Secure Data Aggregation Technique for Wireless Sensor Networks in the Presence of Collusion Attacks

Secure Data Aggregation Technique for Wireless
Sensor Networks in the Presence
of Collusion Attacks
Mohsen Rezvani, Student Member, IEEE, Aleksandar Ignjatovic, Elisa Bertino, Fellow, IEEE, and
Sanjay Jha, Senior Member, IEEE
Abstract—Due to limited computational power and energy resources, aggregation of data from multiple sensor nodes done at the
aggregating node is usually accomplished by simple methods such as averaging. However such aggregation is known to be highly
vulnerable to node compromising attacks. Since WSN are usually unattended and without tamper resistant hardware, they are highly
susceptible to such attacks. Thus, ascertaining trustworthiness of data and reputation of sensor nodes is crucial for WSN. As the
performance of very low power processors dramatically improves, future aggregator nodes will be capable of performing more
sophisticated data aggregation algorithms, thus making WSN less vulnerable. Iterative filtering algorithms hold great promise for such a
purpose. Such algorithms simultaneously aggregate data from multiple sources and provide trust assessment of these sources, usually
in a form of corresponding weight factors assigned to data provided by each source. In this paper we demonstrate that several existing
iterative filtering algorithms, while significantly more robust against collusion attacks than the simple averaging methods, are
nevertheless susceptive to a novel sophisticated collusion attack we introduce. To address this security issue, we propose an
improvement for iterative filtering techniques by providing an initial approximation for such algorithms which makes them not only
collusion robust, but also more accurate and faster converging.
Index Terms—Wireless sensor networks, robust data aggregation, collusion attacks
Ç
1 INTRODUCTION
DUE to a need for robustness of monitoring and low cost
of the nodes, wireless sensor networks (WSNs) are usu-
ally redundant. Data from multiple sensors is aggregated at
an aggregator node which then forwards to the base station
only the aggregate values. At present, due to limitations of
the computing power and energy resource of sensor nodes,
data is aggregated by extremely simple algorithms such as
averaging. However, such aggregation is known to be very
vulnerable to faults, and more importantly, malicious
attacks [1]. This cannot be remedied by cryptographic meth-
ods, because the attackers generally gain complete access to
information stored in the compromised nodes. For that rea-
son data aggregation at the aggregator node has to be
accompanied by an assessment of trustworthiness of data
from individual sensor nodes. Thus, better, more sophisti-
cated algorithms are needed for data aggregation in the
future WSN. Such an algorithm should have two features.
1. In the presence of stochastic errors such algorithm
should produce estimates which are close to the
optimal ones in information theoretic sense. Thus,
for example, if the noise present in each sensor is a
Gaussian independently distributed noise with zero
mean, then the estimate produced by such an algo-
rithm should have a variance close to the Cramer-
Rao lower bound (CRLB) [2], i.e, it should be close to
the variance of the Maximum Likelihood Estimator
(MLE). However, such estimation should be
achieved without supplying to the algorithm the var-
iances of the sensors, unavailable in practice.
2. The algorithm should also be robust in the presence
of non-stochastic errors, such as faults and malicious
attacks, and, besides aggregating data, such algo-
rithm should also provide an assessment of the reli-
ability and trustworthiness of the data received from
each sensor node.
Trust and reputation systems have a significant role in
supporting operation of a wide range of distributed sys-
tems, from wireless sensor networks and e-commerce
infrastructure to social networks, by providing an assess-
ment of trustworthiness of participants in such distributed
systems. A trustworthiness assessment at any given
moment represents an aggregate of the behaviour of the
participants up to that moment and has to be robust in the
presence of various types of faults and malicious behav-
iour. There are a number of incentives for attackers to
manipulate the trust and reputation scores of participants
in a distributed system, and such manipulation can
severely impair the performance of such a system [3]. The
main target of malicious attackers are aggregation algo-
rithms of trust and reputation systems [4].
M. Rezvani, A. Ignjatovic, and S. Jha are with the School of Computer
Science and Engineering, University of New South Wales, Sydney, NSW
2052, Australia. M. Rezvani acknowledges the support of CSIRO.
E-mail: {mrezvani, ignjat, sanjay}@cse.unsw.edu.au, aleksi@nicta.com.
E. Bertino is with the Department of Computer Science, Purdue Univer-
sity, 305 N. University Street, West Lafayette, IN 47907-2107.
E-mail: bertino@cs.purdue.edu.
Manuscript received 30 July 2013; revised 19 Dec. 2013; accepted 2 Apr. 2014.
Date of publication 10 Apr. 2014; date of current version 16 Jan. 2015.
For information on obtaining reprints of this article, please send e-mail to:
reprints@ieee.org, and reference the Digital Object Identifier below.
Digital Object Identifier no. 10.1109/TDSC.2014.2316816
98 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 12, NO. 1, JANUARY/FEBRUARY 2015
1545-5971 ß 2014 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

Trust and reputation have been recently suggested as
an effective security mechanism for Wireless Sensor Net-
works [5]. Although sensor networks are being increas-
ingly deployed in many application domains, assessing
trustworthiness of reported data from distributed sensors
has remained a challenging issue. Sensors deployed in
hostile environments may be subject to node compromis-
ing attacks by adversaries who intend to inject false
data into the system. In this context, assessing the trust-
worthiness of the collected data becomes a challenging
task [6].
As the computational power of very low power pro-
cessors dramatically increases, mostly driven by demands
of mobile computing, and as the cost of such technology
drops, WSNs will be able to afford hardware which can
implement more sophisticated data aggregation and trust
assessment algorithms; an example is the recent emer-
gence of multi-core and multi-processor systems in sensor
nodes [7].
Iterative Filtering (IF) algorithms are an attractive
option for WSNs because they solve both problems—data
aggregation and data trustworthiness assessment—using
a single iterative procedure [8]. Such trustworthiness esti-
mate of each sensor is based on the distance of the read-
ings of such a sensor from the estimate of the correct
values, obtained in the previous round of iteration by
some form of aggregation of the readings of all sensors.
Such aggregation is usually a weighted average; sensors
whose readings significantly differ from such estimate are
assigned less trustworthiness and consequently in the
aggregation process in the present round of iteration their
readings are given a lower weight.
In recent years, there has been an increasing amount of
literature on IF algorithms for trust and reputation sys-
tems [8], [9], [10], [11], [12], [13], [14], [15]. The perfor-
mance of IF algorithms in the presence of different types
of faults and simple false data injection attacks has been
studied, for example in [16] where it was applied to com-
pressive sensing data in WSNs. In the past literature it
was found that these algorithms exhibit better robustness
compared to the simple averaging techniques; however,
the past research did not take into account more sophisti-
cated collusion attack scenarios. If the attackers have a
high level of knowledge about the aggregation algorithm
and its parameters, they can conduct sophisticated
attacks on WSNs by exploiting false data injection
through a number of compromised nodes. This paper
presents a new sophisticated collusion attack scenario
against a number of existing IF algorithms based on the
false data injection. In such an attack scenario, colluders
attempt to skew the aggregate value by forcing such IF
algorithms to converge to skewed values provided by
one of the attackers.
Although such proposed attack is applicable to a broad
range of distributed systems, it is particularly dangerous
once launched against WSNs for two reasons. First, trust
and reputation systems play critical role in WSNs as a
method of resolving a number of important problems,
such as secure routing, fault tolerance, false data detec-
tion, compromised node detection, secure data aggrega-
tion, cluster head election, outlier detection, etc., [17].
Second, sensors which are deployed in hostile and unat-
tended environments are highly susceptible to node
compromising attacks [18]. While offering better protec-
tion than the simple averaging, our simulation results
demonstrate that indeed current IF algorithms are vulner-
able to such new attack strategy.
As we will see, such vulnerability to sophisticated collu-
sion attacks comes from the fact that these IF algorithms
start the iteration process by giving an equal trust value to
all sensor nodes. In this paper, we propose a solution for
such vulnerability by providing an initial trust estimate
which is based on a robust estimation of errors of individual
sensors. When the nature of errors is stochastic, such errors
essentially represent an approximation of the error parame-
ters of sensor nodes in WSN such as bias and variance.
However, such estimates also prove to be robust in cases
when the error is not stochastic but due to coordinated mali-
cious activities. Such initial estimation makes IF algorithms
robust against described sophisticated collusion attack, and,
we believe, also more robust under significantly more gen-
eral circumstances; for example, it is also effective in the
presence of a complete failure of some of the sensor nodes.
This is in contrast with the traditional non iterative statisti-
cal sample estimation methods which are not robust against
false data injection by a number of compromised nodes [18]
and which can be severely skewed in the presence of a com-
plete sensor failure.
Since readings keep streaming into aggregator nodes in
WSNs, and since attacks can be very dynamic (such as
orchestrated attacks [4]), in order to obtain trustworthiness
of nodes as well as to identify compromised nodes we
apply our framework on consecutive batches of consecu-
tive readings. Sensors are deemed compromised only rel-
ative to a particular batch; this allows our framework to
handle on-off type of attacks (called orchestrated attacks
in [4]).
We validate the performance of our algorithm by simula-
tion on synthetically generated data sets. Our simulation
results illustrate that our robust aggregation technique is
effective in terms of robustness against our novel sophisti-
cated attack scenario as well as efficient in terms of the
computational cost.
Our contributions can be summarized as follows:1
1. Identification of a new sophisticated collusion attack
against IF based reputation systems which reveals a
severe vulnerability of IF algorithms.
2. A novel method for estimation of sensors’ errors
which is effective in a wide range of sensor faults
and not susceptible to the described attack.
3. Design of an efficient and robust aggregation
method inspired by the MLE, which utilises an esti-
mate of the noise parameters obtained using contri-
bution 2 above.
4. Enhanced IF schemes able to protect against sophis-
ticated collusion attacks by providing an initial esti-
mate of trustworthiness of sensors using inputs from
contributions 2 and 3 above.
1. An extended version of this paper has been published as a techni-
cal report in [19].
REZVANI ET AL.: SECURE DATA AGGREGATION TECHNIQUE FOR WIRELESS SENSOR NETWORKS IN THE PRESENCE OF COLLUSION... 99

We provide a thorough empirical evaluation of effective-
ness and efficiency of our proposed aggregation method.
The results show that our method provides both higher accu-
racy and better collusion resistance than the existing
methods.
The remainder of this paper is organized as follows. Sec-
tion 2 describes the problem statement and the assump-
tions. Section 3 presents our novel robust data aggregation
framework. Section 4 describes our experimental results.
Section 5 presents the related work. Finally, the paper is
concluded in Section 6.
2 BACKGROUND, ASSUMPTIONS, THREAT MODEL
AND PROBLEM STATEMENT
In this section, we present our assumptions, discuss IF
algorithms, describe a collusion attack scenario against IF
algorithms, and state the problems that we address in
this paper.
2.1 Network Model
For the sensor network topology, we consider the abstract
model proposed by Wagner in [20]. Fig. 1 shows our
assumption for network model in WSN. The sensor nodes
are divided into disjoint clusters, and each cluster has a clus-
ter head which acts as an aggregator. Data are periodically
collected and aggregated by the aggregator. In this paper
we assume that the aggregator itself is not compromised
and concentrate on algorithms which make aggregation
secure when the individual sensor nodes might be compro-
mised and might be sending false data to the aggregator.
We assume that each data aggregator has enough computa-
tional power to run an IF algorithm for data aggregation.
2.2 Iterative Filtering in Reputation Systems
Kerchove and Van Dooren proposed in [8] an IF algo-
rithm for computing reputation of objects and raters in a
rating system. We briefly describe the algorithm in the
context of data aggregation in WSN and explain the vul-
nerability of the algorithm for a possible collusion attack.
We note that our improvement is applicable to other IF
algorithms as well.
We consider a WSN with n sensors Si, i ¼ 1; . . . ; n. We
assume that the aggregator works on one block of read-
ings at a time, each block comprising of readings at m
consecutive instants. Therefore, a block of readings is
represented by a matrix X ¼ fx1; x2; . . . ; xng where
xi ¼ ½x1
i x2
i . . . xm
i Š
T
, ð1 i nÞ represents the ith
m-dimensional reading reported by sensor node Si. Let
r ¼ ½r1 r2 . . . rmŠT
denote the aggregate values for
instants t ¼ 1; . . . ; m, which authors of [8] call a reputation
vector,2
computed iteratively and simultaneously with a
sequence of weights w ¼ ½w1 w2 . . . wnŠT
reflecting the
trustworthiness of sensors. We denote by rðlÞ
; wðlÞ
the
approximations of r; w obtained at lth round of iteration
(l ! 0).
The iterative procedure starts with giving equal credibil-
ity to all sensors, i.e., with an initial value wð0Þ
¼ 1. The
value of the reputation vector rðlþ1Þ
in round of iteration
l þ 1 is obtained from the weights of the sensors obtained in
the round of iteration l as
rðlþ1Þ
¼
X Á wðlÞ
Pn
i¼1 w
ðlÞ
i
:
Consequently, the initial reputation vector is rð1Þ
¼ 1
n X Á 1,
i.e., rð1Þ
is just the sequence of simple averages of the read-
ings of all sensors at each particular instant. The new weight
vector wðlþ1Þ
to be used in round of iteration l þ 1 is then
computed as a function gðdÞ of the normalized belief diver-
gence d which is the distance between the sensor readings
and the reputation vector rðlÞ
. Thus, d ¼ ½d1 d2 . . . dnŠT
,
di ¼ 1
m xi À rðlþ1Þ

2
2
and w
ðlþ1Þ
i ¼ gðdiÞ, ð1 i nÞ.
Function gðxÞ is called the discriminant function and it
provides an inverse relationship of weights to distances d.
Our experiments show that selecting a discriminant func-
tion has a significant role in stability and robustness of IF
algorithms. A number of alternatives for this function are
studied in [8]:
reciprocal: gðdÞ ¼ dÀk
;
exponential: gðdÞ ¼ eÀd
;
affine: gðdÞ ¼ 1 À kld, where kl 0 is chosen so that
gðmaxifd
ðlÞ
i gÞ ¼ 0.
Algorithm 1 illustrates the iterative computation of the
reputation vector based on the above formulas. Table 1
shows a trace example of this algorithm. The sensor read-
ings in the first three rows of this table are from sensed tem-
peratures in Intel Lab data set [21] at three different time
instants. We executed the IF algorithm on the readings; the
discriminant function in the algorithm was a reciprocal of
the distance between sensor readings and the current com-
puted reputation. The lower part of the table illustrates the
weight vector in each iteration as well as the obtained repu-
tation values for the three different time instants (t1, t2, t3)
in the last three columns. As can be seen, the algorithm con-
verges after six iterations.
2.3 Adversary Model
In this paper, we use a Byzantine attack model, where the
adversary can compromise a set of sensor nodes and inject
any false data through the compromised nodes [22]. We
Fig. 1. Network model for WSN.
2. We find such terminology confusing, because reputation should
pertain to the level of trustworthiness rather than the aggregate value,
but have decided to keep the terminology which is already in use.

