This article is an open-access article distributed under the terms and conditions of the Creative Commons Attribution license (http://creativecommons.org/licenses/by/3.0/).

In wireless sensor networks, replica node attacks are very dangerous because the attacker can compromise a single node and generate as many replicas of the compromised node as he wants, and then exploit these replicas to disrupt the normal operations of sensor networks. Several schemes have been proposed to detect replica node attacks in sensor networks. Although these schemes are capable of detecting replicas that are widely spread in the network, they will likely fail to detect

Wireless sensor networks are very useful for performing a variety of tasks. In particular, they are well suited to monitor and sense natural phenomenon and are useful for projects such as earthquake detection, biohazard detection, flood detection, weather forecasting, and fire detection. In addition to these applications, wireless sensor networks can also be deployed for different type of civilian and military applications such as border line surveillance, intrusion detection, nuclear and chemical attack detection, traffic surveillance and patient monitoring [

However, wireless sensor networks could face with the risk of being compromised by the attacker. More specifically, sensor nodes could be easily captured and compromised by the attacker when wireless sensor networks are deployed in hostile environment. (According to the research result of [

To generate the widespread effects on the network, he can mount

Several replica node detection schemes [

Indeed, we could detect replicas without the use of location information in case of

We analytically show that our proposed scheme fulfills high replica cluster detection capability with a few number of samples. The simulation results also demonstrate that it detects replica clusters with at most 3.28 and 6.78 samples while reaching zero false positive and false negative rates.

The rest of paper is organized as follows. In

In this section, we present the related work for replica detection in sensor networks. Parno

Choi

Xing

Ho

Ho

Yu

Wang

Bonaci

Although the related work could effectively detect replica nodes that are widely spread over the network, they likely treat the replicas in a cluster as a single node and thus would likely fail to detect replica clusters. To justify this argument, we first assume that multiple replicas form a cluster

In this section, we first present the network assumptions and then describe our attacker models. Finally, we present an overview of the SPRT.

We assume a

We assume that an adversary can compromise a subset of sensor nodes and have full control of them. In other words, an adversary can leverage the compromised nodes to perform any malicious activities that damage the network. Moreover, he can create the widespread effects on the network by generating many replicas of the compromised nodes, where a replica node is defined as a node having the same ID and secret keying materials as a compromised node. In terms of replica node deployment, we assume that adversary will attempt to form a cluster consisting of multiple replicas of a single compromised node in a small region, and then launch a variety of types of attacks by leveraging replica cluster. To amplify the impacted regions by replica cluster attacks, he can compromise multiple nodes, create multiple replica clusters in such a way that each replica cluster is constructed from each compromised node, and place multiple replica clusters in the different small regions.

The Sequential Probability Ratio Test (SPRT) [

The main benefit of using the SPRT is that it requires only few pieces of evidence to make a correct decision at the cost of low false positive rate and false negative rate [

In replica cluster attacks, multiple replicas with the same ID and secret keying materials are closely deployed to each other in a small region. Since the replicas in a cluster want to affect maliciously as many nodes as possible in the network, they would actively communicate with as many nodes as possible at the same time. Hence, the replicas in a cluster would likely communicate with more peers at a time than the ones of their benign neighbors. By leveraging this intuition, we adapt the SPRT to tackle the replica cluster detection problem. Specifically, every node performs the SPRT on its neighbor node with a null hypothesis that a replica cluster of the neighbor node does not exist and an alternate hypothesis that a replica cluster of the neighbor node exists. In the SPRT, as the number of communication peers of a neighbor node falls short of (resp. exceeds) a pre-configured threshold, the random walk will move toward the lower (resp. upper) limit, leading to the acceptance of the null (resp. alternate) hypothesis. Once the SPRT accepts the alternate hypothesis, the node will stop the communication with the neighbor node. The replica cluster detection procedure is described as follows.

After deployment, every sensor node _{i}

Let _{i}

The success probability

If _{0}, it is likely that a replica cluster of _{1} (_{0} < _{1}), it is likely that a replica cluster of _{0} and _{1}, respectively. In this problem, we define a false positive _{0} (resp. _{1}). In order to make a correct decision in hypothesis testing problem, the false positive (resp. false negative) does not exceed user-configured false positive (resp. user-configured false negative).

