Neighbor Node Trust Based Intrusion Detection System for WSN
0 likes395 views
The document presents a neighbor node trust-based intrusion detection system (IDS) for wireless sensor networks (WSNs) that utilizes trust calculations to classify neighboring nodes as trustworthy, risky, or malicious. It effectively detects attacks such as hello flood, jamming, and selective forwarding by analyzing network statistics and node behaviors. The proposed system includes a trust manager, behavior classifier, and a recommendation database to aid in secure packet forwarding decisions.
Neighbor Node Trust Based Intrusion Detection System for WSN
- 1. Neighbour Node Trust Based Intrusion Detection System for WSN Class Seminar Nov 17 Presented by Hitesh Mohapatra (Ph.D Scholar) Subject In-Charge Dr.S.Panigrahi
- 2. Outline • Abstract • Introduction • Related Work • The proposed IDS • Result and discussion and conclusion • Reference
- 3. Abstract • This seminar presents an intrusion detection technique based on the calculation of trust of the neighbouring node. In the proposed IDS, each node observes the trust level of its neighbour nodes. • Based on these trust values , neighbour nodes may be declared as trust worthy, risky or malicious. • The proposed scheme successfully detects Hello flood attack, jamming attack and selective forwarding attack by analysing the network statistics and malicious node behaviour.
- 4. Introduction Wireless sensor networks • Wireless sensor node • power supply • sensors • embedded processor • wireless link • Many, cheap sensors • wireless easy to install • intelligent collaboration • low-power long lifetime
- 5. Possible applications • Military • Asset monitoring and management, battlefield surveillance, biological attack detection • Ecological • fire detection, flood detection, agricultural uses • Health related • Medical sensing, microsurgery • General engineering • car theft detection, inventory control, residential security
- 6. Security in WSN • Main security threats in WSN are: • Radio links are insecure – eavesdropping / injecting faulty information is possible • Sensor nodes are not temper resistant – if it is compromised the attacker obtains all security information • Protecting confidentiality, integrity, and availability of the communications and computations
- 7. Why security is different? •Sensor Node Constraint •Battery •CPU power •Memory •Networking Constraints and Features •Wireless •Ad hoc •Unattended
- 8. Network defense Protect - Encryption - Firewalls - Authentication - Biometrics Detect - Intrusions - Attacks - Misuse of Resources - Data Correlation - Data Visualization - Malicious S/W - Network Status/ Topology React - Response - Terminate Connections - Block IPAddresses - Containment - Fishbowl - Recovery - Reconstitute
- 9. What is intrusion detection? • Intrusion detection is the process of discovering, analyzing, and reporting unauthorized or damaging network or computer activities • Intrusion detection discovers violations of confidentiality, integrity, and availability of information and resources
- 10. • Intrusion detection demands: • As much information as the computing resources can possibly collect and store • Experienced personnel who can interpret network traffic and computer processes • Constant improvement of technologies and processes to match pace of Internet innovation What is intrusion detection?
- 11. How useful is intrusion detection? • Provide digital forensic data to support post- compromise law enforcement actions • Identify host and network misconfigurations • Improve management and customer understanding of the Internet's inherent hostility • Learn how hosts and networks operate at the operating system and protocol levels
- 12. Intrusion detection models • All computer activity and network traffic falls in one of three categories: • Normal • Abnormal but not malicious • Malicious • Properly classifying these events are the single most difficult problem -- even more difficult than evidence collection
- 13. Intrusion detection models • Two primary intrusion detection models • Network-based intrusion detection monitors network traffic for signs of misuse • Host-based intrusion detection monitors computer processes for signs of misuse • So-called "hybrid" systems may do both • A hybrid IDS on a host may examine network traffic to or from the host, as well as processes on that host
- 14. IDS paradigms • Anomaly Detection – look for abnormal • Misuse Detection – pattern matching • Burglar Alarms - policy based detection • Honey Pots - lure the hackers in • Hybrids - a bit of this and that
- 15. Anomaly detection(cont) • Typical anomaly detection approaches: • Neural networks - probability-based pattern recognition • Statistical analysis - modeling behavior of users and looking for deviations from the norm • State change analysis - modeling system’s state and looking for deviations from the norm
- 16. Core Part Intrusion Detection for WSN
- 17. The proposed intrusion detection 1. The system has a trust manager, which manage the direct and indirect trust (reputation) of a node. 2. The behaviour classifier classifies the behaviour of the node as attacker, trustworthy and risky based on the trust values and calculation obtained from the trust manager. 3. In case of the trustworthy behaviour, the observed node is recommended to the forwarding engine for packet forwarding. 4. When behaviour of the observed node is identified as risky, its risk factor is evaluated and updated. If the observing node is willing to take risk, it recommends the observed node having risky behaviour to the forwarding engine for forwarding. 5. If the observing node does not want to take risk, it stores the risk factor of the observed node in recommendation data base. 6. In case of attack behaviour, the attack classifier distinguishes attack pattern based on the calculation described in the following subsections. 7. The observed node is declined for forwarding purpose. The status of the observed nodes is saved in the recommendation data base.
- 18. Block Diagram of Proposed IDS
- 19. System Model and nodes Initial Observation • In the proposed IDS, a node y0 calculates the level of trust of its neighbouring nodes. • The neighbours of y0 is a set of nodes having one hop contact with node y0 and are represented as • Any node yi possesses set of attributes denoted as • The activity of the node yi is observed by the sensor node y0 by observing its individual attributes. • The observed attributes of node yi are stored by the vector with ever element explaining the node’s activities • If node yi observes its neighbouring nodes it stores the set of the corresponding attribute vectors
- 20. Attributes of WS-Nodes: • Received Signal Strength • Packet Sending Rate • Control Packet Generating Rate • Packets Delivery Ratio • Packet Dropping Rate • Packet Forwarding Rate • Packet Acknowledgment Rate
- 21. Jamming attack • The amount of power in any radio signal received is termed as Received Signal Strength. • The Received Signal Strength of the node y observed by the node y0 is represented as Ps(y). • A node is considered malicious if it has high received signal strength than the vector of received signal strength of its neighbours Nb(y0)={y1......yn}. • In this case the node is considered to have undergone a Jamming attack.