assume that sensors are deployed in a hostile unattended
environment. Consequently, some nodes can be physically
compromised. We assume that when a sensor node is com-
promised, all the information which is inside the node
becomes accessible by the adversary. Thus, we cannot rely
on cryptographic methods for preventing the attacks, since
the adversary may extract cryptographic keys from the
compromised nodes. We assume that through the compro-
mised sensor nodes the adversary can send false data to
the aggregator with a purpose of distorting the aggregate
values. We also assume that all compromised nodes can be
under control of a single adversary or a colluding group of
adversaries, enabling them to launch a sophisticated attack.
We also consider that the adversary has enough knowl-
edge about the aggregation algorithm and its parameters.
Finally, we assume that the base station and aggregator
nodes cannot be compromised in this adversary model;
there is an extensive literature proposing how to deal with
the problem of compromised aggregators; in this paper we
limit our attention to the lower layer problem of false data
being sent to the aggregator by compromised individual
sensor nodes, which has received much less attention in
the existing literature.
2.4 Collusion Attack Scenario
Most of the IF algorithms employ simple assumptions about
the initial values of weights for sensors. In case of our adver-
sary model, an attacker is able to mislead the aggregation
system through careful selection of reported data values.
We use visualisation techniques from [18] to present our
attack scenario.
Assume that 10 sensors report the values of temperature
which are aggregated using the IF algorithm proposed in
[8] with the reciprocal discriminant function. We consider
three possible scenarios; see Fig. 2.
In scenario 1, all sensors are reliable and the result of
the IF algorithm is close to the actual value.
In scenario 2, an adversary compromises two sensor
nodes, and alters the readings of these values such
that the simple average of all sensor readings is
skewed towards a lower value. As these two sensor
nodes report a lower value, IF algorithm penalises
them and assigns to them lower weights, because
their values are far from the values of other sensors.
In other words, the algorithm is robust against false
data injection in this scenario because the compro-
mised nodes individually falsify the readings with-
out any knowledge about the aggregation algorithm.
Table 2 illustrates a trace example of the attack sce-
nario on Intel data set; sensors 9 and 10 are compro-
mised by an adversary. As one can see, the
algorithm assigns very low weights to these two sen-
sor nodes and consequently their contributions
decrease. Thus, the IF algorithm is robust against the
simple outlier injection by the compromised nodes.
In scenario 3, an adversary employs three compro-
mised nodes in order to launch a collusion attack. It
listens to the reports of sensors in the network and
instructs the two compromised sensor nodes to
report values far from the true value of the measured
quantity. It then computes the skewed value of the
simple average of all sensor readings and commands
the third compromised sensor to report such skewed
TABLE 1
A Trace Example of Iterative Filtering Algorithm
Fig. 2. Attack scenario against IF algorithm.

average as its readings. In other words, two compro-
mised nodes distort the simple average of readings,
while the third compromised node reports a value
very close to such distorted average thus making
such reading appear to the IF algorithm as a highly
reliable reading. As a result, IF algorithms will con-
verge to the values provided by the third compro-
mised node, because in the first iteration of the
algorithm the third compromised node will achieve
the highest weight, significantly dominating the
weights of all other sensors. This is reinforced in
every subsequent iteration; therefore, the algorithm
quickly converges to a reputation which is very close
to the initial skewed simple average, as shown in
Fig. 2. Table 3 shows the same attack scenario on
Intel Lab data set; sensors 8, 9 and 10 are compro-
mised by an adversary. As one can see, the algorithm
converges quickly to the readings of sensor 10 which
is essentially equal to the simple average value of the
sensors.
In the third scenario, how much the aggregate value is
skewed directly depends on the number of compromised
nodes which distort the sample average of readings.
Moreover, in this scenario, the attacker needs to gain con-
trol over at least two sensor nodes; one which will reports
readings which distort the sample average and another
one which reports such distorted average. In our experi-
ments, we investigate how the behaviour of the IF algo-
rithm depends on the number of compromised nodes; see
Section 4.4.
Clearly, the main source of the above vulnerability comes
from the fact that the algorithm assigns an equal initial
weight to all sensor nodes in the first iteration. Moreover,
the reciprocal discriminant function has a pole at zero
which makes the algorithm unstable in the presence of
sensors exhibiting a very small belief divergence at any
given round of iteration. Therefore, under an attack of the
kind described, the reputation value of the first iteration is
equal to the simple average of readings, and the second vec-
tor of weights is computed based on the distance of each
sensor to the simple average provided by the first iteration.
As most of the IF algorithms in the literature make the same
assumption about the initial trustworthiness of sensors,
we argue that an adversary with sufficient knowledge of
such algorithms can launch an attack as we have described
and deceive the aggregator node.
In the case in which the nodes use cryptography to
ensure the confidentiality of readings they send to the
aggregator, the adversary can still estimate these readings
by sensing the measured quantity using the malicious
nodes.
To address the shortcoming of existing IF methods, we
focus on estimating an initial trust vector based on an esti-
mate of error parameters of sensor nodes. After that, we use
the new trust vector as the initial sensor trustworthiness in
order to consolidate the algorithms against an attack sce-
nario of the type described.
3 ROBUST DATA AGGREGATION
In this section, we present our robust data aggregation
method. Table 4 contains a summary of notations used in
this paper.
3.1 Framework Overview
In order to improve the performance of IF algorithms
against the aforementioned attack scenario, we provide a
robust initial estimation of the trustworthiness of sensor
nodes to be used in the first iteration of the IF algorithm.
Most of the traditional statistical estimation methods for
TABLE 2
A Trace Example of a Simple Attack Scenario
TABLE 3
A Trace Example of the Proposed Collusion Attack Scenario

variance involve use of the sample mean. For this reason,
proposing a robust variance estimation method in the case
of skewed sample mean is an essential part of our
methodology.
In the remainder of this paper, we assume that the sto-
chastic components of sensor errors are independent ran-
dom variables with a Gaussian distribution; however, our
experiments show that our method works quite well for
other types of errors without any modification. Moreover, if
error distribution of sensors is either known or estimated,
our algorithms can be adapted to other distributions to
achieve an optimal performance.
Fig. 3 illustrates the stages of our robust aggregation
framework and their interconnections. As we have men-
tioned, our aggregation method operates on batches of con-
secutive readings of sensors, proceeding in several stages.
In the first stage we provide an initial estimate of two noise
parameters for sensor nodes, bias and variance; details of
the computations for estimating bias and variance of sen-
sors are presented in Sections 3.2 and 3.3, respectively.
Based on such an estimation of the bias and variance of
each sensor, the bias estimate is subtracted from sensors
readings and in the next phase of the proposed framework,
we provide an initial estimate of the reputation vector calcu-
lated using the MLE. The detailed computation operations
of such estimation are described in Section 3.4.
In the third stage of the proposed framework, the initial
reputation vector provided in the second stage is used to
estimate the trustworthiness of each sensor based on the
distance of sensor readings to such initial reputation vector.
This idea will be described in Section 3.5.
3.2 Estimating Bias
We assume that all sensors in WSN can have some error;
such error et
s of a sensor s is modelled by the Gaussian
distribution random variable with a sensor bias bs and
sensor variance ss, et
s $ N ðbs; s2
sÞ. Let rt denotes the true
value of the signal at time t. Each sensor reading xt
s can
be written as
xt
s ¼ rt þ et
s: (1)
The main idea is that, since we have no access to the true
value rt we cannot obtain the value of the error et
s; however,
we can obtain the values of the differences of such errors.
Thus, if we define dði; jÞ ¼ 1
m
Pm
t¼1 ðxt
i À xt
jÞ, we get
dði; jÞ ¼
1
m
Xm
t¼1
À
xt
i À xt
j
Á
¼
1
m
Xm
t¼1
et
i À
1
m
Xm
t¼1
et
j;
where et
i is a random variable with Gaussian distribution
et
i $ N ðbi; s2
i Þ. Let ei ¼ 1
m
Pm
t¼1 et
i be the sample mean of
this random variable. As the sample mean is an unbi-
ased estimator of the expected value of a random vari-
able, we have
dði; jÞ ¼ ei À ej % bi À bj:
Let dd ¼ fdði; jÞ : 1 i; j ng; this matrix is an estimator
for mutual difference of sensor bias. In order to obtain the
sensor bias from this matrix, we solve the following minimi-
zation problem.
minimize
b
Xn
i¼1
XiÀ1
j¼1
bi À bj
dði; jÞ
À 1
2
subject to
Xn
i¼1
bi ¼ 0:
(2)
To justify our constraint, it is clear that if the mean of
the bias of all sensors is not zero, then there would be no
way to account for it on the basis of sensor readings. On
the other hand, bias of sensors, under normal circumstan-
ces, comes from imperfections in manufacture and cali-
bration of sensors as well as from the fact that they might
be deployed in places with different environmental cir-
cumstances where the sensed scalar might in fact have a
slightly different value. Since by the very nature we are
interested in obtaining a most reliable estimate of an aver-
age value of the variable sensed, it is reasonable to
assume that the mean bias of all sensors is zero (without
faults or malicious attacks). We chose the above objective
rather than
Pn
i¼1
PiÀ1
j¼1 ðbi À bj À dði; jÞÞ2
to improve the
performance in case when biases can be of very different
magnitudes.
We introduce a Lagrangian multiplier and look at
extremal values of the following function:
Fð~bÞ ¼
Xn
i¼1
XiÀ1
j¼1
bi À bj
dði; jÞ
À 1
2
þ
Xn
i¼1
bi:
By setting the gradient of Fð~bÞ to zero we obtain a system
of linear equations whose solution is our approximation of
the the bias values. If we let
dði; jÞ ¼
Àdðj; iÞ i j;
dðj; iÞ i ! j;

