In the trivial case, we see that a single node detects the
same percentage of attacks as the percentage of traffic that it
analyses. When more nodes are added to a neighbourhood,
a greater number of attacks is detected even though the
percentage of packets being analysed stays the same for each
node. This is because multiple nodes randomly analysing
traffic increases the total amount of unique traffic that is
analysed by the neighbourhood as a whole. Our simulations
show that 1 node listening to a random 30% of network events
identifies 30% of attacks, while 5 nodes listening to their own
random 30% of network events are able to identify more than
80% of network attacks. As the number of nodes continues to
increase, we notice that the benefit to be gained (in terms of
percentage of attacks detected) from increasing the amount of
nodes decreases.