Sensor Systems and Software. First International ICST Conference, S-CUBE 2009, Pisa, Italy, September 7-9, 2009, Revised Selected Papers

Research Article

Weak Process Models for Attack Detection in a Clustered Sensor Network Using Mobile Agents

Download
428 downloads
  • @INPROCEEDINGS{10.1007/978-3-642-11528-8_4,
        author={Marco Pugliese and Annarita Giani and Fortunato Santucci},
        title={Weak Process Models for Attack Detection in a Clustered Sensor Network Using Mobile Agents},
        proceedings={Sensor Systems and Software. First International ICST Conference, S-CUBE 2009, Pisa, Italy, September 7-9, 2009, Revised Selected Papers},
        proceedings_a={S-CUBE},
        year={2012},
        month={5},
        keywords={Weak Process Models Anomaly Detection Threat Identification Alarm Generation},
        doi={10.1007/978-3-642-11528-8_4}
    }
    
  • Marco Pugliese
    Annarita Giani
    Fortunato Santucci
    Year: 2012
    Weak Process Models for Attack Detection in a Clustered Sensor Network Using Mobile Agents
    S-CUBE
    Springer
    DOI: 10.1007/978-3-642-11528-8_4
Marco Pugliese1,*, Annarita Giani2,*, Fortunato Santucci1,*
  • 1: University of L’Aquila
  • 2: University of California at Berkeley
*Contact email: marco.pugliese@ieee.org, agiani@eecs.berkeley.edu, santucci@ing.univaq.it

Abstract

This paper proposes a methodology for detecting network-layer anomalies in wireless sensor networks using weak process models (WPM). Weak process models are a non-parametric version of Hidden Markov models (HMM), wherein state transition probabilities are reduced to rules of reachability. Specifically, we present an intrusion detection system based on anomaly detection logic. It identifies any observable event correlated to a threat by applying a set of anomaly rules to the incoming traffic. Attacks are classified into low and high potential attacks according to its final state. Alarms are issued as soon as one or more high potential attacks are detected.