Weak Process Models for Attack Detection in a Clustered Sensor Network Using Mobile Agents

Marco Pugliese; Annarita Giani; Fortunato Santucci

Sensor Systems and Software. First International ICST Conference, S-CUBE 2009, Pisa, Italy, September 7-9, 2009, Revised Selected Papers

Research Article

Weak Process Models for Attack Detection in a Clustered Sensor Network Using Mobile Agents

Download

417 downloads

Cite: BibTeX Plain Text

@INPROCEEDINGS{10.1007/978-3-642-11528-8_4,
    author={Marco Pugliese and Annarita Giani and Fortunato Santucci},
    title={Weak Process Models for Attack Detection in a Clustered Sensor Network Using Mobile Agents},
    proceedings={Sensor Systems and Software. First International ICST Conference, S-CUBE 2009, Pisa, Italy, September 7-9, 2009, Revised Selected Papers},
    proceedings_a={S-CUBE},
    year={2012},
    month={5},
    keywords={Weak Process Models Anomaly Detection Threat Identification Alarm Generation},
    doi={10.1007/978-3-642-11528-8_4}
}

Marco Pugliese
Annarita Giani
Fortunato Santucci
Year: 2012
Weak Process Models for Attack Detection in a Clustered Sensor Network Using Mobile Agents
S-CUBE
Springer
DOI: 10.1007/978-3-642-11528-8_4

Marco Pugliese¹^,*, Annarita Giani²^,*, Fortunato Santucci¹^,*

1: University of L’Aquila
2: University of California at Berkeley

*Contact email: marco.pugliese@ieee.org, agiani@eecs.berkeley.edu, santucci@ing.univaq.it

Abstract

This paper proposes a methodology for detecting network-layer anomalies in wireless sensor networks using weak process models (WPM). Weak process models are a non-parametric version of Hidden Markov models (HMM), wherein state transition probabilities are reduced to rules of reachability. Specifically, we present an intrusion detection system based on anomaly detection logic. It identifies any observable event correlated to a threat by applying a set of anomaly rules to the incoming traffic. Attacks are classified into low and high potential attacks according to its final state. Alarms are issued as soon as one or more high potential attacks are detected.

Keywords: Weak Process Models Anomaly Detection Threat Identification Alarm Generation

Published: 2012-05-25

: http://dx.doi.org/10.1007/978-3-642-11528-8_4