the Number of Receiving and Sending Marking Tuples
The marking probability of nodes in the network under different network security states is provided in Figure 12. When the network is in a safe state, the marking probability of nodes in the TAPMS scheme is lower than that in other schemes; thus, the number of marking tuples that is transmitted to the sink is smaller. The energy consumption in the TAPMS scheme at this time is less than that in other schemes; therefore, network lifetime can be improved.

Experimental Results
OMNET++ is used for experimental verification [39]. In the experiment, the setup is as follows: the network radius R = 400, there are 1000 nodes in the network, and there are 100 malicious nodes.

Marking Probability and the Number of Receiving and Sending Marking Tuples
The marking probability of nodes in the network under different network security states is provided in Figure 12. When the network is in a safe state, the marking probability of nodes in the TAPMS scheme is lower than that in other schemes; thus, the number of marking tuples that is transmitted to the sink is smaller. The energy consumption in the TAPMS scheme at this time is less than that in other schemes; therefore, network lifetime can be improved. The amounts of receiving marking information and sending marking information under different network security states are provided in Figures 13 and 14, respectively. From Figures 13 and  14, conclusions can be drawn that when the network is in a safe state, the number of receiving and sending marking tuples in TAPMS is smaller than that in other schemes. However, when the network is not in a safe state, the number of receiving and sending marking tuples in the TAPMS scheme is greater than that in a PM scheme with 0.6 marking probability.  The amounts of receiving marking information and sending marking information under different network security states are provided in Figures 13 and 14 respectively. From Figures 13 and 14 conclusions can be drawn that when the network is in a safe state, the number of receiving and sending marking tuples in TAPMS is smaller than that in other schemes. However, when the network is not in a safe state, the number of receiving and sending marking tuples in the TAPMS scheme is greater than that in a PM scheme with 0.6 marking probability.

Experimental Results
OMNET++ is used for experimental verification [39]. In the experiment, the setup is as follows: the network radius R = 400, there are 1000 nodes in the network, and there are 100 malicious nodes.

Marking Probability and the Number of Receiving and Sending Marking Tuples
The marking probability of nodes in the network under different network security states is provided in Figure 12. When the network is in a safe state, the marking probability of nodes in the TAPMS scheme is lower than that in other schemes; thus, the number of marking tuples that is transmitted to the sink is smaller. The energy consumption in the TAPMS scheme at this time is less than that in other schemes; therefore, network lifetime can be improved. The amounts of receiving marking information and sending marking information under different network security states are provided in Figures 13 and 14, respectively. From Figures 13 and  14, conclusions can be drawn that when the network is in a safe state, the number of receiving and sending marking tuples in TAPMS is smaller than that in other schemes. However, when the network is not in a safe state, the number of receiving and sending marking tuples in the TAPMS scheme is greater than that in a PM scheme with 0.6 marking probability. The number of receiving marking(*1000 bits) Rounds TAPMS scheme PM scheme with 0.6 marking probability PM scheme with 1 marking probability Figure 13. Amount of receiving marking information. Figure 13. Amount of receiving marking information. The reason is that in the TAPMS scheme, the marking probability of nodes in the network is increased when the network is not in a safe state, but the marking probability of a node in the network is decreased when the network is in a safe state. The total amount of receiving marking information and sending marking information are provided in Figures 15 and 16, respectively. Figures 15 and 16 show that the total amount of receiving marking information and sending marking information in the TAPMS scheme is less than that in other schemes. Although the amount of receiving and sending marking information in the TAPMS scheme is less than that in other schemes when the network is in a safe state, the amount of receiving and sending marking information in the TAPMS scheme is greater than that in other schemes when the network is not in a safe state.  The reason is that in the TAPMS scheme, the marking probability of nodes in the network is increased when the network is not in a safe state, but the marking probability of a node in the network is decreased when the network is in a safe state. The total amount of receiving marking information and sending marking information are provided in Figures 15 and 16 respectively. Figures 15 and 16 show that the total amount of receiving marking information and sending marking information in the TAPMS scheme is less than that in other schemes. Although the amount of receiving and sending marking information in the TAPMS scheme is less than that in other schemes when the network is in a safe state, the amount of receiving and sending marking information in the TAPMS scheme is greater than that in other schemes when the network is not in a safe state. The reason is that in the TAPMS scheme, the marking probability of nodes in the network is increased when the network is not in a safe state, but the marking probability of a node in the network is decreased when the network is in a safe state. The total amount of receiving marking information and sending marking information are provided in Figures 15 and 16, respectively. Figures 15 and 16 show that the total amount of receiving marking information and sending marking information in the TAPMS scheme is less than that in other schemes. Although the amount of receiving and sending marking information in the TAPMS scheme is less than that in other schemes when the network is in a safe state, the amount of receiving and sending marking information in the TAPMS scheme is greater than that in other schemes when the network is not in a safe state.  The reason is that in the TAPMS scheme, the marking probability of nodes in the network is increased when the network is not in a safe state, but the marking probability of a node in the network is decreased when the network is in a safe state. The total amount of receiving marking information and sending marking information are provided in Figures 15 and 16, respectively. Figures 15 and 16 show that the total amount of receiving marking information and sending marking information in the TAPMS scheme is less than that in other schemes. Although the amount of receiving and sending marking information in the TAPMS scheme is less than that in other schemes when the network is in a safe state, the amount of receiving and sending marking information in the TAPMS scheme is greater than that in other schemes when the network is not in a safe state.   However, the total amount of receiving marking information and sending marking information in the TAPMS scheme remains less than that in other schemes, which can improve network lifetime.

