Improving sensor network immunity under worm attacks: A software diversity approach

Abstract

Because of cost and resource constraints, sensor nodes do not have a complicated hardware architecture or operating system to protect program safety. Hence, the notorious buffer-overflow vulnerability that has caused numerous Internet worm attacks could also be exploited to attack sensor networks. We call the malicious code that exploits a buffer-overflow vulnerability in a sensor program sensor worm. Clearly, sensor worm will be a serious threat, if not the most dangerous one, when an attacker could simply send a single packet to compromise the entire sensor network. Despite its importance, so far little work has been focused on sensor worms.In this work, we first illustrate the feasibility of launching sensor worms through real experiments on Mica2 motes. Inspired by the survivability through heterogeneity philosophy, we then explore the technique of software diversity to combat sensor worms. Given a limited number of software versions, we design an efficient algorithm to assign the appropriate version of software to each sensor, so that sensor worms are restrained from propagation. We also examine the impact of sensor node deployment errors on worm propagation, which directs the selection of our system parameters based on percolation theory. Finally, extensive analytical and simulation results confirm the effectiveness of our scheme in containing sensor worms.

Toward Software Diversity in Heterogeneous Networked Systems

“…Its solutions is a natural option in modelling a wide range of real-life problem for making globally optional decision [14] [4]. In most cases, however, the basic graph coloring problem fails to model some real-life problems where additional constraints have to be satisfied.…”

“…Data randomization [10] is another randomized-based approach, which applies masks on data in the memory, so that the attacker cannot determine memory regions that are associated with particular objects. Diversity at the network level is achieved by using different applications [4] [5], operating systems, and shuffling techniques within a networked system [11]. N-version programming was introduced in the 1970s which depends on functionally equivalent versions of the same program and monitors the behavior of the variants in order to detect divergence of the results [12].…”

“…In contrast to homogeneous systems by software monoculture, heterogeneous architectures are expected to have higher survivability [3][4][5]. This point is very much like the maintenance of genetic and ecosystem diversity in biology.…”

Distributed Software-Attestation Defense against Sensor Worm Propagation

“…To defend against the sensor worm attacks, several schemes are proposed to prevent worm propagation in sensor networks [1][2][3]12]. Yang et al [3] first applied a software diversity technique to prevent worm propagation in sensor networks.…”

“…To meet this goal, several schemes have been developed for worm defense in the sensor network [1][2][3]. The key idea of these schemes prevents worm propagation by enforcing two adjacent nodes to have distinct software versions, leading to worm dissemination failure between two adjacent nodes.…”