Virtual-Lattice Based Intrusion Detection Algorithm over Actuator-Assisted Underwater Wireless Sensor Networks

Due to the lack of a physical line of defense, intrusion detection becomes one of the key issues in applications of underwater wireless sensor networks (UWSNs), especially when the confidentiality has prime importance. However, the resource-constrained property of UWSNs such as sparse deployment and energy constraint makes intrusion detection a challenging issue. This paper considers a virtual-lattice-based approach to the intrusion detection problem in UWSNs. Different from most existing works, the UWSNs consist of two kinds of nodes, i.e., sensor nodes (SNs), which cannot move autonomously, and actuator nodes (ANs), which can move autonomously according to the performance requirement. With the cooperation of SNs and ANs, the intruder detection probability is defined. Then, a virtual lattice-based monitor (VLM) algorithm is proposed to detect the intruder. In order to reduce the redundancy of communication links and improve detection probability, an optimal and coordinative lattice-based monitor patrolling (OCLMP) algorithm is further provided for UWSNs, wherein an equal price search strategy is given for ANs to find the shortest patrolling path. Under VLM and OCLMP algorithms, the detection probabilities are calculated, while the topology connectivity can be guaranteed. Finally, simulation results are presented to show that the proposed method in this paper can improve the detection accuracy and save the energy consumption compared with the conventional methods.


Introduction
In recent years, underwater wireless sensor networks (UWSNs) have been proposed to explore the ocean and support solutions for time-critical aquatic applications, such as port surveillance, environment monitoring, disaster prevention and mine reconnaissance; see [1][2][3] and the references therein. Due to the lack of a physical line of defense, intrusion detection becomes one of the key issues in applications of UWSNs, especially when confidentiality has prime importance. For instance, in order to ensure the tracking performance, target surveillance applications often require detecting the absence or presence of an underwater intruder [4].
For terrestrial wireless sensor networks, the intrusion detection problem has been extensively studied, and barrier coverage is one of the most popular strategies to detect the existence of an intruder [5]. Since barrier coverage only needs a few nodes to construct a continuous barrier spanning the protected region, it is particularly efficient and low cost for intruder detection applications compared with area coverage. Early research in barrier coverage is focused on static sensors [6][7][8].
More recent research has examined barrier coverage with mobile sensor nodes. For instance, [9] jointly information. In addition, the energy efficiency in this paper can be improved by compared with neighbor rule-based method [20].
The remainder of this paper is organized as follows: Section 2 includes the problem formulation and preliminaries. The main results of the intrusion detection algorithms are presented in Section 3. To verify the validity of the algorithm, some simulation results are given in Section 4. Finally, the conclusion and future work are given in Section 5.

Problem Formulation and Preliminaries
In this section, we first give the sensing model of SNs and ANs, then the energy model of the communication consumption is constructed. In addition, the average intruder detection probability is defined, and then, some preliminaries on graph theory are provided. In order to clarify and simplify the algorithms, it is assumed that nodes are time-synchronized and that each node knows its location, from some time synchronization techniques [21] and location schemes [22].

Sensing Model of SNs and ANs
As shown in the left part of Figure 1, the three-dimensional underwater space is described by small cubes [23]. Each layer of the space can be presented by a two-dimensional surface, as shown in the right part of Figure 1. We assume that each node (i.e., SN or AN) has a Boolean sensing model [24] with the sensing range R s , and the communication range is denoted by R c , where R c ≥ 2R s . SNs and ANs can sense the environment and detect intruders within their sensing region, and the sensing region is described by the disk of radius R s centered at the node. In addition, AN can autonomously move in the region of interest (ROI). An intruder is said to be detected by an SN or AN if it has been located inside the sensing region of the SN or AN.