then these equations can be written in the following com-
pact form:
Fig. 3. Our robust data aggregation framework.
TABLE 4
Notation Used in This Paper

Pn
i¼1
i6¼k
2
dði;kÞ2 bi À
Pn
i¼1
i6¼k
2
dði;kÞ2 bk À ¼ 2
Pn
i¼1
i6¼k
1
dði;kÞ;
for all k ¼ 1; . . . ; nPn
i¼1 bi ¼ 0:
8

:
(3)
Note that the obtained value of bi is actually an approxi-
mation of the sample mean of the error of sensor i, which,
in turn is an unbiased estimator of the bias of such a sensor.
3.3 Estimating Variance
In this section, we propose a similar method to estimate var-
iance of the sensor noise using the estimated bias from pre-
vious section. Given the bias vector b ¼ ½b1; b2; . . . ; bnŠ and
sensor readings fxt
sg, we can define matrices f^xt
sg and
bb ¼ fbði; jÞg as follows:
^xt
s ¼ xt
s À bs; (4)
bði; jÞ ¼
1
m À 1
Xm
t¼1
À
^xt
i À ^xt
j
Á2
¼
1
m À 1
Xm
t¼1
ÀÀ
xt
i À xt
j
Á
À bi À bj
À ÁÁ2
:
By (1) we have xt
i À xt
j ¼ ðrt þ et
iÞ À ðrt þ et
jÞ ¼ et
i À et
j; thus,
we obtain
bði; jÞ ¼
1
m À 1
Xm
t¼1
À
et
i À bi
Á2
þ
1
m À 1
Xm
t¼1
À
et
j À bj
Á2
À
2
m À 1
Xm
t¼1
À
et
i À bi
ÁÀ
et
j À bj
Á
:
We assume that the sensors noise is generated by inde-
pendent random variables;3
as we have mentioned, our
approximations of the bias bi are actually approximations of
the sample mean; thus
1
m À 1
Xm
t¼1
À
et
i À bi
ÁÀ
et
j À bj
Á
% Covðei; ejÞ ¼ 0
and similarly
bði; jÞ ¼
1
m À 1
Xm
t¼1
À
et
i À bi
Á2
þ
1
m À 1
Xm
t¼1
À
et
j À bj
Á2
% s2
i þ s2
j :
The above formula shows that we can estimate the vari-
ance of sensors noise by computing the matrix bb. We also
compute the sum of variances of all sensors using the fol-
lowing Lemma.
Lemma 3.1 (Total Variance). Let xt
be the mean of readings in
time t, then, using (4) and our assumption that
Pn
i¼1 bi ¼ 0,
we have
xt
¼
1
n
Xn
j¼1
xt
j ¼
1
n
Xn
j¼1
^xt
j;
and the statistic
SðtÞ ¼
n
mðn À 1Þ
Xn
i¼1
Xm
t¼1
À
^xt
i À xt
Á2
is an unbiased estimator of the sum of the variances of all sen-
sors,
Pn
i¼1 vi.
We presented the proof of the lemma in [19]. To obtain an
estimation of variances of sensors from the matrix
bb ¼ fbði; jÞg we solve the following minimization problem:
minimize
v
Xn
i¼1
XiÀ1
j¼1
vi þ vj
bði; jÞ
À 1
2
subject to
Xn
i¼1
vi ¼
n
mðn À 1Þ
Xn
i¼1
Xm
t¼1
^xt
i À xt
À Á2
:
(5)
Note that the constrain of the minimisation problem comes
from Lemma 3.1. We again introduce a Lagrangian multi-
plier and by solving the minimization problem, we obtain
linear Equations (6):
Pn
i¼1
i6¼k
1
bði;kÞ2 vi þ
Pn
i¼1
i6¼k
1
bði;kÞ2 vk þ
2 ¼
Pn
i¼1
1
bði;kÞ;
for all k ¼ 1; . . . ; n
Pn
i¼1 vi ¼ n
mðnÀ1Þ
Pn
i¼1
Pm
t¼1 ^xt
i À xt
À Á2
:
8

:
(6)
3.4 MLE with Known Variance
In the previous sections, we proposed a novel approach
for estimating the bias and variance of noise for sensors
based on their readings. The variance and the bias of a
sensor noise can be interpreted as the distance measures
of the sensor readings to the true value of the signal. In
fact, the distance measures obtained as our estimates of
the bias and variances of sensors also make sense for
non-stochastic errors.
Given matrix fxt
sg where xt
s $ rt þ N ðbs; s2
sÞ and esti-
mated bias and variance vectors b and ss, we propose to
recover rt using (an approximate form of) the MLE
applied to the values obtained by subtracting the bias
estimates from sensors readings. As it is well known, in
this case the MLE has the smallest possible variance as it
attains the CRLB.
From a heuristic point of view, we removed the
“systematic component” of the error by subtracting a quan-
tity which in the case of a stochastic error corresponds to an
estimate of bias; this allows us to estimate the variability
around such a systematic component of the error, which, in
case of stochastic errors, corresponds to variance. We can
now obtain an estimation which corresponds to MLE for-
mula for the case of zero mean normally distributed errors,
but with estimated rather than true variances. Therefore, we
assume that the expected value rt of the measurements is
the true value of the quantity measured, and is the only
parameter in the likelihood function. Thus, in the expres-
sion for the likelihood function for normally distributed
unbiased case,
LnðrtÞ ¼
Yn
i¼1
1
si
ffiffiffiffiffiffi
2p
p e
À1
2
ðxt
i
ÀrtÞ2
s2
i3. We analyze our estimation method with synthetic correlated data
and the experimental results show that the our method produces excel-
lent results even for correlated noise.