Number of Stored Marking Tuples and Energy Consumption
The total amounts of stored marking information and energy consumption under different network security states are provided in Figures 17 and 18 respectively. Figure 17 shows that when the network is in a safe state, the total amount of stored marking information in TAPMS is less than that in other schemes. However, when the network is not in a safe state, the total amount of stored marking information in TAPMS is greater than that in a PM scheme with 0.6 marking probability. The reason is the same as stated previously. Figure 18 shows that when the network is in a safe state, due to the low marking probability of nodes in the network, the total amount of stored marking information in TAPMS is less than that in other schemes. Therefore, the energy consumption in the TAPMS scheme is less than that in other schemes. However, when the network is not in a safe state, due to the higher marking probability of a node in the network, the total amount of stored marking information in TAPMS is greater than that in a PM scheme with 0.6 marking probability. Therefore, the energy consumption in the TAPMS scheme is greater than that in a PM scheme with 0.6 marking probability. However, the total amount of receiving marking information and sending marking information in the TAPMS scheme remains less than that in other schemes, which can improve network lifetime.

Number of Stored Marking Tuples and Energy Consumption
The total amounts of stored marking information and energy consumption under different network security states are provided in Figures 17 and 18, respectively. Figure 17 shows that when the network is in a safe state, the total amount of stored marking information in TAPMS is less than that in other schemes. However, when the network is not in a safe state, the total amount of stored marking information in TAPMS is greater than that in a PM scheme with 0.6 marking probability. The reason is the same as stated previously. Figure 18 shows that when the network is in a safe state, due to the low marking probability of nodes in the network, the total amount of stored marking information in TAPMS is less than that in other schemes. Therefore, the energy consumption in the TAPMS scheme is less than that in other schemes. However, when the network is not in a safe state, due to the higher marking probability of a node in the network, the total amount of stored marking information in TAPMS is greater than that in a PM scheme with 0.6 marking probability. Therefore, the energy consumption in the TAPMS scheme is greater than that in a PM scheme with 0.6 marking probability.  The amounts of data stored in good nodes and malicious nodes under different network security states are provided in Figures 19 and 20, respectively. Figure 19 shows that when the network is not in a safe state, the amount of data stored in the good node sin the TAPMS scheme is greater than that in the PM scheme with 0.6 marking probability because in the TAPMS scheme, nodes with high trust However, the total amount of receiving marking information and sending marking information in the TAPMS scheme remains less than that in other schemes, which can improve network lifetime.

