Anomaly Detection Based Secure In-Network Aggregation for Wireless Sensor Networks

Abstract

-Secure in-network aggregation in Wireless Sensor Networks (WSNs) is a necessary and challenging task. In this paper, we first propose integration of system monitoring modules and intrusion detection modules in the context of WSNs. We propose an Extended Kalman Filter (EKF) based mechanism to detect false injected data. Specifically, by monitoring behaviors of its neighbors and using EKF to predict their future states (actual in-network aggregated values), each node aims at setting up a normal range of the neighbors' future transmitted aggregated values. This task is challenging because of potentially high packet loss rate, harsh environment, sensing uncertainty, etc. We illustrate how to use EKF to address this challenge to create effective local detection mechanisms. Using different aggregation functions (average, sum, max, and min), we present how to obtain a theoretical threshold. We further apply an algorithm of combining Cumulative Summation (CUSUM) and Generalized Likelihood Ratio (GLR) to increase detection sensitivity. To overcome the limitations of local detection mechanisms, we illustrate how our proposed local detection approaches work together with the system monitoring module to differentiate between malicious events and emergency events. We conduct experiments and simulations to evaluate local detection mechanisms under different aggregation functions.

Detecting Malicious Data Injections in Wireless Sensor Networks

“…This is not surprising as finding real attack data in existing WSN deployments is difficult. In fact, two approaches have been broadly adopted to evaluate the algorithms for detection of malicious data injections: simulation [Sun et al 2013;Liu et al 2007;Rezvani et al 2013;Atakli et al 2008;Bankovic et al 2010;Oh et al 2012;Bao et al 2012;Lim and Choi 2013] and injection of attacks in real datasets [Tanachaiwiwat and Helmy 2005;Chatzigiannakis and Papavassiliou 2007].…”

“…Detection of malicious data injections has been addressed with two main approaches so far: anomaly detection (e.g., [Tanachaiwiwat and Helmy 2005;Liu et al 2007;Sun et al 2013]) and trust management (e.g., [Atakli et al 2008;Bao et al 2012;Oh et al 2012]). While anomaly detection defines normal behaviours to infer the presence of anomalies, trust management evaluates the confidence level (trustworthiness) that a sensor's behaviour is normal.…”

“…The use of a Markovian process, modelled with a Kalman filter, forms the basis of the Extended Kalman Filter (EKF) based algorithm by Sun et al [2013]. Here, each sensor builds up a prediction for its neighbours as a function of the neighbours' previous reading.…”

“…Distinguishing Malicious Interference from Events. In the literature, malicious interference is distinguished from events through an agreement-based strategy [Liu et al 2007;Atakli et al 2008;Wang et al 2010;Oh et al 2012;Lim and Choi 2013;Sun et al 2013], i.e. the sensor's information is first used to decide about the presence of an event and then sensors which did not support the final decision are identified as malicious.…”

Development of an Energy- Efficient, Secure and Reliable Wireless Sensor Networks Routing Protocol Based on Data Aggregation and User Authentication

“…The communication overhead is considerably reduced by avoiding the verification of aggregation integrity. Sun et al (2013) proposed a secure in-network data aggregation with anomaly detection in WSNs. The false injected data are detected using Extended Kalman Filter (EKF) based mechanism.…”