A High-level Architecture for Intrusion Detection on Heterogeneous Wireless Sensor Networks: Hierarchical, Scalable and Dynamic Reconfigurable

Abstract

Networks protection against different types of attacks is one of most important posed issue into the network and information security domains. This problem on Wireless Sensor Networks (WSNs), in attention to their special properties, has more importance. Now, there are some of proposed solutions to protect Wireless Sensor Networks (WSNs) against different types of intrusions; but no one of them has a comprehensive view to this problem and they are usually designed in single-purpose; but, the proposed design in this paper has been a comprehensive view to this issue by presenting a complete Intrusion Detection Architecture (IDA). The main contribution of this architecture is its hierarchical structure; i.e. it is designed and applicable, in one, two or three levels, consistent to the application domain and its required security level. Focus of this paper is on the clustering WSNs, designing and deploying Sensor-based Intrusion Detection System (SIDS) on sensor nodes, Cluster-based Intrusion Detection System (CIDS) on cluster-heads and Wireless Sensor Network wide level Intrusion Detection System (WSNIDS) on the central server. Suppositions of the WSN and Intrusion Detection Architecture (IDA) are: static and heterogeneous network, hierarchical, distributed and clustering structure along with clusters' overlapping. Finally, this paper has been designed a questionnaire to verify the proposed idea; then it analyzed and evaluated the acquired results from the questionnaires

Weaknesses, Vulnerabilities And Elusion Strategies Against Intrusion Detection Systems

“…• A hardware or software or combinational system, with defensive-aggressive approach to protect information, systems and networks [3,8,17]; • Usable on host, network [2,11] and application levels;…”

“…• It analyzes the system or network traffic or controls the incoming connections to different ports, and then it detects the occurring sabotage/vandalism; • It can detects known attacks, unusual traffic, harmful data, misuse and unauthorized access to the systems and networks by internal users or external intruders [2,7]; • It inferences by using deterministic methods (based on patterns of known attacks) or nondeterministic methods (to detecting new attacks and anomalies); • It can determine the intruder's identity and tracking him/her/it; • It informs and notifies to the security manager by different types of warnings or notifications; sometimes, it disconnects the suspicious connections or blocks malicious traffic [2,3]; In general, three main functionalities of IDSs are including monitoring (evaluation), analyzing (detection) and responding (reporting) to the occurring attacks on computer systems and networks [3,8]. There are two stages to configure IDS, consisting of attack's signs and management arbitrary events [8].…”

“…• Setting up the Network Interface Card (NIC) on promiscuous mode and eavesdropping network traffic [2,11]; • Capturing the transmitting network packets [3,14];…”

An Introduction to Various Basic Concepts of Clustering Techniques on Wireless Sensor Networks

“…Wireless Sensor Networks (WSNs) are homogeneous or heterogeneous systems consist of many small devices, called sensor nodes, that monitoring different environments in cooperative; i.e. sensor nodes cooperate to each other and combine their local data to reach a global view of the operational environment; they also can operate autonomously [1,2]. In WSNs there are two other components, called "aggregation points" (i.e.…”

“…the Sink deployment location), which have more powerful resources and capabilities than usual sensor nodes. As shown in Figure1, cluster-heads (CHs) collect information from their nearby sensor nodes, aggregate and forward them to the base station (Sink) to process gathered data [1,3,4]. Factors such as wireless, unsafe, unprotected and shared nature of communication channel, untrusted and broadcast transmission media, deployment in hostile and open environments, automated and unattended nature and limited resources, make WSNs vulnerable and susceptible to many types of criteria; therefore, in attending to the WSNs' constraints in energy resources and radio transceiver power, clustering is a vital and complex requirement for these networks.…”