Date post: | 14-Mar-2016 |
Category: |
Documents |
Upload: | nevada-mcfarland |
View: | 54 times |
Download: | 2 times |
1
Secure In-Network Aggregation for Wireless Sensor Networks
Bo SunDepartment of Computer Science
Lamar University
Research Supported by Texas Advanced Research Program under Grant 003581-0006-2006
2
Outline of Presentation• Introduction and Motivation• Assumptions and Network Model• Local Detection
– Challenges– Extended Kalman Filter based Monitoring– CUSUM GLR based Monitoring
• Collaboration between Intrusion Detection Module (IDM) and System Monitoring Module (SMM)
• Performance Evaluation• Conclusions and Future work
4
Wireless Sensor Networks (WSNs)
TargetBase
StationInternet
User
Sensor Node
Sensor Node
Sensor Field
•Many simple nodes with sensors deployed throughout an environment
Sensing + CPU +Radio = Thousands of Potential Applications
5
Why do we need Aggregation in WSNs?
• Example Query:– What is the maximum
temperature in area A between 10am and 11am?
– Redundancy in the event data• Solution: Combine the data
coming from different sources• Eliminate redundancy• Minimize the number of
transmissions
2
1
3
4
5
6
Secure In-Network Aggregation Problem
I
C D
B
E
HA
F
G
Base Station
JK L M
NWireless Sensor NodeData Transmission
Legend
v1 v2
v3
vi Sensor Measurement
f(v1, v2, v3)
f Aggregation Function
7
Observation
• There is very little work that aims at addressing secure in-network aggregation problem from the intrusion detection perspective
• Our Work– We set up the normal range of the neighbor’s
future transmitted values– We propose the integration between System
Monitoring Modules and Intrusion Detection Modules
8
Intrusion Detection Systems (IDSs)
Intrusion Prevention(Encryption, Authentication,etc.): Not Enough
Weakest Point
IntrusionDetection
LayeredProtection
Security Failure
IntrusionTolerance
• Why do we need IDSs?
• Goal: Highly secured Information Systems
9
1) Misuse Based Detection2) Anomaly Based Detection3) Combination of 1) and 2)
Intrusion Detection Systems
System
NormalActivities
IntrusiveActivities
DetectionEngine
Probes Audits
Database Configuration
Intrusion ResponseAlarms
10
Challenges
• It is difficult to achieve the real aggregated values– High packet loss rate– Individual sensor readings are subject to
environmental noise– Uncertainty of the aggregation function
• Sensor nodes suffer from stringent resources
13
Assumptions
• The majority of nodes around some unusual events are not compromised
• Falsified data inserted by compromised nodes are significantly different from real values
16
Kalman Filter• A set of mathematical equations
– Recursively estimate the state of a process
• Time Update: Project the current state estimate ahead of time• Measurement Update: Adjust the projected estimate by an actual
measurement
18
Extended Kalman Filter based Monitoring – System Dynamic Model
• Process Model
• Measurement Model
19
Extended Kalman Filter based Monitoring – System Equations
• Time Update– State Estimate Equations:– Error Project Equations:
• Measurement Update– Kalman Gain Equation:– Estimate Update with Measurement:
– Error Covariance Update Equation:
21
CUSUM GLR based Location Detection
• EKF based solution ignores the information given by the entire data sequence
• EKF based solution is not suitable if an attacker continuously forge values with small deviations
• Solution– Cumulative Summation (CUSUM) Generalized
Likelihood Ratio (GLR)
24
Collaboration between IDM and SMM to Differentiate Malicious Events from
Emergency Events
Co-DetectorsNormal Nodes
Compromised Node
Compromised NodeFire
False Report
False ReportAlert Transmission
Base Station
26
Simulation Setup
• Aggregation Function– Average, Sum, Min, and Max
• Simulation– Different packet loss ratio: 0.1, 0.25, 0.5– D: Attack Intensity
• The difference between attack data and normal data• Performance Metric
– False Positive Rate– Detection Rate
35
Related Work
• Hu and Evans’ secure Aggregation• Secure Information Aggregation• Secure Hierarchical In-Network Aggregation• Secure hop-by-hop data aggregation• Topological Constraints based Aggregation• Resilient Aggregation
36
Conclusions and Future Work
• Conclusions– Extended Kalman Filter based approach can
provide an effective local detection algorithm– Intrusion Detection Module and System
Monitoring Modules should work together to provide intrusion detection capabilities
• Future Work– Large scale test of the proposed approach– Further elaboration of interactions between IDM
and SMM