Number of Stored Marking Tuples and Energy Consumption
The total amounts of stored marking information and energy consumption under different network security states are provided in Figures 17 and 18, respectively. Figure 17 shows that when the network is in a safe state, the total amount of stored marking information in TAPMS is less than that in other schemes. However, when the network is not in a safe state, the total amount of stored marking information in TAPMS is greater than that in a PM scheme with 0.6 marking probability. The reason is the same as stated previously. Figure 18 shows that when the network is in a safe state, due to the low marking probability of nodes in the network, the total amount of stored marking information in TAPMS is less than that in other schemes. Therefore, the energy consumption in the TAPMS scheme is less than that in other schemes. However, when the network is not in a safe state, due to the higher marking probability of a node in the network, the total amount of stored marking information in TAPMS is greater than that in a PM scheme with 0.6 marking probability. Therefore, the energy consumption in the TAPMS scheme is greater than that in a PM scheme with 0.6 marking probability.  The amounts of data stored in good nodes and malicious nodes under different network security states are provided in Figures 19 and 20, respectively. Figure 19 shows that when the network is not in a safe state, the amount of data stored in the good node sin the TAPMS scheme is greater than that in the PM scheme with 0.6 marking probability because in the TAPMS scheme, nodes with high trust The amounts of data stored in good nodes and malicious nodes under different network security states are provided in Figures 19 and 20 respectively. Figure 19 shows that when the network is not in a safe state, the amount of data stored in the good node sin the TAPMS scheme is greater than that in the PM scheme with 0.6 marking probability because in the TAPMS scheme, nodes with high trust are selected to store marking tuples. Thus, the majority of marking tuples are stored in the good nodes, which can avoid the problem of marking information loss. Figure 20 shows that the amount of data stored in malicious nodes in the TAPMS scheme is greater than in the PM scheme. Thus, the performance of the TAPMS scheme is effective. are selected to store marking tuples. Thus, the majority of marking tuples are stored in the good nodes, which can avoid the problem of marking information loss. Figure 20 shows that the amount of data stored in malicious nodes in the TAPMS scheme is greater than in the PM scheme. Thus, the performance of the TAPMS scheme is effective. The amount of data stored in good nodes (bits) Rounds TAPMS scheme PM scheme with 0.6 marking probability PM scheme with 1 marking probability Figure 19. Amount of data stored in good nodes under different network security states. The storage spaces for node and energy consumption of nodes at different distances to the Sink are provided in Figures 21 and 22, respectively. Figure 21 shows that for nodes in the range of 150 m to the sink, the storage space of those nodes in the TAPMS scheme is greater than that in the PM scheme with 0.6 marking probability, which shows that the malicious source node can be determined quickly when the network is attacked by a malicious node. Figure 22 shows that the energy consumption of a node in the TAPMS scheme is the same as the energy consumption in other schemes. Figure 18 shows that the energy consumption of the network in the TAPMS scheme is greater than that in the PM scheme with 0.6 marking probability when the network is not in a safe state. The total energy consumption in the TAPMS scheme ranges up to that in other schemes. Therefore, network lifetime in the TAPMS scheme cannot be damaged. are selected to store marking tuples. Thus, the majority of marking tuples are stored in the good nodes, which can avoid the problem of marking information loss. Figure 20 shows that the amount of data stored in malicious nodes in the TAPMS scheme is greater than in the PM scheme. Thus, the performance of the TAPMS scheme is effective. The amount of data stored in good nodes (bits) Rounds TAPMS scheme PM scheme with 0.6 marking probability PM scheme with 1 marking probability Figure 19. Amount of data stored in good nodes under different network security states. The storage spaces for node and energy consumption of nodes at different distances to the Sink are provided in Figures 21 and 22, respectively. Figure 21 shows that for nodes in the range of 150 m to the sink, the storage space of those nodes in the TAPMS scheme is greater than that in the PM scheme with 0.6 marking probability, which shows that the malicious source node can be determined quickly when the network is attacked by a malicious node. Figure 22 shows that the energy consumption of a node in the TAPMS scheme is the same as the energy consumption in other schemes. Figure 18 shows that the energy consumption of the network in the TAPMS scheme is greater than that in the PM scheme with 0.6 marking probability when the network is not in a safe state. The total energy consumption in the TAPMS scheme ranges up to that in other schemes. Therefore, network lifetime in the TAPMS scheme cannot be damaged. The storage spaces for node and energy consumption of nodes at different distances to the Sink are provided in Figures 21 and 22 respectively. Figure 21 shows that for nodes in the range of 150 m to the sink, the storage space of those nodes in the TAPMS scheme is greater than that in the PM scheme with 0.6 marking probability, which shows that the malicious source node can be determined quickly when the network is attacked by a malicious node. Figure 22 shows that the energy consumption of a node in the TAPMS scheme is the same as the energy consumption in other schemes. Figure 18 shows that the energy consumption of the network in the TAPMS scheme is greater than that in the PM scheme with 0.6 marking probability when the network is not in a safe state. The total energy consumption in the TAPMS scheme ranges up to that in other schemes. Therefore, network lifetime in the TAPMS scheme cannot be damaged.