- 22. Hello Flood attack • Packet Generation Rate is the number of control packets generated in a specific interval of time. • Pg(y) is the Packet Generation Rate of node y monitored by the node y0. • A node is considered malicious if it generates high number of control packets than the vector of control packets generated by its neighbours Nb(y0)={y1......yn}. • In this case, the node is considered to have undergone a Hello Flood attack.
- 23. Selective Forwarding Attack • In a multi-hop scenario, a node forwards packets of its neighbours. The rate of packet received by a node and its subsequent forwarding to its destination node is termed as Packet Forwarding Rate. • PFrR(y) is the Packet Forwarding Rate of node y monitored by the node y0. • A node is said to be suffering selective forwarding attack if its packets forwarding rate is much less than the packets forwarding rate of its neighbour Nb(y0)={y1......yn}.
- 24. Trust Trust is calculated by taking average of the direct trust A(y) and indirect trust i.e. reputation B(y). Mathematically :
- 25. Detection of Jamming Attack The total Received Signal Strength of node y observed by node y0 during time interval T0 = Ps0(y) During time interval T1 = Ps1(y) Total packet sending rate of node y observed by node y0 during time interval Tz = Psz(y) Total Received Signal Strength of node y observed by node y0 during time interval Ti = Psi(y) Average Received Signal Strength is calculated as Now at any interval ’i’ if the Received Signal Strength is greater then the summation of average Received Signal Strength and the Received Signal Strength values of the sensor specified in its data sheets, node is suffering from jamming Attack. Mathematically, {Where Psi(y) is the Received Signal Strength of node y at any given interval i observed by node y0. C is the Received Signal Strength values of the sensor specified in its data sheets. Node for which equation 1 does not not hold true, are malicious.}
- 26. Detection of Selective Forwarding Attack •
- 27. Detection of HELLO Flood Attack Let Pg0(y) is the control packets generating rate of node y observed by node y0 during time interval T0. Pg1(y) is the packets generating rate of node y observed by node y0 during time interval T1 and Pgz(y) is the control packets generating rate of node y observed by node y0 during time interval Tz. Let Pgi(y) ) is the control packets generating rate of node y observed by node y0 during time interval Ti. Then the average control packets generating rate is given : Now at any interval ’i’ if the control packets generating rate of any node is greater then the summation of average control packets generating rate and the control packets generating rate values of the sensor specified in the standard protocol, node is suffering from Hello Flood Attack. Mathematically : Where Pgi(y) is the control packets generating rate of node y at any given interval i observed by node y0 . C is the control packets generating rate values of the sensor specified in the standard protocol it follow. Node for which equation 3 does not hold true, are malicious and higher control packets generating rate is the identification of hello flood attack.
- 28. • Detection of Trustworthy (Good) Nodes A node is said to be trustworthy or Good if its current Direct Trust value Ac(y) is greater or equal to the required trust value RTv , meaning that it satisfies the condition :
- 29. Detection of Risky Nodes There are two possibilities about the risky nature of a node. In the first case, there is no prior recommendation about the node , that is B(y)=0 and its current direct trust value Ac(y) is less that the Required Trust Value RTv. Mathematically: Ac(y) < RTv. In this case, the total trust is given as and as B(y)=0 so Then the value of risk is given as :
- 30. Detection of Risky Nodes In the second case, the recommendation value of the node is less than the value of Required Trust Value that is B(y) < RTv and its current direct trust value Ac(y) is less that the Required Trust Value RTv. Mathematically Ac(y) < RTv. In this case, the total trust is given as : Then the value of risk is given by the following equation.
- 31. Storage of Node Status for future use (Reputation) and subsequent Forwarding Decision Recommendation Data Base stores the status of the node. On the bases of calculation, a node may be found malicious, trustworthy or risky. These statistics are used in the future interaction of the nodes. A trustworthy node is recommended for interaction, a malicious node is declined, while decision about packet forwarding through risky node is made, if the node intending to send data is willing to take risk. After the successful determination of the node status as malicious, trustworthy or risky, decision about the packet forwarding through any neighbour node is taken by the packet sending node. The criteria for packet forwarding is the selection of safest path rather than selecting shortest path.
- 32. Results The proposed intrusion detection system is implemented using MATLAB .
- 33. Conclusion We propose an intrusion detection technique based on the principle that nodes in each other neighbourhood behave in a similar way. The proposed NeTMids detects hello flood, jamming and selective forwarding attack. It can be further extended by including other attacks as well. Simulation results shows that network perform better when the proposed NeTMids is deployed. Thank You to original authors and Dr.S.Panigrahi Contact: hiteshmahapatra@gmail.com Mob:9436992299
- 34. Reference 6th International Conference on Emerging Ubiquitous Systems and Pervasive Networks,EUSPN- 2015 Neighbour Node Trust Based Intrusion Detection System for WSN Syed Muhammad Sajjada, Safdar Hussain Boukb, Muhammad Yousafa Riphah Institute of Systems Engineering, Riphah International University, Islamabad, Pakistan Department of Electrical Engineering, Comsats Institute of Information Technology, Islamabad, Pakistan