Energy Model for Communication Consumption
In the underwater environment, the energy consumption of nodes in the information transmission process is much greater than the ones in information sensing, processing and receiving [25]. Based on this, we use a common communication consumption model to describe the energy model of SNs and ANs, as proposed in [26]. Define p r as the power threshold for a node to receive the information package, and d is the transmitting distance. The energy consumption for transmitting information is denoted by E tx (d), and it can be calculated as: where T p denotes the transmitting time of the data package.
In Equation (1), T p is defined as: where M b and S v are the size and transmission speed of the information package, respectively. In addition, A(d) denotes the energy attenuation with the transmitting distance d, and it can be calculated as: where λ is the energy spreading factor related to sensing model (λ is 1 for cylindrical, 1.5 for practical and 2 for spherical spreading). The parameter β = 10 α( f )/10 is determined by the underwater acoustic absorption coefficient α( f ), and it can be given as: where f is the frequency of the carrier acoustic signal in kHz, and α( f ) is in dB/m. Denote the time of information package transmitting as t n , and the communication range is R t . With Equation (1), the energy model for communication consumption in node i is denoted by C i e , which is shown as:

Average Intruder Detection Probability
Without loss of generality, let the detection area R be a thin cuboid, which is partitioned into many virtual lattices. It is assumed that SNs are independently deployed with a random uniform distribution. These SNs can be air-dropped or launched via artillery in battlefields or unfriendly environments. It has been proven in [27] that the Poisson process can well describe the deployment of SNs. Based on this, we denote the density of the Poisson process as λ, and the distribution is described in Figure 2. In a region R, the number of located SNs, i.e., N (R), follows a Poisson distribution with parameter λ R , where R represents the volume of the region. Then, the probability of the SN quantity is given by: The coverage rate P c is defined as:  Obviously, it needs to deploy a large number of static sensors if the coverage rate P c approaches one. In order to improve the coverage rate with a small quantity of SNs, the deployment of ANs is necessary. In general, the intruder is assumed to stochastically arrive at each virtual lattice i, where i = 1, 2, · · · ,q. At an arbitrary lattice i, the intruder arrival time t is a random variable with a distribution of cumulative function F (t). Due to the temporal correlation of intruder arrival times, we use the Weibull distribution to describe the arrival time of the intruder. The Weibull distribution can well characterize the temporal correlation of the arrival time of the intruder, and it has been widely applied to model many real-world random events, especially in a sparse environment. Based on this, the density is denoted as f (t), and Figure 3 is given to show the distribution with different β. The cumulative function F (t) is described in Figure 4, wherein the probability between two arrival times is very small. The definition of F (t) is given as: where t ≥ 0, λ ≥ 0, and β ≥ 1. When β = 1, Weibull distribution becomes the well-known Poisson distribution.    The state of intruder arrival is denoted by O t j . O t j = 1 if an intruder arrives at lattice j during time slot t, and O t j = 0 otherwise. The state of SNs in lattice j is denoted by S t j . S t j = 1 if there are at least two SNs during time slot t in lattice j, and S t j = 0 otherwise. The state of ANs in lattice j is denoted by A t j , A t j = 1 if there is at least one AN staying at lattice j at time slot t, and A t j = 0 otherwise. Then, we characterize the state of lattice j at time slot t as L t j = (O t j , S t j , A t j ). Figure 5 illustrates that if an intruder arrives at lattice j during time slot t and there are at least two SNs, i.e., O t j = 1 and S t j = 1, then the intruder is detected. Meanwhile, if an intruder arrives at lattice j during time slot t and the number of SNs is less than two, however, there is at least one AN staying at lattice j during the same time slot, i.e., O t j = 1, S t j = 0 and A t j = 1, then the intruder is also considered to be detected. From the above description, we can draw a truth table of state L t j to show the relationships among O t j , S t j and A t j . As stated in Figure 6, their relationship can be described as follows: As mentioned above, we define the following important performance metrics. Definition 1 (average intruder detection probability): Given a sequence of m}, the average intruder detection probability γ is defined as: In Equation (11), we use states L t j to define the average intruder detection probability γ, which is calculated by the ratio of the number of detected intruders to all arriving intruders. This design models the arrival of the intruder at a specific lattice as a renew process. In Equation (11), the average intruder detection probability γ consists of two parts, i.e., deterministic intruder detection probability θ and monitoring intruder detection probability α. For instance, when the value of γ is 0.5, it means that half of the intruders can be detected by the SNs or ANs. Now, we present the following two definitions. Definition 2 (deterministic intruder detection probability): If there is at least one SN in lattice j, the intruder can be monitored no matter when it arrives at this lattice. Then, the deterministic intruder detection probability θ is defined as:

Definition 3 (monitoring intruder detection probability):
In the process of AN monitoring, the periodic intruder detection probability α is defined as:

Problem Definition
Given the previous discussions, the intrusion detection problem can now be stated as follows. Problem 1: Considering the energy consumption and topology connectivity constraints, we aim to design a monitoring algorithm for SNs to detect the existence of an attacker in the three-dimensional underwater environment. Based on the lattice topology, we attempt to design a monitor patrolling algorithm for SNs and ANs to optimize the communication links and improve the detection probability.

Graph Preliminaries
In the following, we introduce rigid graph and optimally rigid graph, which are important notions about connectivity in topology optimization scheme. The topology relationship of AN-assisted UWSNs is represented by an undirected graph G. It consists of a center vertex set i˜j} is the edge set, and (i, j) represents the interconnection edges among the vertices. In addition, the SNs and ANs are denoted by S SN = {S 1 , S 2 , · · · , S c } and S AN = {S 1 , S 2 , · · · , S n }, respectively. This alternating sequence of distinct vertices and edges in the graph is called a 'path', and the graph G is 'connected' if there is a path between any pair of distinct nodes. Now, we first present the definitions of connectivity and rigid graph. Definition 4 (connectivity) [28]: The graph is connected if there is a path between any pair of SNs in the active state. Definition 5 (rigid graph) [29]: A framework (or graph) is rigid iff continuous motion of the points of the configuration maintaining the bar constraints comes from a family of motions of all Euclidean space, which are distance-preserving. A graph that is not rigid is said to be flexible.
Good connectivity is one characteristic of rigidity. Figure 7a is flexible, because the distance between Vertex 2 and Vertex 4 can be continuously changed freely; while Figure 7b is rigid, in which each vertex has at least two adjacent edges. Another two important notions are minimal rigidity and minimally weighted rigidity. A minimally-rigid graph is a rigid graph that no edge can be removed from without losing rigidity. As shown in Figure 7c and Figure 7d, the two frameworks are the same shape apart from the edge in Figure 7c and the edge in Figure 7d. To compare the two edge weights, the edge is equal to 2.5 less than the edge that equals 3.19. Then, we call the framework in Figure 7c as the minimally-weighted rigidity graph. Generally, communication consumption of the network comes from two factors: (i) the number of links; and (ii) the sum of the length for all edges. Obviously, these factors are represented by the minimally-rigid graph. Thus, the minimally-rigid graph is adopted in this paper to optimize the communication consumption of the network. In order to ensure the rigid maintenance, the following lemmas are needed. Lemma 1 [28]: The initial subgraph formed by one node and its n − 1 neighbors is a rigid graph with 2n − 3 edges at least if R s satisfies R s ≤ R c √ 8 . Notice that the communication range of a sensor node R c is an arbitrary value; thus, we give Lemma 2 to show the necessary condition to generate a rigid graph in a heterogeneous model. Lemma 2 [28]: The initial subgraph formed by one node and its n − 1 neighbors is a rigid graph with 2n − 3 edges at least if r satisfies r ≤ (1 − DOI)R m / √ 8. In framework G, we assume q i (t) is a differentiable function for each vertex i. If V (i, j) ∈ E satisfies q i − q j = γ > 0 and (q i − q j ) T (q i −q j ) = 0 at the initial rotation time t ≥ 0, we say thatq = (q 1 ,q 2 ,· · · , q n ) is an infinitesimal flex. An infinitesimal flex is trivial if it results from a rigid motion of the framework. A framework is said to be infinitesimally rigid if it only has trivial infinitesimal flex. The infinitesimal rigidity of a framework is a stronger condition than rigidity, where all infinitesimally-rigid networks are rigid. Then, we build a matrix M, whose rows and columns correspond to the edges and coordinates of the vertices, respectively. Then, the row corresponding to the edge (i, j) is given as: Lemma 3 shows the relationship between the infinitesimally-rigid graph and the rigidity matrix. Lemma 3 [28,30]: M is a rigidity matrix of a general structure with n vertices. In two-dimensional space, if and only if when rank(M) = 2n − 3, this structure is infinitesimal rigid.