Security and Lifetime Performance
The times (or the marking tuples) for receiving malicious nodes under different network security states are provided in Figure 23. When the network is in a safe state, that is, in rounds 1, 11, and 12, the time for receiving a malicious node in the TAPMS scheme is less than that in other schemes. However, the time for receiving a malicious node in the TAPMS scheme is greater than that in the PM scheme with 0.6 marking the probability when the network is not in a safe state. The reason is that when the network is not in a safe state, the number of attacks launched by malicious nodes is increased. To determine the malicious source node as soon as possible, the marking probability of a node can be increased in the TAPMS scheme. Therefore, the number of receiving malicious nodes is increased. However, when the network is in a safe state, the number of attacks launched by malicious nodes is smaller. The marking probability of a node can be decreased to save energy, showing that the TAPMS scheme can adjust the marking probability with the change of the network security state. The system can determine the malicious source node quickly using the TAPMS scheme when the network is not in a safe state, illustrating the effectiveness of the TAPMS scheme.

Security and Lifetime Performance
The times (or the marking tuples) for receiving malicious nodes under different network security states are provided in Figure 23. When the network is in a safe state, that is, in rounds 1, 11, and 12, the time for receiving a malicious node in the TAPMS scheme is less than that in other schemes. However, the time for receiving a malicious node in the TAPMS scheme is greater than that in the PM scheme with 0.6 marking the probability when the network is not in a safe state. The reason is that when the network is not in a safe state, the number of attacks launched by malicious nodes is increased. To determine the malicious source node as soon as possible, the marking probability of a node can be increased in the TAPMS scheme. Therefore, the number of receiving malicious nodes is increased. However, when the network is in a safe state, the number of attacks launched by malicious nodes is smaller. The marking probability of a node can be decreased to save energy, showing that the TAPMS scheme can adjust the marking probability with the change of the network security state. The system can determine the malicious source node quickly using the TAPMS scheme when the network is not in a safe state, illustrating the effectiveness of the TAPMS scheme.

Security and Lifetime Performance
The times (or the marking tuples) for receiving malicious nodes under different network security states are provided in Figure 23. When the network is in a safe state, that is, in rounds 1, 11, and 12, the time for receiving a malicious node in the TAPMS scheme is less than that in other schemes. However, the time for receiving a malicious node in the TAPMS scheme is greater than that in the PM scheme with 0.6 marking the probability when the network is not in a safe state. The reason is that when the network is not in a safe state, the number of attacks launched by malicious nodes is increased. To determine the malicious source node as soon as possible, the marking probability of a node can be increased in the TAPMS scheme. Therefore, the number of receiving malicious nodes is increased. However, when the network is in a safe state, the number of attacks launched by malicious nodes is smaller. The marking probability of a node can be decreased to save energy, showing that the TAPMS scheme can adjust the marking probability with the change of the network security state. The system can determine the malicious source node quickly using the TAPMS scheme when the network is not in a safe state, illustrating the effectiveness of the TAPMS scheme.
Network lifetimes under different r and different lengths of marking information are given in Figures 24 and 25. Figure 24 shows that network lifetime in the TAPMS scheme is greater than that in other schemes. Figure 25 implies that: (1) a longer length of marking information implies a smaller network lifetime and (2) network lifetime in the TAPMS scheme is greater than that in other schemes.  Figure 24 shows that network lifetime in the TAPMS scheme is greater than that in other schemes. Figure 25 implies that: (1) a longer length of marking information implies a smaller network lifetime and (2) network lifetime in the TAPMS scheme is greater than that in other schemes.   Network lifetimes under different r and different lengths of marking information are given in Figures 24 and 25. Figure 24 shows that network lifetime in the TAPMS scheme is greater than that in other schemes. Figure 25 implies that: (1) a longer length of marking information implies a smaller network lifetime and (2) network lifetime in the TAPMS scheme is greater than that in other schemes.  Network lifetimes under different r and different lengths of marking information are given in Figures 24 and 25. Figure 24 shows that network lifetime in the TAPMS scheme is greater than that in other schemes. Figure 25 implies that: (1) a longer length of marking information implies a smaller network lifetime and (2) network lifetime in the TAPMS scheme is greater than that in other schemes.