Intrusion Detection System Base On Flow Forecast For Wireless Sensor Networks

the WSN(Wireless Sensor Network) can be deployed in many areas where the existing equipment cannot be used, such as the mountains, rivers and so on, and it has been used in many fields of the earthquake monitoring, traffic control and military etc. WSN is different from the traditional wireless networks, the energy, storage and the processing ability of the WSN’s nodes are limited. That is why the traditional wireless network attack detection methods which are used widely are not suitable to the WSN. So the work on the attack detection methods of WSN is meaningful.With the bases of the study on the internal attack types of the wireless sensor network, this paper proposed the intrusion detection system which based on the ARMA(Autoregressive Moving Average). In this paper, we focus on the data acquisition network of the WSN. The reason is that the traffic of the network is stable under the normal circumstances. Once the attack occurred, the traffic will be affected. So our mechanism firstly predicts the traffic under using the ARMA, and calculates the range of the Packet Reception Rate(PRR). Then our mechanism compares the actual traffic and the PRR. If the actual traffic goes beyond the range of the PRR, the mechanism thinks the attack occurred, and then the network will make the corresponding treatment measures such as isolation of the node. On the contrary, there is no attack took place.Firstly, In this paper, the ARMA(2,1) model is verified by experiments, which is good for predicting the traffic flow of the nodes in WSN, and it is basically in line with the actual traffic value.Then, the feasibility of the mechanism is verified by the calculation of the rate of traffic flow.Finally, the comparison of accuracy detection rate and false positive rate is compared with This scheme and ARMA model alone and PRR alone and. Experimental results show that the system has a higher detection rate and lower false alarm rate.At the same time, through experimental verification in the no attack and no detection,has attack and no detection, has attack and has detection network average energy consumption, can be seen when the attack occurred, the use of the detection mechanism can effectively reduce the attack to the network energy consumption.