The Intrusion Detection Algorithm Based On Clustering

With the increasing development of computer technology, wireless communication technology, microelectronics and sensor technology, wireless sensor networks(WSNs)have widely used in military operations, medical management, forest fire prevention, air quality monitoring, and so on. After wireless sensor nodes are deployed in complicated environment, they are often easily attacked due to the limited computation capability and the open data transmission environment. Attack nodes can know all the normal nodes information(including node location, secret key, node identity) by capturing the normal nodes in the network. Then, the attack nodes copy this information to constitute clone nodes. Researchers have proposed many methods to deal with this kind of attack.However, these methods have some deficiencies:(1) When directly detecting the clone nodes in the networks, they do not consider the large scale of the network, which will lead to the huge waste of energy;(2) In the clustering network, they are not able to determine whether both data transmission nodes and cluster head nodes are attacked by malicious nodes at the same time. To solve these problems, this thesis makes the following contributions:First, this thesis propose a fuzzy clustering algorithm based on variation coefficient.Because the deployment scope of wireless sensor network is wide, the attack nodes may be in any position of network. In order to find the clone nodes as soon as possible, we proposed a fuzzy clustering algorithm based on variation coefficient to cluster the whole network. In this way,we can rapidly, effectively, accurately locate the position of the clone node within each cluster,and we can also save energy of each node to prolongingthe life of the network. The fuzzy clustering algorithm based on variation coefficient not only improve how to select initial centroid position but also make weighted variation for different dimensions of data, which greatly reduce the effect of unrelated dimensions.Second, this thesis propose and intrusion detection algorithm(IDA) for detecting the existence of clone nodes. In this algorithm, first of all, we choose some nodes with less energy consumption as witness nodes. The witness nodes will monitor the whole networks to determine whether data transmission nodes and the cluster head nodes are captured. Then, when the witness nodes monitor the data transmission nodes, IDA algorithm will determine whether the data transmission nodes are cloned within the cluster by analyzing the missed detection probability and the effective throughput.Furthermore, in the monitoring of cluster head nodes, we will determine whether the cluster head nodes are cloned by setting the alarm threshold.Finally, compared to the existing detection algorithms, our intrusion detection algorithm(IDA) is a feasible method through theoretical analysis and mathematical deduction. Simulation experiments show that our algorithm can efficiently detect the clone nodes and improve the throughput, security and the lifetime of the network. It can be also shown that the miss detection probability will decrease greatly, and the network throughput can be improved effectively by choosing appropriate coding function.