we replace s2
i by the obtained variance vi from Equation (6).
Moreover, by differentiating the above formula with respect
to rt and setting the derivative equal to zero we get
rt ¼
Xn
i¼1
1
vi
Pn
j¼1
1
vj
xt
i for all t ¼ 1; . . . ; m: (7)
Equation (7) provide an estimate of the true value of the
quantity measured in a form of a weighted average of sen-
sor readings, with the sensor readings given a weight
inversely proportional to the estimation of their error vari-
ance provided by our method:
r ¼
Xn
s¼1
wsxs: (8)
Note that this method estimates the reputation vector
without any iteration. Thus, the computational complexity
of the estimation is considerably less than the existing IF
algorithms.
3.5 Enhanced Iterative Filtering
According to the proposed attack scenario, the attacker
exploits the vulnerability of the IF algorithms which origi-
nates from a wrong assumption about the initial trustwor-
thiness of sensors. Our contribution to address this
shortcomings is to employ the results of the proposed
robust data aggregation technique as the initial reputation
for these algorithms. Moreover, the initial weights for all
sensor nodes can be computed based on the distance of sen-
sors readings to such an initial reputation. Our experimental
results illustrate that this idea not only consolidates the IF
algorithms against the proposed attack scenario, but using
this initial reputation improves the efficiency of the IF algo-
rithms by reducing the number of iterations needed to
approach a stationary point within the prescribed tolerance;
see Section 4.2.
4 SIMULATION RESULTS
In this section, we report on a detailed numerical simulation
study that examines robustness and efficiency of our data
aggregation method.4
The objective of our experiments is to
evaluate the robustness and efficiency of our approach for
estimating the true values of signal based on the sensor
readings in the presence of faults and collusion attacks. For
each experiment, we evaluate the accuracy based on Root
Mean Squared error (RMS error) metric and efficiency based
on the number of iterations needed for convergence of IF
algorithms.
4.1 Experimental Settings
All the experiments have been conducted on an HP PC with
3.30 GHz Intel Core i5-2500 processor with 8 GB RAM run-
ning a 64-bit Windows 7 Enterprise. The program code has
been written in MATLAB R2012b. Although there are a
number of real world data sets for evaluating reputation
systems and data aggregation in sensor networks such as
Intel data set [21], none of them provides a clear ground
truth. Thus, we conduct our experiments by generating syn-
thetic data sets. The experiments are based on simulations
performed with both correlated and uncorrelated sensor
errors. If not mentioned otherwise, we generate synthetic
data sets according to the following parameters:
Each simulation experiment was repeated 200 times
and then results were averaged.
Number of sensor nodes is n ¼ 20.
Number of readings for each sensor is m ¼ 400.
For statistical parameters of the errors (noise) used to
corrupt the true readings, we consider several ranges
of values for bias, variance and covariance of noise
for each experiment.
The level of significance in K-S test is a ¼ 0:05.
In all experiments, we compare our robust aggregation
method against three other IF techniques proposed for rep-
utation systems. For all parameters of other algorithms used
in the experiments, we set the same values as used in the
original papers where they were introduced.
The first IF method considered computes the trustwor-
thiness of sensor nodes based on the distance of their
readings to the current state of the estimated reputation
[8]. We described the details of this approach in Sec-
tion 2.2. We investigate two discriminant functions in our
experiments gðdÞ ¼ dÀ1
and gðdÞ ¼ 1 À kld, and call these
methods dKVD-Reciprocal and dKVD-Affine, respectively.
The second IF method we consider is a correlation
based ranking algorithm proposed by Zhou et al. in [9].
In this algorithm, trustworthiness of each sensor is
obtained based on the correlation coefficient between the
sensors readings and the current estimate of the true
value of the signal. In other words, this method gives
credit to sensor nodes whose readings correlate well
with the estimated true value of the signal. Based on this
idea, the authors proposed an iterative algorithm for esti-
mating the true value of the signal by applying a
weighted averaging technique. They argued that correla-
tion coefficient is a good way to quantify the similarity
between two vectors. Thus, they employed Pearson cor-
relation coefficient between sensor readings and the cur-
rent state of estimate signal in order to compute the
sensor weight. We call this method Zhou.
The third algorithm considered has been proposed by
Laureti et al. in [10] and is an IF algorithm based on a
weighted averaging technique similar to the algorithm
described in Section 2.2. The only difference between these
two algorithms is in the discriminant function. The authors
in [10] exploited discriminant function gðdÞ ¼ dÀ0:5
. We call
this method Laureti.
We apply dKVD-Reciprocal, dKVD-Affine, Zhou, Laureti
and our robust aggregation approach to synthetically gener-
ated data. Although we can simply apply our robust frame-
work to all existing IF approaches, in this paper we
investigate the improvement which addition of our initial
trustworthiness assessment method produces on the robust-
ness of dKVD-Reciprocal and dKVD-Affine methods (We call
4. Unfortunately, we are unable to prove mathematically that our
system is secure; however we demonstrated higher robustness com-
pared to the state of the art by thorough empirical evaluation. We are
working on obtaining a rigorous proof but this appears to be a challeng-
ing problem.

them RobustAggregate-Reciprocal and RobustAggregate-Affine,
respectively.).
Table 5 shows a summary of discriminant functions for
all of the above four different IF methods.
We first conduct experiments by injecting only Gaussian
noise into sensor readings. In the second part of the experi-
ments, we investigate the behaviour of these approaches by
emulating a simple, non-colluding attack scenario pre-
sented in the second case of Fig. 2. We then evaluate these
approaches in the case of our sophisticated attack scenario.
4.2 Accuracy and Efficiency without an Attack
In the first batch of experiments we assume that there are no
sensors with malicious behaviour. Thus, the errors are fully
stochastic; we consider Gaussian sensors errors. In order to
evaluate the performance of our algorithm in comparison
with the existing algorithms, we produce the following four
different synthetic data sets.
1. Unbiased error. We considered various distributions
of the variance across the set of sensors and
obtained similar results. We have chosen to present
the case with the error of a sensor s at time t is
given by et
s $ N ð0; s Â s2
Þ, considering different
values for the baseline sensor variance s2
. Fig. 4a
shows the results of the MLE with our noise param-
eter estimation (steps 1 and 2 in Fig. 3) and the
information theoretic limit for the minimal variance
provided by the CRLB, achieved, for example, using
the MLE with the actual, exact variances of sensors,
which are NOT available to our algorithm. As one
can see in this figure, our proposed approach nearly
exactly achieves the minimal possible variance com-
ing from the information theoretic lower bound.
Furthermore, Fig. 4b illustrates the performance of
our approach for the initial trustworthiness assess-
ment of sensors with different discriminant func-
tions as well as other IF algorithms. It shows that in
this experiment, the performance of our approach
with both discriminant functions is very similar to
the original IF algorithm.
2. Bias error. In this scenario, we inject bias error to
sensor readings, generated by Gaussian distribu-
tion with different variances. Therefore, the error
of sensor s in time t is generated by et
s $
N ðN ð0; s2
bÞ; s Â s2
Þ with the variance of the bias
s2
b ¼ 4 and increasing values for variances, where
the variance of sensor s is equal to s Â s2
. Thus,
the sensors bias is produced by a zero mean
Gaussian distribution random variable. Fig. 4c
shows the RMS error for all algorithms in this sce-
nario. As can be seen in this figure, since all of the
IF algorithms, along with our approach, generate
an error close to their errors in the unbiased sce-
nario, we can conclude that the methods are sta-
ble against bias but fully stochastic noise.
3. Correlated noise. The heuristics behind our initial vari-
ance estimation assumed that the errors of sensors
are uncorrelated. Thus, we tested how the perfor-
mance of our method degrades if the noise becomes
correlated and how it compares to the existing meth-
ods under the same circumstances. So in this sce-
nario, we assume that the errors of sensors are no
longer uncorrelated. Possible covariance functions
can be of different types, such as Spherical, Power
Exponential, Rational Quadratic, and Matern; see [23].
Although our proposed method can be applied to all
covariance functions, we present here the results for
the case of the Power Exponential function rði; jÞ ¼
e
À j iÀj j
n . Moreover, the variance of a sensor s is again
set to s2
s ¼ s Â s2
. From the corresponding covari-
ance matrix SS ¼ fSij ¼ rði; jÞsisj : i; j ¼ 1 . . . ng,
the noise values of sensors are generated from multi-
variate Normal distribution Noise $ N ðBias; SSÞ. In
this scenario, we take into account different values of
s for generating the noise values of sensors in order
to analyse the accuracy of the data aggregation
under various levels of noise. Fig. 4d shows the RMS
error of the algorithms for this scenario. As can be
seen in this figure, our approach with reciprocal dis-
criminant function improves dKVD-Reciprocal algo-
rithm for all different values of variance, although
our method with affine function generates very simi-
lar RMS error to the original dKVD-Affine algorithm.
TABLE 5
Summary of Different IF Algorithms
Fig. 4. Accuracy for No Attack scenarios.

