Research On Distributed Intrusion Detection In Wireless Sensor Networks

Wireless Sensor Networks (WSNs) are vulnerable to security attacks for variousreasons, resulting in reduction in network performance or even collapse of thenetworks. When malicious nodes launch attacks, an intrusion detection system (IDS)can be used to detect intrusions through monitoring network communication andidentifying anomaly behaviors to protect the network from damages. For wirelesssensor networks (WSNs), special characteristics, i.e., the constraint of such resourcesas energy, computation power and transmission capacity, must be fullyconsidered. Although a great deal of progress has been made in the research on IDSin WSNs, more work needs to be done before the technologies developed so far.canbe applied in real networks and applications.In this thesis, the concept of critical node is first introduced based on theobservation that potential damage that can be caused by attacks to a WSN, namely, thedanger of attacks to the network, depends not only on the losses caused by the attacks,but also on the importance of the nodes under attack. That is, the same attack towardnodes of different importance will result in different levels of damage. Therefore, anintruder will probably choose to attack critical nodes to maximize the effect of theattack. Moreover, the attacking node can try to make itself a critical node to attractmore traffic or may behave normally until it becomes a critical node. Critical nodes inWSNs are then thoroughly analyzed, including critical routing nodes, beacon nodesand cluster head nodes. Secondly, a scheme is proposed in which different strategiesare developed for different nodes depending on their importance or whether they arecritical nodes. By focusing on the critical nodes, more specific data can be collectedwith less power consumption. Based on this general idea, a new method for thedeployment of monitoring nodes is proposed to monitor the behavior of the criticalnodes through their communication links. Analysis using an energy model shows thatthe collection of more specific data during monitoring can greatly reduce energyconsumption. Finally, simulation is performed to compare our proposed intrusiondetection scheme based on the notion of critical nodes to a pure distributed intrusiondetection scheme using the criteria of detection accuracy and energy efficiency.Simulation results show that our proposed scheme can achieve a higher level ofdetection accuracy with lower energy consumption. Even more, the large the network,the more advantages our proposed scheme becomes.The proposed scheme is suitable for networks in which the importance of nodescan be easily classified. The scheme can be used to effectively defend networksagainst attacks toward critical nodes and can effectively improve detection accuracy while achieving better energy efficiency.