| Wireless sensor networks (WSNs) are new generation networks which combines the technologies of sensor, wireless communication, micro-electro-mechanism systems (MEMS) and distributed computing. As a hot spot, it has a vast range of applications, which extend from the military affairs to environmental monitoring and industrial production. However, the openness of transmission media and the harsh environment of deployment threat the security of WSNs and restrict applications of WSNs. How to ensure the safety of information, nodes and network domain become serious questions when WSNs designed. Intrusion detection in a WSN can be regarded as a monitoring system for detecting any behavior that will damage or attempt to damage system confidentiality, integrality or availability, and it can provide the reasonable supplement to intrusion prevention mechanism which constructs a second wall of defense for network and system.In this paper, several intrusion detection systems have been analyzed at home and abroad firstly. Then, describing the module and detection algorithm of IDS for WSN based on multi-agent and refined clusting in detail, concluding that: even distributed anomaly Detection based on network is good fit for WSN.The main contributions of this paper can be summarized as follows:1. Detection module. The IDS this paper proposed is an even distributed anomaly detection based on network. All detection woks are assigned to cluster headers and common sensors evenly extending the life of cluster headers and avoiding changing the topology of whole network frequently.2. Detection algorithm. Proposing an algorithm for detecting a series of attacks in WSNs by applying Modified Cumulative Sum (CuSum) algorithm aims to detect anomalies which good fits the demands and restrictions of WSNs. At same time, unlike CUSUM, M-CUSUM can detect both the anomaly increscent of average sending power in message transition phase, and the Continuously large transmit power when topology formation phase.3. Trust management module. A successful interaction is a main parameter of this module. Some nodes with high trust degree, calculated through trust model, monitor the whole cluster which decreasing the huge power consumption and prolonging life of the whole networks. When a node receives an alert or claim, it will distinguish whether it is a validate alert or a faulty anomaly claim generated by an unidentitified malicious node according to the trust level of trust table, which shields false alarm messages.We show through experiments with real data that our algorithm can decrease the false alarm rate and increase the detection accuracy rate compared with existing intrusion detection schemes while lowering the power consumption. |