Virtual-Lattice-Based Monitor Algorithm
In this section, we describe the VLM algorithm to detect the arrival of an intruder. The monitoring area is regarded as a thin sea surface in underwater space. Similar to [31], the monitoring area can be divided into multiple equally-sized virtual lattices. Then, a set of SNs is randomly deployed in the sea surface. The roles of SNs are to collect data from the environment and to stay at a lattice to monitor the intruder. In order to better grasp the regional information, a set of ANs is allocated to monitor the intruder. Each AN dynamically changes its position and locally broadcasts a HELLO message with its max transmission range to all nodes at that lattice. Then, we record whether an AN has received the HELLO-ACK message. In the end, SNs and ANs cooperatively monitor the intruder arrival. The detailed process is given in Algorithm 1. S AN = {S 1 , S 2 , · · · , S n }, the position of all ANs 3: With GAF, a cuboid is partitioned into many virtual small lattices, their ID set is denoted by I = {I 1 , I 2 , · · · , I m }. 4: for i ∈ I, (i = 1, 2, · · · , m) do 5: AN S z locally broadcasts a HELLO message to all nodes in lattice I i with its max transmission range. 6: if AN S z receives a number of HELLO-ACK message which is greater than or equal to two then 7: Record I i ∈ P Record center coordinates set I i = (x i ,y i ,z i ). 13: end for 14: Delete I i ∈ P and corresponding center coordinates from ID set I and I i . 15: Record new ID set I i ∈ I, new center coordinates set I i ∈ I i . 16: Output: The lattices that are required to be patrolled by ANs, and the ID set is I i .
The objective of Algorithm 1 is to find the lattices that are not satisfied with the two-coverage condition, and these lattices are required to be patrolled by ANs. Inspired by this, each AN locally broadcasts a HELLO message to all nodes in the lattice. By judging the received number of HELLO-ACK, ANs can record the ID set of lattices that are required to be patrolled by ANs. Especially, one-hop transmission is considered in each lattice, because the range of each lattice is relative small. To analyze the performance of Algorithm 1, the following theorem is given. Theorem 1. In VLM, the average intruder detection probability γ is a constant under the ideal situation, where γ = θ + k m · n k = θ + n m , and n denotes the number of ANs.
Proof of Theorem 1 . According to Definition 1, the average intruder detection probability γ consists of two independent probability, i.e., the deterministic intruder detection probability θ and the periodic intruder detection probability α. Notice that θ is a deterministic value, and it does not change with time; while, the value of α depends on the number of intruders. In VLM, each AN does not need to know the intruder prior information; however, each lattice can always be selected to be monitored by ANs. It is assumed that the probability of intruder arrival at each time slot isF. Then, the number of ANs that have detected intruders is nF. In addition, kF denotes the remaining lattices that can accommodate the intruders. k is the difference between the number of all lattices and the lattices that have detected the intruders. These judgments are based on the k m , which is the premise of the monitoring intruder detection probability. Therefore, γ can be calculated as: which completes the proof.

Remark 1:
As shown in Algorithm 1, each lattice is always monitored by an SN or AN. Based on this, the intruder can be detected by the AN-assisted UWSNs. If θ, n and m do not change with time, the average intruder detection probability γ will be a fixed value.

The Optimal and Coordinate Lattice Monitor Algorithm
In order to improve γ, this section proposes the OCLMP algorithm, which can be regarded as a weak barrier coverage. This algorithm is divided into two steps, and the first step is to generate and optimize the network topology. The optimized topology has good connection and low energy dissipation. If an intruder appears at a lattice with a optimized topology, the intruder can be detected. The second step is to coordinate the monitor patrolling of ANs. With the collaboration of ANs, the AN-assisted UWSNs can yield a much higher average intruder detection probability γ compared with the result in Section 3.1.
The OCLMP algorithm is described in Algorithm 2. A rigid graph is generated according to its neighbor rules among SNs (see Lines 1-9 in Algorithm 2). To decrease the complexity of the initial rigid topology, we delete some links that do not belong to global optimally-rigid graph by using locally-collected information (see . Based on this, a low-energy dissipation network that is at least two-connected can be built. if (M i is full rank) then 8: According to M i , record the edge E ij 9: end if 10: end if 11: for l = {I i , i} do 12: for k = {I i , i, k = l} do 13: if ((k,l) / ∈ E ij ) then 14: Delete (k,l) 15: Draw the edge of E ij

16:
end if 17: end for 18: end for As shown in Algorithm 2, the optimized graph can be given through the "drawing" and "deleting" implementations. In a broadcast medium, the implementations of "drawing" and "deleting" mean the changes of topology. That is to say, we can change the communication topology of UWSNs to design a desired routing relationship of SNs and ANs. If they are in each other's transmission range, the deletion implementation means the change of topology. Similarly, the implementation of adding is also the change of topology. If intruders break into a lattice from any direction, they can be detected by the AN-assisted UWSNs. Next, a theorem is first introduced. Theorem 2. In OCLMP, γ ≥ n+s m , where m is the total number of monitoring lattices.

Proof of Theorem 2.
This proof is similar to the proof in Theorem 1. Denote the average probability of intruder arrival at each time slot byF. Hence, the number of all lattices that can monitor intruders is mF. All actuators can detect the number of intruders nF; sF is the number of lattices that can monitor intruders doubtlessly. Then, pulsing nF with sF, this means the total number ANs and SNs can detect the intruders at time slot t. The average intruder detection probability γ can be calculated as: which completes the proof.

Remark 2:
In Theorem 2, when t goes to infinity, γ remains at the same value. However, the case of the value of γ equaling n+s m is an ideal situation. In general, the locations of SNs do not follow a uniform distribution. Inspired by this, we deploy ANs to patrol and collaborate with SNs. As stated in Lemma 3, the geometric relationships between neighbor nodes can expand the monitoring scope. Thus, the intruders can be detected if they travel through the expanded monitoring scope. Hence, it can be obtained that γ > nF+sF mF . In order to find the shortest patrolling path, an equal price search strategy is further given for ANs. From Algorithm 2, some independent lattices are not monitored by ANs or SNs. These independent lattices are put in a set Q, and I i ∈ Q is its ID number, where i = 1, 2 , · · · , m. With the equal price search method, all of the independent lattices can be linked to the shortest road by the ID number. That is to say, this method is to find the shortest road for AN monitor patrolling. There are five points, i.e., A, B, C, D and E. Begin with Point A, and expand it by the ascending order to four new nodes, AB (7), AC (5), AD (3) and AE (10), where 7, 5, 3 and 10 are the distances between AB, AC, AD and AE, respectively. In addition, mark A as an expanded node, while AB, AC, AD and AE as waitingexpanded nodes. Compare the distance information among the four new nodes, and find the shortest distance to expand continuously. Then, AD (3) has the shortest distance, and we expand it to three new nodes, i.e, ADB (6), ADC (9) and ADE (11). Meanwhile, mark AD as the expanded node, and ADB, ADC and ADE as waiting expanded nodes. Then, comparing all of the waiting expand nodes, AC (5) has the shortest distance. Once more, expand AC to three new nodes ACB (8), ACD (13), ACE (14), and mark AC as the expanded node, while ACB, ACD, ACE are marked as the waiting expanded nodes. Update the waiting expand nodes, and find the node that has the shortest distance. ADB has the shortest distance. Then, repeat the above operation until all five points appear in a new expanded node. The shortest link among A, B, C, D and E can be built up. At last, ANs are assigned to monitor these independent lattices along this link. The pseudocodes can be found in Algorithm 3.

Algorithm 3 Equal Price-Basedd Search Method With Coordination SNs Monitor Patrolling Algorithm
1: Input: New ID set I i ∈ Q, (i = 1, 2, · · · , m) and sequence it in an increasing way. 2: Initialization, set the min ID I i in the waiting expand node list D k , set the have expanded node list H k = 0. 3: Take I i from D k and expand I i to I i I i+1 , I i I i+2 , · · · , I i I m , meanwhile record the corresponding and I i into H k , respectively. 4: Take min D k continue to expand, i.e., I i I i+2 (d i,i+2 ) is the minimum node, expand it to , then update D k and H k . 5: Continue Step 4 until a new expanded lattice with all of the ID sequence I i I i+1 I i+2 I m appeared. 6: Set t = 0, I i = 0. According to the new ID sequence, assign each ANs to monitor one lattice. 7: If there is no ANs monitoring at ID I i , Set I i = I i + 1; otherwise I i = 0 8: Call algorithm 2. 9: t = t + 1, If an AN detects an intruder at time slot t − 1, then it claims itself not busy. Count the total number of not busy ANsn, ifn > 0, continue. 10: Then ANs are newly selected to monitor lattices with ID I i = I i + 1. 11: Continue Step 6 until all ANs run out of energy.

Simulation Results
In this section, simulation results are provided to validate the effectiveness of the proposed method. A stationary two-dimensional Poisson point process is used to model the locations of SNs. Meanwhile, each virtual lattice is considered to be fully covered if at least one SN is located in this lattice. Accordingly to Lemma 3, the maximal transmission range is chosen as R m = √ 8/(1 − DOI), where DOI = 0.1. The length of each virtual lattice is designed as a constant, i.e., r = 5. Similar to the assumption in [32], the arrival time of the intruder in this paper is assumed to follow the independent and identically distributed Weibull distribution. In addition, it is designed that λ = 10.
Based on the above design, 60 SNs are randomly deployed in the 50 × 50 region, and this region is divided into 100 virtual lattices. In Figure 8, the positions of SNs follow a Poisson distribution, and there exist gaping holes in the coverage lattice. Meanwhile, Figure 9 shows the coverage results of SNs, and it can been seen that most of the region can achieve multiple coverage. In order to improve the coverage rate and intrusion detection probability, the ANs in corresponding lattices are activated, and it can be seen that the region is fully covered by the SNs and ANs as shown in Figure 10. Obviously, the AN-assisted UWSNs can achieve full coverage with a minimal amount of activated ANs. Correspondingly, the invasive monitoring probability can be improved, and the improved full coverage can be seen in Figure 11.   Next, we evaluate the performance of BLMP, which is performed in an ideal condition. In Figure 12, we fix β = 4, and the number of ANs is n = 10. When N = 40, which includes 30 SNs, the average intruder detection probability γ does not change with time slot T, as shown in Figure 12. To be more convincing, we change the value of N to 50, 60, 70 and 80. From Figure 12, it can be obtained that γ does not change during the continuous monitoring time slot T, and the values of γ satisfy the result in Theorem 1. To investigate the impact of β on γ, we give a similar simulation result in Figure 13. Keeping N = 50 (40 SNs and 10 ANs), we fix the values of β to 4, 5, 6 and 7, and the results are the same when time slot T is varying. Finally, we set N = 40 and β = 5 as a comparison in Figure 14. It is clearly shown that only N can impact the value of γ. Intuitively, the optimal network structure constructed in Algorithm 2 is shown in Figure 15. According to (5), the energy consumption of SNs is computed, and Figure 16 shows the energy consumption comparison between the two topology structures. Compared with the non-optimization topology [20], the optimized network structure in this paper can improve the energy efficiency.

Conclusion and Future Work
In this paper, we investigate the underwater intrusion detection problem with AN-assisted UWSNs. In order to detect the attacker, a virtual-lattice-based monitor patrolling algorithm is first proposed. Meanwhile, an optimal and coordinative lattice-based monitor patrolling algorithm is also provided to reduce the redundancy of communication links and improve detection probability. In addition, an equal price search strategy is further given for ANs to find the shortest patrolling path. Different from the previous works, the optimized topology can save the communication energy consumption, and the mobility of ANs can improve the detection probability. In the end, simulation results are provided to show the effectiveness of the proposed method.
In our future work, the cooperation control of multiple ANs can be designed to further expedite the underwater intrusion detection problem, such that the ubiquitous monitoring capability can be enhanced with the cooperation of SNs and ANs.