An Efficient Hybrid Anomaly Detection Scheme Using K-Means Clustering for Wireless Sensor Networks

Abstract

Sensor nodes in a wireless sensor network (WSN) may be lost due to enervation or malicious attacks by an adversary. WSNs deployed for several applications including military applications are prone to various attacks, which degrade the network performance very rapidly. Hybrid anomaly is a type of anomaly that contains the different types of attacker nodes such as blackhole, misdirection, wormhole etc. These multiple attacks can be launched in the network using the hybrid anomaly. In this situation, it is very difficult to find out which kind of attacker nodes are activated in the network. This motivates us to design a robust and efficient secure intrusion detection approach in order to extend the lifetime of a WSN. In this paper, we aim to propose a new intrusion detection technique for hybrid anomaly, which uses the existing data mining algorithm, called K-means clustering. For the detection purpose, patterns of intrusions are built automatically by the K-means clustering algorithm over training data. After that intrusions are detected by matching network activities against these detection patterns. We evaluate our approach over a WSN dataset that is created using Opnet modeler, which contains various attributes, such as endto-end delay, traffic sent and traffic received. The training dataset contains the normal values of the network parameters. The testing dataset is created in actual working mode consists of normal and abnormal values of the network parameters. The proposed technique has the ability to detect two types of malicious nodes: blackhole and misdirection nodes. Our scheme achieves 98.6 % detection rate and 1.2 % false positive rate, which are significantly better than the existing related schemes.

RAD‐EI: A routing attack detection scheme for edge‐based Internet of Things environment

“…Assume that each packet sent by a node has unique sequence number in an increasing order, we denote t x ( j , k ) as the “receiving time of packet j on node k with respect to the perfect clock t r ( j , k ) and transmitting time of packet j on node k .” Transmission time or reception time is considered as the “time just before the first byte of a packet is transmitted or received.” Let P and Q be the source and destination nodes in a particular path. Then, t r ( j , P ) is the “generation time of packet j on the source node P .” The “end‐to‐end delay of the packet j for some path” can be then estimated as follows: If the “waiting time for packet j at node k on the path” be denoted by t w ( j , k ), we have t w ( j , k )= t x ( j , k )− t r ( j , k ). It is worth noting that the “waiting time t w ( j , k ) contains backoff time on node to contend for the channel.” Henceforth, the “end‐to‐end delay” is estimated as follows: where n is the “number of nodes along with that path.” Note that, in RAD‐EI, P is a regular IoT sensor, and Q is an edge node.…”

“…If these attacker nodes are present, the information may not reach to the destination within a specific time. Moreover, information may be lost or modified, which may also create more energy disbursement …”

“…Therefore, it becomes very important to provide an efficient solution for such kind of attack. In this paper, an intrusion detection framework has been suggested to handle routing attack that may happen in an edge‐based IoT environment …”

A method for identifying faulty cells using a classification tree-based UE diagnosis in LTE

“…the user diagnosis), which is equivalent to that obtained from applying the classification tree, can be used for cell diagnosis. The k -means clustering has previously been applied to fault detection in the context of wireless networks [46].…”

Intrusion Detection System in Wireless Sensor Networks: A Review

“…The anomaly based model has a high detection rate and seldom classifies an actual intrusion as a normal packet, but it has a large false positive rate (FPR) i.e normal packets are defined as abnormal. Also as suggested in [11], there could be attacks due to hybrid anomaly which consists of multiple anomaly attacks, for which he proposes a model which has a detection technique based on K-means clustering. To improve on the disadvantages of these two conventional methods, a hybrid of the two IDS is usually incorporated known as a Hybrid Intrusion Detection System (HIDS).…”