Moreover, the scale of RMS error is in general larger
than in scenarios with uncorrelated noise, as one
would expect. This can be explained by our assump-
tion that the sensors noise is generated by indepen-
dent random variables; see Section 3.3.
The results of our simulations also show that the use of
our initial variance estimation in the second phase of our
proposed framework as the initial reputation of IF algo-
rithms decreases the number of iterations for the algo-
rithms. We evaluate the number of iterations for the IF
algorithm proposed in [8] by providing the initial reputa-
tion from the results of the our approach for both unbiased
and biased sensors errors. The results of this experiment
show that the proposed initial reputation for the IF algo-
rithm improves the efficiency of the algorithm in terms of
the number of iterations until the procedure has converged.
In other words, by providing this initial reputation, the
number of iterations for IF algorithm decreases approxi-
mately 9 percent for reciprocal and around 8 percent for
affine discriminant functions in both biased and unbiased
circumstances. This can be explained by the fact that the
new initial reputation is close to the true value of signal and
the IF algorithm needs fewer iterations to reach its station-
ary point. In the next part of our experiments, we employ
this idea for consolidating the IF algorithm against the pro-
posed attack scenario.
4.3 Accuracy with Simple Attack Scenario
Lim et al. in [18] introduced an attack scenario against tradi-
tional statistical aggregation approaches. We described the
scenario in Section 2.4 and the second round of Fig. 2 as a
simple attack scenario using a number of compromised
node for skewing the simple average of sensors readings. In
this section, we investigate the behavior of IF algorithms
against the simple attack scenario. Note that the objective of
this attack scenario is to skew the sample mean of sensors
readings through reporting outlier readings by the compro-
mised nodes.
In order to evaluate the accuracy of the IF algorithms
against the simple attack scenario, we assume that the
attacker compromises cðc n) sensor nodes and reports
outlier readings by these nodes. We generate synthetically
data sets for this attack scenario by taking into account dif-
ferent values of variance for sensors errors as well as
employing various number of compromised nodes. More-
over, we generate biased readings for all sensor nodes with
bias provided by a random variable with a distribution
N ð0; s2
bÞ with the variance of bias chosen to be s2
b ¼ 4.
Fig. 5 shows the accuracy of the IF algorithms and our
approach in the presence of such simple attack scenario. It
can be seen that the estimates provided by the three
approaches, dKVD-Affine, Zhou and Laureti are significantly
skewed by this attack scenario and their accuracy signifi-
cantly decreases by increasing the number of compromised
nodes. On the other hand, dKVD-Reciprocal provides a rea-
sonable accuracy for all parameter values of this simple
attack scenario (see Fig. 5a). The robustness of this discrimi-
nant function can be explained by the fact that the function
sharply diminishes the contributions of outlier readings
through assigning very low values of weights to them. In
our sophisticated collusion attack scenario, we exploit this
property in order to compromise systems employing such
discriminant function.
The results of this experiment clearly show that our ini-
tial trustworthiness has no negative effects on the perfor-
mance of the IF algorithm with both discriminant functions
in the case of the simple attack scenario. In next section, we
show that how this initial values improve the IF algorithm
in the case of proposed collusion attack scenario, while both
dKVD-Affine and dKVD-Reciprocal algorithms are compro-
mised against such an attack scenario.
4.4 Accuracy with a Collusion Attack
In order to illustrate the robustness of the proposed data
aggregation method in the presence of sophisticated attacks,
we synthetically generate several data sets by injecting the
proposed collusion attacks. Therefore, we assume that the
adversary employs c (c n) compromised sensor nodes to
launch the sophisticated attack scenario proposed in Sec-
tion 2.4. The attacker uses the first c À 1 compromised nodes
to generate outlier readings in order to skew the simple
average of all sensor readings. The adversary then falsifies
the last sensor readings by injecting the values very close to
such skewed average. This collusion attack scenario makes
the IF algorithm to converge to a wrong stationary point. In
order to investigate the accuracy of the IF algorithms with
this collusion attack scenario, we synthetically generate sev-
eral data sets with different values for sensors variances as
well as various number of compromised nodes (c).
Fig. 5. Accuracy with a simple attack scenario.

Fig. 6 shows the accuracy of the IF algorithms and our
approach in the presence of the collusion attack scenario. It
can be seen that the IF algorithms with reciprocal discrimi-
nant function are highly vulnerable to such attack scenario
(see Figs. 6a and 6d), while the affine discriminant function
generates more robust results in this case (see Fig. 6b). How-
ever, the accuracy of the affine discriminant function is still
much worse than the previous experiment without the col-
lusion attack.
This experiment shows that the collusion attack scenario
can circumvent all the IF algorithms we tried. Moreover, the
accuracy of the algorithms dramatically decreases by
increasing the number of compromised nodes participated
in the attack scenario. As explained before, the algorithms
converge to the readings of one of the compromised nodes,
namely, to the readings of the node which reports values
very close to the skewed mean. This demonstrates that an
attacker with enough knowledge about the aggregation
algorithm employed can launch a sophisticated collusion
attack scenario which defeats IF aggregation systems.
Figs. 6e and 6f show the accuracy of our approach by tak-
ing into account the IF algorithm in [8] with reciprocal and
affine discriminant functions, respectively. As one can see,
our proposed approach is superior to all other algorithms in
terms of the accuracy for reciprocal discriminant functions,
while the approach has a very small improvement on affine
function. Moreover, comparing the accuracy of our
approach in this experiment with the results from no attack
and simple attack experiments in Figs. 4 and 5, we can argue
that our approach with reciprocal discriminant function is
robust against the collusion attack scenario. The reason is
that our approach not only provides the highest accuracy
for this discriminant functions, it actually approximately
reaches the accuracy of No Attack scenarios.
As we described, the main shortcoming of the IF algo-
rithms in the proposed attack scenario is that they quickly
converge to the sample mean in the presence of the attack
scenario. In order to investigate the shortcoming, we con-
ducted an experiment by increasing the sensor variances as
well as the number of colluders. In this experiment, we
quantified the number of iterations for the IF algorithm
with reciprocal discriminant function (dKVD-Reciprocal and
RobustAggregate-Reciprocal algorithms). The results obtained
from this experiment show that the original version of the
IF algorithm quickly converges (after around five iterations)
to the skewed values provided by one of the attackers, while
starting with an initial reputation provided by our
approach, the algorithms require around 29 iterations, and,
instead of converging to the skewed values provided by
one of the attackers, it provides a reasonable accuracy.
The results of this experiment validate that our sophisti-
cated attack scenario is caused by the discovered vulnerabil-
ity in the IF algorithms which sharply diminishes the
contributions of benign sensor nodes when one of the sen-
sor nodes reports a value very close to the simple average.
5 RELATED WORK
Robust data aggregation is a serious concern in WSNs and
there are a number of papers investigating malicious data
injection by taking into account the various adversary mod-
els. There are three bodies of work related to our research:
IF algorithms, trust and reputation systems for WSNs, and
secure data aggregation with compromised node detection
in WSNs.
There are a number of published studies introducing IF
algorithms for solving data aggregation problem [8], [9],
[10], [11], [12], [13], [14], [15]. We reviewed three of them in
our comparative experiments in Section 4. Li et al. in [12]
proposed six different algorithms, which are all iterative
and are similar. The only difference among the algorithms
is their choice of norm and aggregation function. Ayday
et al. proposed a slight different iterative algorithm in [13].
Their main differences from the other algorithms are: 1) the
ratings have a time-discount factor, so in time, their impor-
tance will fade out; and 2) the algorithm maintains a black-
list of users who are especially bad raters. Liao et al. in [14]
proposed an iterative algorithm which beyond simply using
the rating matrix, also uses the social network of users. The
main objective of Chen et al. in [15] is to introduce a “Bias-
smoothed tensor model”, which is a Bayesian model of
rather high complexity. Although the existing IF algorithms
consider simple cheating behaviour by adversaries, none of
them take into account sophisticated malicious scenarios
such as collusion attacks.
Our work is also closely related to the trust and reputa-
tion systems in WSNs. Ganeriwal et al. in [24] proposed a
general reputation framework for sensor networks in which
each node develops a reputation estimation for other nodes
by observing its neighbors which make a trust community
Fig. 6. Accuracy with our collusion attack.

