An Improved ARIMA-Based Traffic Anomaly Detection Algorithm for Wireless Sensor Networks

Abstract

Traffic anomaly detection is emerging as a necessary component as wireless networks gain popularity. In this paper, based on the improved Autoregressive Integrated Moving Average (ARIMA) model, we propose a traffic anomaly detection algorithm for wireless sensor networks (WSNs) which considers the particular imbalanced, nonstationary properties of the WSN traffic and the limited energy and computing capacity of the wireless sensors at the same time. We systematically analyze the characteristics of WSN traffic, the causes of WSN abnormal traffic, and the latest related research and development. Specifically, we improve the traditional time series ARIMA model to make traffic prediction and judge the traffic anomaly in a WSN. Simulated and real WSN traffic data gathered from University of North Carolina are used to carry out simulations on Matlab. Simulation results and comparative analyses demonstrate that our proposed WSN traffic anomaly detection scheme has better anomaly detection accuracy than traditional traffic anomaly detection algorithms.

Using Temporal and Topological Features for Intrusion Detection in Operational Networks

“…A summary of the related work is listed in Table 1. There are reviews addressing the chal- Scientific Work Reviews [19,27] Graph-based methods [2,12,13,36,37,41,42] Graph-based and time-sensitive methods [1,45] Machine learning-based [6,14,32] Statistical processes [33,44,48,50] Wavelet analysis [25,31,35] Industrial Intrusion Detection [3,15,18,20,23,28,34,38,39,46] lenge of anomaly detection for intrusion detection. García-Teodoro et al address the challenges of this field of work while presenting techniques and systems [19].…”

“…A common approach is using Auto-Regressive Integrated Moving Average (ARIMA) to model time series behaviour [33,48], Tabatabaie et al include a chaotic behaviour prediction into their ARIMA model [44]. Yu et al present an anomaly detection scheme based on ARIMA for Wireless Sensor Networkss (WSNs) [50].…”

Traffic Anomaly Detection Algorithm for Wireless Sensor Networks Based on Improved Exploitation of the GM(1,1) Model

“…Usually, the methods with relatively bad and bad independence are optimization and assist methods [16]. The method, which is based on feature and behavior, demands that feature database is built, which needs abundant data.…”

A Novel Intrusion Detection Approach Based on Chaos Theory in Wireless Sensor Networks

“…Specifically, by monitoring behaviors of its neighbors and using EKF to predict their future states, each node aims at setting up a normal range of the neighbors' future transmitted aggregated values, and further apply an algorithm of combining cumulative summation and generalized likelihood ratio to increase detection sensitivity, but the EKF has the drawback of filter divergence, it will lead to an inaccurate prediction. In [4] a traffic prediction-based intrusion detection technology is proposed. In [5] presents an intrusion detection based on statistics anomaly in WSNs, by establish models for some system characteristics in normal state of the sensor nodes, and detects the intrusion through the deviation degree of observed values to normal model.…”