In line with this sampling plan, we present how a node _{1},_{2},…,_{n}. We first define the null hypothesis _{0}and the alternate one _{1} as follows: _{0} is the hypothesis that a replica cluster of a node _{1} is the hypothesis that a replica cluster of a node _{n}

Assume that _{i}_{n}

Let _{n}_{i }= 1 in the

where

Based on the log-probability ratio _{n}_{0} against _{1} is given as follows:

• _{0} and terminate the test;

• _{1} and terminate the test;

•

We can rewrite the SPRT as follows:

• _{n}_{0} (_{0}and terminate the test;

• _{n} ≥_{1} (_{1}and terminate the test;

• _{0} (_{n}_{1} (

where

If the SPRT decides that a replica cluster of

In this section, we first describe the replica cluster detection accuracy of our proposed scheme and then analyze the resilience of our proposed scheme against replica cluster attacks. Next, we show how many observations on average are required to detect replica clusters. Finally, we provide an analysis on the energy consumption of our scheme.

In the SPRT, we define two types of errors as follows:

• _{1} when _{0} is true.

• _{0} when _{1} is true.

Since

where

From Equation (5), we see that low user-configured false positive and false negative probabilities will result in a low false negative probability for the sequential test process, leading to high detection rates.

Let us investigate how our proposed scheme tolerates against replica cluster attacks.

_{1} type out of n samples that node u receives from a replica cluster of node v. Given n samples, u detects a replica cluster of node v if u receives at least γ^{* }× n samples with H_{1} type from a replica cluster of v such that

_{n} is the number of times that the sample with H_{1} type occurs in n samples, θ_{n }=γ × n holds. According to the SPRT, u detects a replica cluster of v if θ_{n} ≥ τ_{1} (n), which is rewritten as γ ≥γ^{*} such that _{1} type that u receives from a replica cluster of v is at least γ^{* }× n, udetects a replica cluster of v

Let us explore how ^{*} when _{0} = 0.1, and _{1} = 0.9. As shown in ^{*} gradually decreases as _{1} types for replica cluster detection as the total number of samples increases. Putting it differently, the SPRT detects replica cluster attacks with the fewer number of samples as a replica cluster more actively makes a malicious impact on the network.

Let

From this equation, we compute the expected numbers of _{0} and _{1} as follows:

Note that a sample in the SPRT corresponds to a time slot and thus _{0}] and _{1}] represent an average number of time slots to terminate the SPRT conditioned on the hypothesis _{0} and _{1}, respectively. From Equation (7), given a value of _{1}, _{1}] increases as _{0} rises. This means that _{0} needs to be configured as a small value in order for replica clusters to be detected with a small number of samples. On the other hand, given a value of _{0}, _{1}] decreases as _{1}increases. This implies that the large value of _{1} diminishes the number of claims required for replica cluster detection.

The effects of ^{*}, which is the minimum fraction of samples with type _{1} in

Since our scheme requires each sensor node to operate in monitor mode, each sensor node needs to receive all packets sent by its neighboring nodes. We compute the amount of energy that a senor node consumes to receive the packets. According to [^{3} J = 12.5

Energy consumption

In this section, we first describe our simulation environment and then present the simulation results.

We developed a simple simulation program to evaluate our proposed scheme. In our simulation, we have 1,000 sensor nodes and set _{0} and the upper threshold _{1} to 0.1 and 0.9, respectively. The rationale behind these configurations is discussed in

We use the following metrics to evaluate the performance of our proposed scheme:

•

•

•

We present the average results for 1,000 runs of the simulation in each configuration such that each run is executed for 60 time slots. For each run, we obtain each metric as the average of the results of the SPRTs that are performed. Note that the SPRT will restart (resp. terminate) if it accepts the null (resp. alternate) hypothesis _{0} (resp. _{1}). Now we present our main findings.

First, we find that there are no false positives and no false negatives. Hence, a replica cluster is always detected and no benign node is misidentified as a replica cluster. This indicates that the SPRT comes to a decision with very high accuracy.

Second, we present the results of the average number of samples. For this purpose, we define

In the _{1}.

Finally,

Average number of samples

Average number of samples

Probability distribution of the number of samples in

In this paper, we introduce the replica cluster attacks and propose a replica cluster detection scheme using the Sequential Probability Ratio Test (SPRT). We also analytically show that our proposed scheme achieves robust replica cluster detection capability. Finally, we evaluate our proposed scheme through the simulation. The evaluation results show that it quickly stops replica cluster attacks without false negative or false positive errors.

This work was supported by a research grant from Seoul Women’s University (2012).