The Research On Malicious Node Detection In Wireless Sensor Network Based On Machine Learning

The technology of wireless sensor network, as a new technology, has broad application prospects in national security and most aspects of national economy. WSN is a distributed network exposed to an open environment, with the independence of every sensor node, lack of central node or monitoring node as its main feature. So it is vulnerable to malicious nodes, and costly to find out them. With the development of wireless sensor network to a large-scale and dense distribution, the research on how to accurately and efficiently detect the malicious nodes, with a satisfying compatibility and simplicity, is of importance.First, this thesis introduces the characteristic of wireless sensor network and its difference from the mobile Ad hoc network (MANET). Then, based on the potential security hazard of WSN, it lists most attack patterns and solutions on every network layer (such as physical layer, link layer, network layer, transport layer and so on). It also lists some malicious node detection method based on machine learning after generalizing the machine learning theory. And then, it introduces NS-2, the simulation tool in this article.Second, this thesis points out that the sensor node behaviors are hard to be monitored after analyzing them. And based on the fact that all malicious behaviors are presented by the node's communications in a network, it proposes a modeling method in which all sensor node select and count the specific node behaviors related to the given attack pattern. All the data are sent to a sink node and reorganized there to vector values of sensor node feature. After this, this thesis models the sensor node features and attack patterns of malicious node from a part of wireless sensor network model.Third, after modeling the sensor nodes in a WSN, this thesis presents a malicious node detection method based on multivariate classification. Given the types of a few sensor nodes, it extracts sensor nodes'preferences related with the known types of malicious node, establishes the sample space of all sensor nodes that participate in network activities. Then, according to the study on the type-known sensor nodes samples based on the multivariate classification algorithm, a classifier is generated, and all the unknown-type sensor nodes are classified. The experiments are simulated in NS-2 2.27 with the patch of nrlsensorsim, and the results show that as long as the value of sensor nodes preferences and the number of active sensor nodes is stable, the false detection rate is under 0.5%.Last, this thesis presents another malicious detection method based on k-mean clustering with the initial mi decided by labeled samples. The method based on multivariate classification would have an inaccurate model and a high false detection rate or even not carry on, if the number of type-known nodes is insufficient. And this method can solve these problems. The experiments are also simulated in NS-2, and the results, compared with the upper ones, show that when the type-known nodes are sufficient, the malicious detection method based on k-mean clustering with the initial mi decided by labeled samples has the same false detection rate (under 0.5% after the value of sensor nodes preferences and the number of active sensor nodes being stable); meanwhile, the false detection rate, highly related to the chosen type-known nodes when they are insufficient (under 1%, 0.5%, 0.4% respectively in Exp 3), keeps on a acceptable level when the detection with the algorithm based on multivariate classification could not be executed.