for sensor nodes in the network. Xiao et al. in [25] proposed
a trust based framework which employs correlation to
detect faulty readings. Moreover, they introduced a ranking
framework to associate a level of trustworthiness with each
sensor node based on the number of neighboring sensor
nodes are supporting the sensor. Li et al. in [26] proposed
PRESTO, a model-driven predictive data management
architecture for hierarchical sensor networks. PRESTO is a
two tier framework for sensor data management in sensor
networks. The main idea of this framework is to consider a
number of proxy nodes for managing sensed data from sen-
sor nodes. Lim et al. in [6] proposed an interdependency
relationship between network nodes and data items for
assessing their trust scores based on a cyclical framework.
The main contribution of Sun et al. in [27] is to propose a
combination of trust mechanism, data aggregation, and
fault tolerance to enhance data trustworthiness in Wireless
Multimedia Sensor Networks (WMSNs) which considers
both discrete and continuous data streams. Tang et al. in
[28] proposed a trust framework for sensor networks in
cyber physical systems such as a battle-network in which
the sensor nodes are employed to detect approaching ene-
mies and send alarms to a command center. Although fault
detection problems have been addressed by applying trust
and reputation systems in the above research, none of them
take into account sophisticated collusion attacks scenarios
in adversarial environments.
Reputation and trust concepts can be used to overcome
the compromised node detection and secure data aggrega-
tion problems in WSNs. Ho et al. in [29] proposed a frame-
work to detect compromised nodes in WSN and then apply
a software attestation for the detected nodes. They reported
that the revocation of detected compromised nodes can not
be performed due to a high risk of false positive in the pro-
posed scheme. The main idea of false aggregator detection
in the scheme proposed in [30] is to employ a number of
monitoring nodes which are running aggregation opera-
tions and providing a MAC value of their aggregation
results as a part of MAC in the value computed by the clus-
ter aggregator. High computation and transmission cost
required for MAC-based integrity checking in this scheme
makes it unsuitable for deployment in WSN. Lim et al. in
[18] proposed a game-theoretical defense strategy to protect
sensor nodes and to guarantee a high level of trustworthi-
ness for sensed data. Moreover, there is a large volume of
published studies in the area of secure tiny aggregation in
WSNs [31], [32], [33]. These studies focus on detecting false
aggregation operations by an adversary, that is, on data
aggregator nodes obtaining data from source nodes and
producing wrong aggregated values. Consequently, they
address neither the problem of false data being provided by
the data sources nor the problem of collusion. However,
when an adversary injects false data by a collusion attack
scenario, it can affects the results of the honest aggregators
and thus the base station will receive skewed aggregate
value. In this case, the compromised nodes will attest their
false data and consequently the base station assumes that
all reports are from honest sensor nodes. Although the
aforementioned research take into account false data injec-
tion for a number of simple attack scenarios, to the best of
our knowledge, no existing work addresses this issue in the
case of a collusion attack by compromised nodes in a man-
ner which employs high level knowledge about data aggre-
gation algorithm used.
6 CONCLUSIONS
In this paper, we introduced a novel collusion attack sce-
nario against a number of existing IF algorithms. More-
over, we proposed an improvement for the IF algorithms
by providing an initial approximation of the trustworthi-
ness of sensor nodes which makes the algorithms not
only collusion robust, but also more accurate and faster
converging. In future work, We will investigate whether
our approach can protect against compromised aggrega-
tors. we also plan to implement our approach in a dep-
loyed sensor network.
REFERENCES
[1] S. Ozdemir and Y. Xiao, “Secure data aggregation in wireless sen-
sor networks: A comprehensive overview,” Comput. Netw.,
vol. 53, no. 12, pp. 2022–2037, Aug. 2009.
[2] L. Wasserman, All of Statistics : A Concise Course in Statistical Infer-
ence. New York, NY, USA: Springer,.
[3] A. Jøsang and J. Golbeck, “Challenges for robust trust and reputa-
tion systems,” in Proc. 5th Int. Workshop Security Trust Manage.,
Saint Malo, France, 2009, pp. 253–262.
[4] K. Hoffman, D. Zage, and C. Nita-Rotaru, “A survey of attack and
defense techniques for reputation systems,” ACM Comput. Sur-
veys, vol. 42, no. 1, pp. 1:1–1:31, Dec. 2009.
[5] R. Roman, C. Fernandez-Gago, J. Lopez, and H. H. Chen,
“Trust and reputation systems for wireless sensor networks,”
in Security and Privacy in Mobile and Wireless Networking, S.
Gritzalis, T. Karygiannis, and C. Skianis, eds.,Leicester, U.K.:
Troubador Publishing Ltd, 2009 pp. 105–128,.
[6] H.-S. Lim, Y.-S. Moon, and E. Bertino, “Provenance-based trust-
worthiness assessment in sensor networks,” in Proc. 7th Int. Work-
shop Data Manage. Sensor Netw., 2010, pp. 2–7.
[7] H.-L. Shi, K. M. Hou, H. ying Zhou, and X. Liu, “Energy efficient
and fault tolerant multicore wireless sensor network: E2
MWSN,”
in Proc. 7th Int. Conf. Wireless Commun., Netw. Mobile Comput.,
2011, pp. 1–4.
[8] C. de Kerchove and P. Van Dooren, “Iterative filtering in reputa-
tion systems,” SIAM J. Matrix Anal. Appl., vol. 31, no. 4, pp. 1812–
1834, Mar. 2010.
[9] Y. Zhou, T. Lei, and T. Zhou, “A robust ranking algorithm to
spamming,” Europhys. Lett., vol. 94, p. 48002, 2011.
[10] P. Laureti, L. Moret, Y.-C. Zhang, and Y.-K. Yu, “Information fil-
tering via iterative refinement,” Europhys. Lett., vol. 75, pp. 1006–
1012, Sep. 2006.
[11] Y.-K. Yu, Y.-C. Zhang, P. Laureti, and L. Moret, “Decoding infor-
mation from noisy, redundant, and intentionally distorted
sources,” Physica A: Statist. Mech. Appl., vol. 371, pp. 732–744,
Nov. 2006.
[12] R.-H. Li, J. X. Yu, X. Huang, and H. Cheng, “Robust reputation-
based ranking on bipartite rating networks,” in Proc. SIAM Int.
Conf. Data Mining, 2012, pp. 612–623.
[13] E. Ayday, H. Lee, and F. Fekri, “An iterative algorithm for trust
and reputation management,” Proc. IEEE Int. Conf. Symp. Inf. The-
ory, vol. 3, 2009, pp. 2051–2055.
[14] H. Liao, G. Cimini, and M. Medo, “Measuring quality, reputation
and trust in online communities,” in Proc. 20th Int. Conf. Found.
Intell. Syst., Aug. 2012, pp. 405–414.
[15] B.-C. Chen, J. Guo, B. Tseng, and J. Yang, “User reputation in a
comment rating environment,” in Proc. 17th ACM SIGKDD Int.
Conf. Knowl. Discovery Data Mining, 2011, pp. 159–167.
[16] C. T. Chou, A. Ignatovic, and W. Hu, “Efficient computation of
robust average of compressive sensing data in wireless sensor net-
works in the presence of sensor faults,” IEEE Trans. Parallel Dis-
trib. Syst., vol. 24, no. 8, pp. 1525–1534, Aug. 2013.
[17] Y. Yu, K. Li, W. Zhou, and P. Li, “Trust mechanisms in wireless
sensor networks: Attack analysis and countermeasures,” J. Netw.
Comput. Appl., vol. 35, no. 3, pp. 867–880, 2012.

