Algorithm 4. Procedure D. Procedure (D): $IDS\_Engine\left(HBC and IVB\right)$

Input: $Data[a(ma{c}^i)]$ Output: Suspicious events detection 1. From Procedure C (step 2) 2. Set node’s internal intrusion dataset $I\left(f\right)$ 3. Get $events (a(ma{c}^i))$ at node $n^i$; sender or forwarding node 4. Call $IDS\_Engine\left(HBC and IVB\right)$ at $n^i$             $If \left(a(ma{c}^i,IH{F}^i)\right)==TRUE):$              Call IDS rule engine functions              Start $ule set\left(a\right)$; $a-traffic attributes$, Table 1.              Validate $If \left(MAC\_i\left(n^i\right)==TRUE\right)$              Validate $If \left(MAC\_i\left(p\left(n^i\right)\right)==MAC\_i\left(pr\left(n^i\right)\right)\right)$              Validate $If \left(B\left(p\left(n^i\right)\right)==B\left(pr\left(n^i\right)\right)\right)$        $pr\left(n^i\right)-Preceding Node;B\left(p\left(n^i\right)\right)-Blocked identifiers,$         $MA{C}_i-Wireless Physical Address of sensor node$ 5. Start rule-based classification function,           $C^{RF}={\displaystyle \sum _{i=1}^N}f(c^1,c^2,c^3\dots \dots c^N)\forall C(A{X}^i)$ 6. Set event classifier logs for each node 7. Update the logs for each session 8. Redo for all channels

End of Procedure (D)