Abnormal Node Detection in Wireless Sensor Network by Pair Based Approach using IDS Secure Routing Methodology
Khandakar Rashed Ahmed, Kabir Ahmed · 2008
Summary Mission critical wireless sensor networks require an efficient, lightweight and flexible intrusion detection methodology to identify abnormal node or malicious attackers. The proposed idea in this paper is to develop a new approach of abnormal node detection in wireless sensor network using IDS security routing methodology by dividing the network into number of pairs. Every node of each pair is responsible to identify abnormality of other node in that particular pair considering different attributes of nodes. The abnormal node detection algorithm uses both signatures and knowledge based routing methodology to achieve most accurate and reliable result. All the security solutions proposed so far can be classified into two main categories: prevention based techniques and detection based techniques. Prevention based techniques, such as encryption and authentication, are often regarded as the first line of defense against attacks. Detection based techniques are designed to identify and isolate attackers after prevention based techniques fail. Furthermore, there are two types of detection based techniques: signature based detection and anomaly based detection. Signature based detection techniques match the known attack profiles with suspicious behaviors whereas anomaly based detection techniques detect unusual deviations from pre- established normal profiles to identify the abnormal behaviors. In the proposed methodology, a new pair-based abnormal node detection scheme is introduced which is a combination of prevention and detection based techniques. The total network is divided into a number of pairs. A pair is formed using the special algorithm considering different sensor attribute of nodes which produces the initial knowledgebase for the pair as well as for the sensor network group. Many numbers of pairs forms a sensor network group within a small range of area. The knowledgebase developed its own knowledge dynamically using different sensor node behavior and activities. The nodes in a pair have the same sensing capability and are physically close to other node of the pair. Abnormal node detection algorithm is scheduled to run in locally for each pair and centrally for a sensor network group. The method used both knowledge based and signature based techniques of IDS security routing methodology to identify abnormal node in a pair or in a group of wireless sensor network.