An Adaptive Protection System for Sensor Networks Based on Analysis of Neighboring Nodes

Abstract

Creation and operation of sensor systems is a complex challenge not only for industrial and military purposes but also for consumer services (“smart city”, “smart home”) and other applications such as agriculture (“smart farm”, “smart greenhouse”). The use of such systems gives a positive economic effect and provides additional benefits from various points of view. At the same time, due to a large number of threats and challenges to cyber security, it is necessary to detect attacks on sensor systems in a timely manner. Here we present an anomaly detection method in which sensor nodes observe their neighbors and detect obvious deviations in their behavior. In this way, the community of neighboring nodes works collectively to protect one another. The nodes record only those parameters and attributes that are inherent in any node. Regardless of the node’s functionality, such parameters include the amount of traffic passing through the node, its Central Processing Unit (CPU) load, as well as the presence and number of packets dropped by the node. Our method’s main goal is to implement protection against the active influence of an internal attacker on the whole sensor network. We present the anomaly detection method, a dataset collection strategy, and experimental results that show how different types of attacks can be distinguished in the data produced by the nodes.

Trusted Operation of Cyber-Physical Processes Based on Assessment of the System’s State and Operating Mode

“…Although the value was not reduced to zero during the attack, it reached 0.1. This is due to the fact that as a result of the attack, the spoofed UAV simply smoothly deviated from the route, and as a result of a different unforeseen circumstance, it fell [ 38 ]. At the same time, the analysis of different groups of parameters can make it possible to determine what caused the failure.…”

GPS-Spoofing Attack Detection Technology for UAVs Based on Kullback–Leibler Divergence

“…First, the concept of a sliding window is used throughout, where the divergence is calculated not only for newly received values but also for those values that were previously present in the sample. Second, Xiang et al consider detection of low-intensity Denial-of-Service attacks [40]. Consequently, they also assume that even insignificant new changes affecting the parameters of the environment of the system can be fixed in an atypical way.…”

“…Therefore, we also used the Poisson distribution [16,41]. The Poisson model usually describes a scheme of rare events [40,41]. Under certain assumptions about the nature of random events, the number of events that occur over a fixed period or in a fixed region of space can obey the following Poisson distributions,…”