| |
Sybil Attacks in Wireless Sensor Network
We introduces a new approach that addresses data contamination problems
from attacks in unattended wireless sensor networks. We propose a
sliding-window based spatio-temporal correlation analysis called
“Abnormal Relationships Test (ART)” to effectively detect, respond and
immune to inserted spoofed data from both various-ID impersonators and
compromised nodes. Also a systematic approach is given to identify the
appropriate sliding window size and correlation coefficient threshold.
Our study shows that correlation property of observed phenomenon is not
always transitive, different phenomenon from same set of nodes at the
same or different period of time can have different correlation
coefficients. Our simulation results reveal interesting relationships of
outlier percentage and correlation coefficient. With proper parameter
setting ART achieves high attack detection rate (90% for correlated
attacks and 94% for random attacks even with 100% data insertion).
Figure 1 shows example scenarios of one attacker trying to insert data to
active sensing/forwarding nodes while pretending to be a set of other valid
nodes (especially inactive/destroyed nodes)
Architecture
We propose the Abnormal Relationships Test (ART), misbehavior detection
mechanism, to alleviate malicious data insertion problem. The ART
distributively analyzes integrity of data set relationships as well as
verifies data ownership among neighbors in WSN. It immunes to spread
blame from sybil nodes and not suffer from high false positive.
Furthermore, it is able to examine small data set with minimal bias.
The ART has 2 main modules
- Statistical Analysis Module
- Authentication Module
Figure 2 Abnormal Relation Test Modules in each sensor node
ART Protocol
- Obtain the sensor readings of all neighbors of node i
- Verify data timestamp if schedule is known
- Calculate the correlation coefficient and t*-value for each neighbor.
- Request additional data if number of data is insufficient.
- If either test result drop below predefined threshold, authenticate the
suspected node(s). Otherwise, forward data to next hop.
- If suspected node(s) can verify their identity, increment the associated
counter by one and forward the packet to next hop. If counter exceeds threshold,
drop packet and report to sink.
- If suspected node(s) fails to verify its identity, drop packets and
report to sink.
- Adjusting window size based on observed outlier percentage and correlation
level until reaching min/max window size
- Randomly authenticate good neighbors with probability p.
Please see details of our statistical analysis and results in the link below.
Publications |