[18] H.-S. Lim, G. Ghinita, E. Bertino, and M. Kantarcioglu, “A game-
theoretic approach for high-assurance of data trustworthiness in
sensor networks,” in Proc. IEEE 28th Int. Conf. Data Eng., Apr.
2012, pp. 1192–1203.
[19] M. Rezvani, A. Ignjatovic, E. Bertino, and S. Jha, “Secure data
aggregation technique for wireless sensor networks in the pres-
ence of collusion attacks,” School Comput. Sci. and Eng., Univ.
New South Wales, Kensington, NSW, Australia, Tech. Rep.
UNSW-CSE-TR-201319, Jul. 2013.
[20] D. Wagner, “Resilient aggregation in sensor networks,” in Proc.
2nd ACM Workshop Security Ad Hoc Sens. Netw., 2004, pp. 78–87.
[21] (2004). The Intel lab data Data set [Online]. Available: http://
berkeley.intel-research.net/labdata/
[22] B. Awerbuch, R. Curtmola, D. Holmer, C. Nita-rotaru, and H.
Rubens, “Mitigating byzantine attacks in ad hoc wireless
networks,” Dept. Comput. Sci., Johns Hopkins Univ., Baltimore,
MD, USA, Tech. Rep., 2004.
[23] M. C. Vuran and I. F. Akyildiz, “Spatial correlation-based collabo-
rative medium access control in wireless sensor networks,” IEEE/
ACM Trans. Netw., vol. 14, no. 2, pp. 316–329, Apr. 2006.
[24] S. Ganeriwal, L. K. Balzano, and M. B. Srivastava, “Reputation-
based framework for high integrity sensor networks,” ACM Trans.
Sens. Netw., vol. 4, no. 3, pp. 15:1–15:37, Jun. 2008.
[25] X.-Y. Xiao, W.-C. Peng, C.-C. Hung, and W.-C. Lee, “Using Sen-
sorRanks for in-network detection of faulty readings in wireless
sensor networks,” in Proc. 6th ACM Int. Workshop Data Eng. Wire-
less Mobile Access, 2007, pp. 1–8.
[26] M. Li, D. Ganesan, and P. Shenoy, “PRESTO: Feedback-driven
data management in sensor networks,” in Proc. 3rd Conf. Netw.
Syst. Des. Implementation, vol.3, 2006, pp. 23–23.
[27] Y. Sun, H. Luo, and S. K. Das, “A trust-based framework for fault-
tolerant data aggregation in wireless multimedia sensor
networks,” IEEE Trans. Dependable Secure Comput., vol. 9, no. 6,
pp. 785–797, Nov. 2012.
[28] L.-A. Tang, X. Yu, S. Kim, J. Han, C.-C. Hung, and W.-C. Peng,
“Tru-Alarm: Trustworthiness analysis of sensor networks in
cyber-physical systems,” in Proc. IEEE Int. Conf. Data Mining,
2010, pp. 1079–1084.
[29] J.-W. Ho, M. Wright, and S. Das, “ZoneTrust: Fast zone-based
node compromise detection and revocation in wireless sensor net-
works using sequential hypothesis testing,” IEEE Trans. Depend-
able Secure Comput., vol. 9, no. 4, pp. 494–511, Jul./Aug. 2012.
[30] S. Ozdemir and H. C¸ am, “Integration of false data detection with
data aggregation and conﬁdential transmission in wireless sensor
networks,” IEEE/ACM Trans. Netw., vol. 18, no. 3, pp. 736–749,
Jun. 2010.
[31] H. Chan, A. Perrig, and D. Song, “Secure hierarchical in-network
aggregation in sensor networks,” in Proc. 13th ACM Conf. Comput.
Commun. Security, 2006, pp. 278–287.
[32] Y. Yang, X. Wang, S. Zhu, and G. Cao, “SDAP: A secure hop-by-
hop data aggregation protocol for sensor networks,” in Proc. 7th
ACM Int. Symp. Mobile Ad Hoc Netw. Comput., 2006, pp. 356–367.
[33] S. Roy, M. Conti, S. Setia, and S. Jajodia, “Secure data aggregation
in wireless sensor networks,” IEEE Trans. Inf. Forensics Security,
vol. 7, no. 3, pp. 1040–1052, Jun. 2012.
Mohsen Rezvani received the bachelor’s and
master’s degrees both in computer engineering
from the Amirkabir University of Technology and
the Sharif University of Technology, respectively.
He is currently working toward the PhD degree in
the School of Computer Science and Engineering
at the University of New South Wales, Sydney,
Australia. His research interests include trust and
reputation systems in WSNs. He is a student
member of the IEEE and the IEEE Communica-
tions Society.
Aleksandar Ignjatovic received the bachelor’s
and master’s degrees both in mathematics from
the University of Belgrade, former Yugoslavia,
and the PhD degree in mathematical logic from
the University of California at Berkeley. After
graduation, he was an assistant professor at the
Carnegie Mellon University, where he taught for
5 years at the Department of Philosophy and
subsequently had a startup in the Silicon Valley.
He joined the School of Computer Science and
Engineering at the University of New South
Wales (UNSW) in 2002, where he teaches algorithms. His research
interests include sampling theory and signal processing, applications of
mathematical logic to computational complexity theory, algorithms for
embedded systems design, and most recently trust-based data aggre-
gation algorithms.
Elisa Bertino is a professor of computer science
at Purdue University, and serves as the research
director of the Center for Education and
Research in Information Assurance and Security
(CERIAS) and interim director of Cyber Center
(Discovery Park). Previously, she was a faculty
member and department head at the Department
of Computer Science and Communication of the
University of Milan. Her main research interests
include security, privacy, digital identity manage-
ment systems, database systems, distributed
systems, and multimedia systems. She is currently the chair of the ACM
SIGSAC and a member of the editorial board of the following interna-
tional journals: the IEEE Security and Privacy, IEEE Transactions on
Service Computing, and the ACM Transactions on Web. She was the
editor-in-chief of the VLDB Journal and the editorial board member of
ACM Transactions on Information and System Security and IEEE Trans-
actions on Dependable and Secure Computing. She coauthored the
book Identity Management Concepts, Technologies, and Systems. She
received the 2002 IEEE Computer Society Technical Achievement
Award for outstanding contributions to database systems and database
security and advanced data management systems, and the 2005 IEEE
Computer Society Tsutomu Kanai Award for pioneering and innovative
research contributions to secure distributed systems. She is a fellow of
the IEEE.
Sanjay Jha received the PhD degree from the
University of Technology, Sydney, Australia. He
is a professor and head of the Network Group at
the School of Computer Science and Engineering
at the University of New South Wales. He is an
associate editor of the IEEE Transactions on
Mobile Computing. He was a member-at-large,
Technical Committee on Computer Communica-
tions (TCCC), IEEE Computer Society for a
number of years. He has served on program
committees of several conferences. He was the
cochair and general chair of the Emnets-1 and Emnets-II workshops,
respectively. He was also the general chair of the ACM Sensys 2007
symposium. His research activities include a wide range of topics in net-
working including wireless sensor networks, ad hoc/community wireless
networks, resilience/quality of service (QoS) in IP networks, and active/
programmable networks. He has published more than 100 articles in
high-quality journals and conferences. He is the principal author of the
book Engineering Internet QoS and a coeditor of the book Wireless Sen-
sor Networks: A Systems Perspective. He is a senior member of the
IEEE and the IEEE Computer Society.
For more information on this or any other computing topic,
please visit our Digital Library at www.computer.org/publications/dlib.

Secure Data Aggregation Technique for Wireless Sensor Networks in the Presence of Collusion Attacks

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to Secure Data Aggregation Technique for Wireless Sensor Networks in the Presence of Collusion Attacks (20)

Recently uploaded (20)

Secure Data Aggregation Technique for Wireless Sensor Networks in the Presence of Collusion Attacks