Intrusion Detection System for Wireless Sensor Networks

1. Intrusion Detection System for Wireless Sensor Networks SIBHI/UnCoRe 2007 Students : Rahat Qureshi, Min K. Chang Advisor : Dr. Huirong Fu METHODS/RESULTS METHODS/RESULTS METHODS/RESULTS ABSTRACT Wireless sensor networks (WSNs) consist a set of small sensor devices. These devices are deployed in an ad hoc fashion for sensing a physical phenomenon, and they are connected with each other through wireless communication channels. WSNs are ideal candidates for various applications such as target tracking in battlefield, patient monitoring in a hospital, environment monitoring as well as scientific exploration in dangerous environments. However, WSNs suffer from various attacks, such as jamming, flooding, hello flood attacks. In this project, we design an Intrusion Detection System (IDS) to detect various attacks on WSNs. We are implementing the proposed IDS using MoteIV sensor of Tmote Sky (MoteIV Corporation) and nesC computer language. BACKGROUND • Intrusion detection is the process of monitoring the events occurring in a computer system or network infrastructures and analyzing them for signs of intrusions. • Components of a Sensor • Applications of WSNs Physical Layer • An adversary keeps sending useless radio signals making other nodes unable to communicate. • Detection: we put radio frequency, counter, and timer as a variable and for threshold of RSSI value. • Decision: Information is useless and nodes are unable to communicate? (Whether RSSI value > Threshold if yes and n>N) • Result: Jamming Attack detected. Transport Layer • An attacker forges messages carrying wrong sequence number to one or both endpoints • Variables: # of Mis-Reassembles • Decision: Whether Re-assemble is Correct and Whether mis-reassembles are exceeding the limit. • Result: De-Synchronization Attack Detected. Network & Routing Layer • There are four types of attacks that an adversary can launch against localization. • Variables: Beacon Nodes receive information and timing. • Decision: Whether received information by the node about its address (which group it belongs to) is correct. • Result: If address is not satisfied then it detects one of following attack : - Range-Change Attack - Multi-Impersonation Attack - Silence Attack -Impersonation Attack Figure 3. Detection of De-Synchronization Attack Figure 1. Detection of Jamming Attack Application Layer • An attacker captures one or more of these nodes and tries to send malicious messages through out the network. JTAG, Bootstrap Loader and External flash are some of the Node Capture attacks that can be performed on WSNs. • Variables: Missing Node and source code changed or overwritten Microprocessor • Decision: JTAG, Boot Strap or External Flash Attack • Result: Node Capture Attack Detected Link Layer • Happens during unusually late collision, such as a collision induced near the end of the frame. This could cause Exhaustion of battery resources in nearby nodes. • Variables: Battery Sources are exhausting. • Decision : Received many useless information from compromised nodes and exceeding the threshold? • Result: If yes and battery exhausting then Exhaustion Attack detected. Figure 5. Detection of Localization Anomalies Attack CONCLUSIONS There are many different kinds of attacks in wireless sensor network. In this project, we study various attacks on WSNs, categorize these attacks into sub-systems, and design an intrusion detection system to detect various attacks on WSNs. In the future, we plan to implement and evaluate the proposed mechanisms. OBJECTIVE Design and implement a preliminary Intrusion Detection System for Wireless Sensor Networks For additional information please contact: Name : Rahat Qureshi, Min K. Chang, Advisor : Dr. Huirong Fu Institution : Oakland University, The Pennsylvania State University E-mail address : raquresh@oakland.edu, mkc5021@psu.edu fu@oakland.edu Figure 2. Detection of Exhaustion Attack Figure 4. Detection of Node Capture Attack