Decentralized intrusion detection in wireless sensor networks

ABSTRACT

Wireless sensor networks (WSNs) have many potential applications. Furthermore, in many scenarios WSNs are of interest to adversaries and they become susceptible to some types of attacks since they are deployed in open and unprotected environments and are constituted of cheap small devices. Preventive mechanisms can be applied to protect WSNs against some types of attacks. However, there are some attacks for which there is no known prevention methods. For these cases, it is necessary to use some mechanism of intrusion detection. Besides preventing the intruder from causing damages to the network, the intrusion detection system (IDS) can acquire information related to the attack techniques, helping in the development of prevention systems. In this work we propose an IDS that fits the demands and restrictions of WSNs. Simulation results reveal that the proposed IDS is efficient and accurate in detecting different kinds of simulated attacks.

REFERENCES

• 1: Yi-an Huang , Wenke Lee, A cooperative intrusion detection system for ad hoc networks, Proceedings of the 1st ACM workshop on Security of ad hoc and sensor networks, October 31, 2003, Fairfax, Virginia [doi>10.1145/986858.986877]
• 2: I. Balepin, S. Maltsev, J. Rowe, and K. Levitt, Using specification-based intrusion detection for automated response, in Proc of the 6th Int'l Symp on Recent Advances in Intrusion Detection, September 2003.
• 3: J. Deng, R. Han, and S. Mishra, A performance evaluation of intrusion-tolerant routing in wireless sensor networks, in Proc of IEEE 2nd Int'l Workshop on Info Processing in Sensor Networks, April 2003, pp. 349--364.
• 4: Y.-C. Hu, A. Perrig, and D. B. Johnson, Packet leashes: A defense against wormhole attacks in wireless networks, in Proc of IEEE Infocomm 2003, 2003.
• 5: Ming-Yuh Huang , Robert J. Jasper , Thomas M. Wicks, A large scale distributed intrusion detection framework based on attack strategy analysis, Computer Networks: The International Journal of Computer and Telecommunications Networking, v.31 n.23-24, p.2465-2475, Dec. 1999 [doi>10.1016/S1389-1286(99)00114-0]
• 6: Koral Ilgun, USTAT: A Real-Time Intrusion Detection System for UNIX, Proceedings of the 1993 IEEE Symposium on Security and Privacy, p.16, May 24-26, 1993
• 7: Koral Ilgun , R. A. Kemmerer , Phillip A. Porras, State Transition Analysis: A Rule-Based Intrusion Detection Approach, IEEE Transactions on Software Engineering, v.21 n.3, p.181-199, March 1995 [doi>10.1109/32.372146]
• 8: Chris Karlof , Naveen Sastry , David Wagner, TinySec: a link layer security architecture for wireless sensor networks, Proceedings of the 2nd international conference on Embedded networked sensor systems, November 03-05, 2004, Baltimore, MD, USA [doi>10.1145/1031495.1031515]
• 9: C. Karlof and D. Wagner, Secure routing in wireless sensor networks: Attacks and countermeasures, in Proc of 1st IEEE Int'l Workshop on Sensor Network Protocols and Applications, 2003.
• 10: C. Ko , M. Ruschitzka , K. Levitt, Execution monitoring of security-critical programs in distributed systems: a Specification-based approach, Proceedings of the 1997 IEEE Symposium on Security and Privacy, p.175, May 04-07, 1997
• 11: S. Kumar and E. H. Spafford, A software architecture to support misuse intrusion detection, in Proc of the 18th Nat'l Info Security Conf, 1995, pp. 194--204.
• 12: Philip Levis , Nelson Lee , Matt Welsh , David Culler, TOSSIM: accurate and scalable simulation of entire tinyOS applications, Proceedings of the 1st international conference on Embedded networked sensor systems, November 05-07, 2003, Los Angeles, California, USA [doi>10.1145/958491.958506]
• 13: Sergio Marti , T. J. Giuli , Kevin Lai , Mary Baker, Mitigating routing misbehavior in mobile ad hoc networks, Proceedings of the 6th annual international conference on Mobile computing and networking, p.255-265, August 06-11, 2000, Boston, Massachusetts, United States [doi>10.1145/345910.345955]
• 14: M. H. T. Martins, A. P. R. da Silva, A. A. F. Loureiro, and L. B. Ruiz, An IDS simulator for wireless sensor networks. Sensornet Technical Report, Comp Sci Dept, Federal University of Minas Gerais, May 2005.
• 15: Sung Park , Andreas Savvides , Mani B. Srivastava, SensorSim: a simulation framework for sensor networks, Proceedings of the 3rd ACM international workshop on Modeling, analysis and simulation of wireless and mobile systems, p.104-111, August 20-20, 2000, Boston, Massachusetts, United States [doi>10.1145/346855.346870]
• 16: V. Paxon, Bro: A system for detecting network intruders in real-time, in Proc of USENIX, USENIX - Security, 1998.
• 17: Adrian Perrig , Robert Szewczyk , J. D. Tygar , Victor Wen , David E. Culler, SPINS: security protocols for sensor networks, Wireless Networks, v.8 n.5, p.521-534, September 2002 [doi>10.1023/A:1016598314198]
• 18: W. R. Pires, T. H. P. Figueiredo, H. C. Wong, and A. A. F. Loureiro, Malicious node detection in wireless sensor networks, in 18th Int'l Parallel and Distributed Processing Symp, 2004.
• 19: P. A. Porras and P. G. Neumann, Emerald: Event monitoring enabling responses to anomalous live disturbances, in Proc of 20th NIST-NCSC Nat'l Info Systems Security Conf, 1997, pp. 353--365.
• 20: L. B. Ruiz, J. M. S. Nogueira, and A. A. Loureiro, Manna: A management architecture for wireless sensor networks, IEEE Comm Magazine, 41 (2003), pp. 116--125.
• 21: A. Segall, Distributed network protocols, IEEE Trans on Info Theory, 29 (1983), pp. 23--35.
• 22: Victor Shnayder , Mark Hempstead , Bor-rong Chen , Geoff Werner Allen , Matt Welsh, Simulating the power consumption of large-scale sensor network applications, Proceedings of the 2nd international conference on Embedded networked sensor systems, November 03-05, 2004, Baltimore, MD, USA [doi>10.1145/1031495.1031518]
• 23: Chin-Yang Tseng , Poornima Balasubramanyam , Calvin Ko , Rattapon Limprasittiporn , Jeff Rowe , Karl Levitt, A specification-based intrusion detection system for AODV, Proceedings of the 1st ACM workshop on Security of ad hoc and sensor networks, October 31, 2003, Fairfax, Virginia [doi>10.1145/986858.986876]
• 24: Anthony D. Wood , John A. Stankovic, Denial of Service in Sensor Networks, Computer, v.35 n.10, p.54-62, October 2002 [doi>10.1109/MC.2002.1039518]

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.1 Network Architecture and Design
          Subjects: Wireless communication
      C.2.3 Network Operations
          Subjects: Network monitoring

  H. Information Systems
  H.1 MODELS AND PRINCIPLES
      H.1.0 General

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

General Terms:
Design, Security

Keywords:
intrusion detection, security, wireless sensor networks