Ahmad Salam AlRefai

Introduction System Features General Overview (general process) Details of each component Simulation Results Considerations References Questions & Answers

2

Security is critical for many sensor network application.

Sensor network has a number of limitations

Trustworthy sensor collaboration might fail.

Effective, light, flexible algorithm is required to detect internal adversary given that only localized information is available.

3

Each sensor monitor the neighboring sensors.

Might refer to other neighbor results in sparse.

The sensor explore the spatial correlation among networking behaviors.

Majority vote is conducted to get the final decision.

4

No prior knowledge Generic Localized Application friendly

5

6

closed set of nodes monitored by x directly, (one hop neighborhood).

represent another neighborhood (dense ), while sparse ( may include two hop neighbors).

Expressing the resulting q component vector.

Packet dropping rate, Packet sending rate, Forwarding delay time, and sensor reading.

7

F(x) may inaccurate when and F(x) contains indirect monitoring results. (sparse).

Trust-Based False Information Filtering Protocol: sensor x assigns a trust value to each neighbor in the range [0,1], closer to 1 indicates higher probability that Xi is normal.

8

is studied to detect outliers.

Xi is considered as outlier if the distance between it and the center of the data set is greater than some threshold .

F(xi) form a sample of multivariate normal distribution (as ).

The Mahalanobis squared distance

9

If the mahalanobis distance is very large, the node should be treated as an insider attacker.

If xi is declared as an outlier. Since the mean and covariance matrix are

very sensitive to the presence of outlier, a robust estimators are required.

The mean and the covariance matrix are estimated according to Orthogonalized Gnanadesikan-kettenring (OGK) estimators. Others (low breaking point or high computational overhead.

The value of is chosen to be the percentile of the chi square distribution q degree of freedom, thus outlier is declared

10

Each sensor announce all identified outlying neighbors to a neighborhood.

They send all the sensors they know with their status 0/1 outlier or not.

If more than half the nodes identify the sensor as outlier, then we consider the sensor as insider attacker.

11

12

13

Simulation to implementation. In the majority vote 0/1

outlaying/normal. Consider designing special detection

scheme for some specific attributes. Consider using different robust statistics

scheme like fast MCD.

14

Fang Liu, Xiuzhen Cheng and Dechang Chen. “Insider Attacker Detection in Wireless Sensor Networks. In IEEE INFOCOM 2007 proceedings.

15

16