Overcoming Adversaries in Sensor Networks: A Survey of Theoretical Models and Algorithmic Approaches for Tolerating Malicious Interference <s> D. Adversaries <s> Sensor networks hold the promise of facilitating large-scale, real-time data processing in complex environments, helping to protect and monitor military, environmental, safety-critical, or domestic infrastructures and resources, Denial-of-service attacks against such networks, however, may permit real world damage to public health and safety. Without proper security mechanisms, networks will be confined to limited, controlled environments, negating much of the promise they hold. The limited ability of individual sensor nodes to thwart failure or attack makes ensuring network availability more difficult. To identify denial-of-service vulnerabilities, the authors analyzed two effective sensor network protocols that did not initially consider security. These examples demonstrate that consideration of security at design time is the best way to ensure successful network deployment. <s> BIB001 </s> Overcoming Adversaries in Sensor Networks: A Survey of Theoretical Models and Algorithmic Approaches for Tolerating Malicious Interference <s> D. Adversaries <s> Large-scale peer-to-peer systems face security threats from faulty or hostile remote computing elements. To resist these threats, many such systems employ redundancy. However, if a single faulty entity can present multiple identities, it can control a substantial fraction of the system, thereby undermining this redundancy. One approach to preventing these "Sybil attacks" is to have a trusted agency certify identities. This paper shows that, without a logically centralized authority, Sybil attacks are always possible except under extreme and unrealistic assumptions of resource parity and coordination among entities. <s> BIB002 </s> Overcoming Adversaries in Sensor Networks: A Survey of Theoretical Models and Algorithmic Approaches for Tolerating Malicious Interference <s> D. Adversaries <s> We consider routing security in wireless sensor networks. Many sensor network routing protocols have been proposed, but none of them have been designed with security as a goal. We propose security goals for routing in sensor networks, show how attacks against ad-hoc and peer-to-peer networks can be adapted into powerful attacks against sensor networks, introduce two classes of novel attacks against sensor networks sinkholes and HELLO floods, and analyze the security of all the major sensor network routing protocols. We describe crippling attacks against all of them and suggest countermeasures and design considerations. This is the first such analysis of secure routing in sensor networks. <s> BIB003 </s> Overcoming Adversaries in Sensor Networks: A Survey of Theoretical Models and Algorithmic Approaches for Tolerating Malicious Interference <s> D. Adversaries <s> Security is important for many sensor network applications. A particularly harmful attack against sensor and ad hoc networks is known as the Sybil attack based on J.R. Douceur (2002), where a node illegitimately claims multiple identities. This paper systematically analyzes the threat posed by the Sybil attack to wireless sensor networks. We demonstrate that the attack can be exceedingly detrimental to many important functions of the sensor network such as routing, resource allocation, misbehavior detection, etc. We establish a classification of different types of the Sybil attack, which enables us to better understand the threats posed by each type, and better design countermeasures against each type. We then propose several novel techniques to defend against the Sybil attack, and analyze their effectiveness quantitatively. <s> BIB004 </s> Overcoming Adversaries in Sensor Networks: A Survey of Theoretical Models and Algorithmic Approaches for Tolerating Malicious Interference <s> D. Adversaries <s> Wireless networks are built upon a shared medium that makes it easy for adversaries to launch jamming-style attacks. These attacks can be easily accomplished by an adversary emitting radio frequency signals that do not follow an underlying MAC protocol. Jamming attacks can severely interfere with the normal operation of wireless networks and, consequently, mechanisms are needed that can cope with jamming attacks. In this paper, we examine radio interference attacks from both sides of the issue: first, we study the problem of conducting radio interference attacks on wireless networks, and second we examine the critical issue of diagnosing the presence of jamming attacks. Specifically, we propose four different jamming attack models that can be used by an adversary to disable the operation of a wireless network, and evaluate their effectiveness in terms of how each method affects the ability of a wireless node to send and receive packets. We then discuss different measurements that serve as the basis for detecting a jamming attack, and explore scenarios where each measurement by itself is not enough to reliably classify the presence of a jamming attack. In particular, we observe that signal strength and carrier sensing time are unable to conclusively detect the presence of a jammer. Further, we observe that although by using packet delivery ratio we may differentiate between congested and jammed scenarios, we are nonetheless unable to conclude whether poor link utility is due to jamming or the mobility of nodes. The fact that no single measurement is sufficient for reliably classifying the presence of a jammer is an important observation, and necessitates the development of enhanced detection schemes that can remove ambiguity when detecting a jammer. To address this need, we propose two enhanced detection protocols that employ consistency checking. The first scheme employs signal strength measurements as a reactive consistency check for poor packet delivery ratios, while the second scheme employs location information to serve as the consistency check. Throughout our discussions, we examine the feasibility and effectiveness of jamming attacks and detection schemes using the MICA2 Mote platform. <s> BIB005 </s> Overcoming Adversaries in Sensor Networks: A Survey of Theoretical Models and Algorithmic Approaches for Tolerating Malicious Interference <s> D. Adversaries <s> Sybil attack is a harmful threat to sensor networks, in which a malicious node illegally forges an unbounded number of identities to defeat redundancy mechanisms. Digital certificates are a way to prove identities. However, they are not viable in sensor networks. In this paper, we propose a light-weight identity certificate method to defeat Sybil attacks. Our proposed method uses one-way key chains and Merkle hash trees. The method thereby avoids the need for public key cryptography. In addition, the method provides a means for authentication of all data messages. A variant of this method is presented that has lower computational requirements under certain conditions. The security of each method is analyzed, and is as good or better than previously-proposed approaches, with fewer assumptions. The overhead (computation, storage, and messages) is also shown to be acceptable for use in sensor networks. <s> BIB006 </s> Overcoming Adversaries in Sensor Networks: A Survey of Theoretical Models and Algorithmic Approaches for Tolerating Malicious Interference <s> D. Adversaries <s> Wireless Sensor Networks (WSNs) are used in many applications in military, ecological, and health-related areas. These applications often include the monitoring of sensitive information such as enemy movement on the battlefield or the location of personnel in a building. Security is therefore important in WSNs. However, WSNs suffer from many constraints, including low computation capability, small memory, limited energy resources, susceptibility to physical capture, and the use of insecure wireless communication channels. These constraints make security in WSNs a challenge. In this article we present a survey of security issues in WSNs. First we outline the constraints, security requirements, and attacks with their corresponding countermeasures in WSNs. We then present a holistic view of security issues. These issues are classified into five categories: cryptography, key management, secure routing, secure data aggregation, and intrusion detection. Along the way we highlight the advantages and disadvantages of various WSN security protocols and further compare and evaluate these protocols based on each of these five categories. We also point out the open research issues in each subarea and conclude with possible future research directions on security in WSNs. <s> BIB007 </s> Overcoming Adversaries in Sensor Networks: A Survey of Theoretical Models and Algorithmic Approaches for Tolerating Malicious Interference <s> D. Adversaries <s> We consider a scenario where a sophisticated jammer jams an area in a single-channel wireless sensor network. The jammer controls the probability of jamming and transmission range to cause maximal damage to the network in terms of corrupted communication links. The jammer action ceases when it is detected by a monitoring node in the network, and a notification message is transferred out of the jamming region. The jammer is detected at a monitor node by employing an optimal detection test based on the percentage of incurred collisions. On the other hand, the network computes channel access probability in an effort to minimize the jamming detection plus notification time. In order for the jammer to optimize its benefit, it needs to know the network channel access probability and number of neighbors of the monitor node. Accordingly, the network needs to know the jamming probability of the jammer. We study the idealized case of perfect knowledge by both the jammer and the network about the strategy of one another, and the case where the jammer or the network lack this knowledge. The latter is captured by formulating and solving optimization problems, the solutions of which constitute best responses of the attacker or the network to the worst-case strategy of each other. We also take into account potential energy constraints of the jammer and the network. We extend the problem to the case of multiple observers and adaptable jamming transmission range and propose a intuitive heuristic jamming strategy for that case. <s> BIB008 </s> Overcoming Adversaries in Sensor Networks: A Survey of Theoretical Models and Algorithmic Approaches for Tolerating Malicious Interference <s> D. Adversaries <s> Sybil attack is a network threat introduced by one or more malicious nodes to declare numerous illegal identifies to confuse or even collapse the network applications. A new detection mechanism, called CRSD, is proposed for static wireless sensor networks, which takes use of the received signal strength (RSS) to infer the distance between two identities and further determines the positions relation of the interesting identities by use of the RSS information from multiple neighbor nodes, e.g., via node cooperation. A Sybil attack is detected when two or more different identities have almost the same position. The analysis and simulation results show that, first, Sybil attack deteriorates the system performance significantly and second, CRSD can detect such attack in most cases, thus protecting the overall performance effectively. <s> BIB009 </s> Overcoming Adversaries in Sensor Networks: A Survey of Theoretical Models and Algorithmic Approaches for Tolerating Malicious Interference <s> D. Adversaries <s> One threat in wireless multi-hop networks is jamming the wireless channel. Jamming is easy to implement but nevertheless can have severe impact on the performance of the network. To study the impact of different jamming attacks as well as different detection approaches simulative evaluation is performed for scalability and reproducibility reasons. However, realistic propagation modeling in the simulator is often neglected. In this paper, we describe our integration of jamming attacks into the new realistic IEEE802.11 MAC and physical layer ofns-2. Based on this we evaluate different detection metrics: RSSI standard deviation, carrier sensing time, and expected packet delivery rate. In contrast to the related work thresholds for the metrics are dynamically and adaptively parametrized. In contrast to other studies that do not consider realistic MAC and physical models in our evaluation the carrier sensing time with dynamic thresholds shows best results. <s> BIB010 </s> Overcoming Adversaries in Sensor Networks: A Survey of Theoretical Models and Algorithmic Approaches for Tolerating Malicious Interference <s> D. Adversaries <s> Multiple-path source routing protocols distribute the total traffic among available paths. In this article, we consider the problem of jamming-aware source routing and avoiding jamming by splitting data rate. We formulate this traffic allocation as a lossy network flow optimization problem using portfolio selection theory from financial statistics. We show that in multi-source networks, this centralized optimization problem can be solved using a distributed algorithm based on decomposition in network utility maximization (NUM). We demonstrate the network’s ability to estimate the impact of jamming and solve it by redirecting the packets or by splitting data rate. Finally, we efficiently allocate the <s> BIB011
In all of the works considered here, there exists an adversary who attempts to disrupt the functionality of the network. The type of malicious behavior differs between models and we delay discussion of certain details to more appropriate sections. However, there are a number of commonalities which we discuss here. There are several ways of interpreting the presence of an adversary. Certainly, this behavior captures the worst-case disruption of transmissions due to non-malicious failures such as software errors or accidental deviations from a global broadcasting schedule. Furthermore, such an adversary also models challenging attacks on the network and these are discussed in this section. Jamming Adversaries: A jamming adversary embodies one or more devices that attempt to interfere with communications by intentionally causing message collisions or simply flooding the channel with useless information. Various jamming strategies are featured prominently in the literature such as constant, random, adaptive, and reactive jamming  , BIB005 , and we use these characterizations in categorizing the results we survey. Constant jamming is the simplest strategy where the adversary perpetually disrupts the communication medium. Of course, little can be done against an adversary with an unbounded energy supply since such an adversary may broadcast in perpetuity. However, such continuous disruption is easily identifiable and subject to various defensive techniques (see BIB001 , BIB008 and references therein). Furthermore, constant jamming requires an abundant energy supply and devices, including those that have suffered adversarial faults, are typically battery powered; therefore, a constant jammer will rapidly deplete its energy supply. In cases where the adversary is (1) equipped with a finite budget for causing interference or BIB003 cannot jam all channels in a multi-channel scenario, we will see results where a constant jammer can be overcome. Random jamming is a less aggressive and energy-efficient strategy that can allow the adversary to remain concealed; however, by its nature, this type of jamming may not be particularly accurate, especially if the adversary wishes to target specific communications. The history of the network might allow for more effective jamming attacks. For instance, devices might periodically activate in order to disseminate data; at this point, an informed adversary can jam the medium. Such an adversary, one who exploits the history of the network in order to increase the efficacy of its attacks, is called adaptive. Finally, a reactive jamming adversary is one who may detect a transmission and then quickly jam the medium. This is a particularly challenging strategy since it does not necessarily require the adversary to jam aggressively as specific transmissions can be targeted. Finally, we note that wireless jamming has received significant attention in the context of more applied research BIB005 , BIB008 - BIB010 . However, these works fall outside our scope and, instead, we refer the interested reader to the surveys of Wood and Stankovic BIB001 , Karlof and Wagner BIB003 , Wang et al. BIB007 and Pelechrinis et al. BIB011 for an overview of these results. Byzantine Adversaries: When a network device suffers a Byzantine fault it is assumed to be controlled by an adversary who uses that device to disrupt the network. In sensor networks, a number of attack models exist, but a common theme is the use of message collisions or message corruption by the adversary to thwart the fundamental task of communication. For instance, Byzantine devices may deviate from a broadcast schedule intentionally, acting to jam transmissions as discussed above. Such devices may also attempt to impersonate correct devices; this is generally referred to as spoofing. Without some form of authentication, ownership of a transmission over the wireless medium may be claimed by anyone. A similar disruptive technique involves message injection where a Byzantine device can change portions of a legitimate transmission. Again, without authentication, this type of interference can go undetected. Unlike the situation for jamming attacks, here the lightweight cryptographic techniques discussed above can help; however, as we will see, authentication is not always accomplished via cryptographic means. In Section IV, we will observe two main Byzantine fault scenarios. The first involves faults that occur uniformly at random and independently with some constant probability; we call this the probabilistic scenario. The second constrains, for each node, the number of neighbors that can suffer a Byzantine fault; we refer to this as the locally-bounded scenario. Later on, when we compare and contrast the results from this area, we will categorize the surveyed works using these two scenarios. Finally, it is important to mention the closely related Sybil attack where an adversary assumes control of a large number of identities in order to influence the network BIB002 . However, in contrast to the Byzantine attacks, Sybil attacks rely on the fact that identities may be cheaply acquired. For instance, while a Byzantine adversary may actually control abundant physical resources such as many sensor network devices, a Sybil adversary might control only a single device and then spoof multiple identities in the network. In this manner, a Sybil adversary may even constitute a majority of identities in the network thus making defense a challenging problem. Surprisingly, despite such a dire attack scenario, there have been several proposals for mitigating Sybil attacks in sensor networks BIB009 - BIB006 . For both a taxonomy of attacks and a survey of the results in this area, we refer the reader to the work of Newsome et al. BIB004 , and we do not examine Sybil adversaries further.