Study On Detection Of Malicious Nodes In Wireless Sensor Networks

Wireless sensor network, which consists of thousands of micro processing sensors, is a kind of self-organizing network without infrastructure. Wireless sensor network shares many similarities with the ordinary wireless Ad Hoc network, such as the characteristics of independence(independence on communications infrastructure), distribution and multi-hop. But, it also has some practical advantages like good concealment, strong survivability, fast network structure, accurate information, ubiquitous distribution and so on. The limitation of the node's communication radius, battery capacity, storage and computing power, make it vulnerable to become failure when it is impacted or destructed by the malicious environment, which will case the network connectivity and the accuracy of the data in danger and make the network security in great challenge. It is variable for an attacker to launch various types of attacks through the layout of malicious nodes in the network, such as flooding attack, Sinkhole attack, impulse attack, selective forwarding attack, black hole attack and so on. So it is very important to detect the malicious nodes and isolate them from the sensor network. According to the detailed study of the characteristics of various malicious attacks, the main contribution of this paper is as follows:(1) Sinkhole attack detection algorithm based on random path. For characteristics that Sinkhole malicious nodes are usually displaced in the vicinity of the base station and lie that they can reach to the base station with fewer hops, which will absorb almost all the traffic in the network, in this paper, we propose a novel Sinkhole attack detection algorithm based on the optimal path and the difference of hops. The algorithm uses the idea of dynamic programming to set up a database which related to the hops, some paths to the base station are set up randomly based on the optimal number of hops, and then the malicious nodes are justified according to the numbers of the nodes passed by the paths and the difference hops of the nodes. Simulations show that the algorithm can achieve higher detection rate which will raise with the increase of the nodes size. The false detection rate of the proposed algorithm is inversely proportional to the number of paths, meanwhile the detection rate of the algorithm will reduce when the number of paths increases to a certain degree.(2) Cooperative polling flooding detection algorithm based on Preprocessing. Flood attack usually sends information to the surrounding nodes with larger power, which makes the nodes in the remote distance take it as a neighbor node, and increase the probability of it to be a cluster head. For the situation that the malicious node is selected to be a cluster head, the paper presents a new algorithm based on simple preprocessing and node cooperative voting. This paper begins with the setting of a reasonable threshold for the members of the cluster that each cluster head belongs to by using the standard deviation model so as to trigger the detection mechanism, some guide nodes are selected randomly to detect those cluster heads whose numbers of cluster members beyond the threshold based on the received signal strength and the distance, finally malicious node are determined by the cooperation votes of the guide nodes. Simulations show that the number of the cluster heads needed to be detected and the number of data packets required to be transmitted by the guide nodes in each round of the algorithm is approximately 1/2 of the original algorithm. And the algorithm can obtain the similar detection rate and lower false positive rate with less energy compare with the original algorithm.