Effective Identification of the Intruders and Modifiers in Wireless Sensor Networks

Packet dropping and modification are common attacks that can be launched by an adversary to disrupt communication in wireless multihop sensor networks. Many schemes have been proposed to mitigate or tolerate such attacks, but very few can effectively and efficiently identify the intruders. To address this problem, we propose a simple yet effective scheme, which can identify misbehaving forwarders that drop or modify packets. In Wireless Sensor Network, sensors at different locations can generate streaming/ discrete data, which can be analyzed in real-time/Non real-time to identify events of interest. A sensor node is often placed in an unfriendly environment to perform the monitoring and data collection tasks. When it is unfriendly environment, node may subject to compromise. After compromising one or multiple sensor nodes, an adversary may launch various attacks to disrupt the in-network communication. In this paper, two algorithms are proposed, firstly, one node categorization algorithm to identify nodes that are droppers or modifiers for sure or suspicious droppers or modifiers. As the tree structure dynamically changes every time interval, behaviors of sensor nodes can be observed in a large variety of scenarios. The information of node behaviors has been accumulated. Secondly, the sink will periodically run heuristic ranking algorithms to identify most likely bad nodes from suspiciously bad nodes. And an extension to identify modified packets using Message Authentication Code.