A survey of security issues in wireless sensor networks <s> INTRUSION DETECTION <s> This paper describes two techniques that improve throughput in an ad hoc network in the presence of nodes that agree to forward packets but fail to do so. To mitigate this problem, we propose categorizing nodes based upon their dynamically measured behavior. We use a watchdog that identifies misbehaving nodes and a pathrater that helps routing protocols avoid these nodes. Through simulation we evaluate watchdog and pathrater using packet throughput, percentage of overhead (routing) transmissions, and the accuracy of misbehaving node detection. When used together in a network with moderate mobility, the two techniques increase throughput by 17% in the presence of 40% misbehaving nodes, while increasing the percentage of overhead transmissions from the standard routing protocol's 9% to 17%. During extreme mobility, watchdog and pathrater can increase network throughput by 27%, while increasing the overhead transmissions from the standard routing protocol's 12% to 24%. <s> BIB001 </s> A survey of security issues in wireless sensor networks <s> INTRUSION DETECTION <s> The rapid proliferation of wireless networks and mobile computing applications has changed the landscape of network security. The traditional way of protecting networks with firewalls and encryption software is no longer sufficient and effective. We need to search for new architecture and mechanisms to protect the wireless networks and mobile computing application. In this paper, we examine the vulnerabilities of wireless networks and argue that we must include intrusion detection in the security architecture for mobile computing environment. We have developed such an architecture and evaluated a key mechanism in this architecture, anomaly detection for mobile ad-hoc network, through simulation experiments. <s> BIB002 </s> A survey of security issues in wireless sensor networks <s> INTRUSION DETECTION <s> Attack analysis is a challenging problem, especially in emerging environments where there are few known attack cases. One such new environment is the Mobile Ad hoc Network (MANET). In this paper, we present a systematic approach to analyze attacks. We introduce the concept of basic events. An attack can be decomposed into certain combinations of basic events. We then define a taxonomy of anomalous basic events by analyzing the basic security goals. <s> BIB003 </s> A survey of security issues in wireless sensor networks <s> INTRUSION DETECTION <s> Sensor networks are often deployed in unattended environments, thus leaving these networks vulnerable to false data injection attacks in which an adversary injects false data into the network with the goal of deceiving the base station or depleting the resources of the relaying nodes. Standard authentication mechanisms cannot prevent this attack if the adversary has compromised one or a small number of sensor nodes. In this paper, we present an interleaved hop-by-hop authentication scheme that guarantees that the base station will detect any injected false data packets when no more than a certain number t nodes are compromised. Further, our scheme provides an upper bound B for the number of hops that a false data packet could be forwarded before it is detected and dropped, given that there are up to t colluding compromised nodes. We show that in the worst case B is O(t/sup 2/). Through performance analysis, we show that our scheme is efficient with respect to the security it provides, and it also allows a tradeoff between security and performance. <s> BIB004
The security mechanisms implemented in secure routing protocols and secure data aggregation protocols are configured ahead of time in order to inhibit an attacker from breaking the security of the network. These security mechanisms alone cannot ensure perfect security of a WSN. Since sensor nodes can be compromised, it is easy for an adversary to inject false data into a WSN through the compromised nodes. Authentication and data encryption are not enough for ensuring data security. Another approach to protect WSNs involves mechanisms for detecting and reacting to intrusions. An Intrusion Detection System (IDS) monitors a host or network for suspicious activity patterns outside normal and expected behavior [5] . It is based on the assumption that there exists a noticeable difference in the behaviors of an intruder and a legitimate user in the network such that an IDS can match those preprogrammed or possibly learned rules. Based on the analysis model used for analyzing the audit data to detect intrusions, IDSs in ad hoc networks are classified into rule-based and anomaly-based systems. The rule-based intrusion detection systems are used to detect known patterns of intrusions (e.g., BIB001 and BIB002 ) while anomaly-based systems are used to detect new or unknown intrusions (e.g.,  and BIB003 ). A rule-based IDS has a low false-alarm rate when compared to an anomaly-based system, and an anomaly-based IDS has a high intrusion-detection rate in comparison to a rule-based system. However, WSNs are generally application-specific and lack basic information on topology, normal usage, expected communication patterns, and so forth. It is impractical to preinstall some fixed patterns in sensors before they are deployed. Moreover, due to constraints in sensors, to learn and detect these parameters after deployment is both time and energy consuming. Thus, existing IDSs in ad hoc networks may not be adapted to WSNs. The research on intrusion detection in WSNs is still preliminary. Current research focuses on how to detect and eliminate injected false information. Note that compromised nodes can always inject false information into a sensor network. Thus, cooperation among sensors, especially neighboring nodes, is necessary to decide the validity of a report. In this section, we discuss the intrusion detection techniques in WSNs. Zhu et al. proposed an interleaved hop-by-hop authentication (IHOP) scheme in BIB004 . IHOP guarantees that the base station will detect any injected false data packets when no more than a certain number t of nodes are compromised. The sensor network is organized in a cluster-based hierarchy. Each cluster head builds a route to the base station and each intermediate node has an upper associate node and a lower associate node that is t + 1 hops away. IHOP depends on the use of some sharing keys: