Cooperative Robust Localization against MaliciousAnchors Based on Semi-Definite Programming

Dexin Wang and Liuqing YangDepartment of Electrical and Computer Engineering, Colorado State University, Fort Collins, CO 80523

dxwang@engr.colostate.edu, lqyang@engr.colostate.edu

Abstract—Location awareness for wireless sensor networkshas attracted significant interests in recent years. In hostileenvironments, there may be malicious attacks to mislead thelocation estimation of target nodes. In this paper, we proposea novel secured localization method by applying cooperativesemi-definite programming (SDP) algorithm. We also introduceresidual normalization to improve the SDP approximation. Co-operation enhances the capability to identify the compromisedanchors and the accuracy of location estimation. SDP improvesthe reliability of the algorithm and the out-of-convex-hull per-formance. Simulation results are provided to demonstrate theaforementioned improvements.

I. INTRODUCTION

In typical wireless sensor networks (WSNs), a large numberof sensors are deployed in a geographical area to collectlocal environmental information. Localization and navigationof the sensors are critical for many applications includingobject tracking, medical services, search and rescue operations,control of home appliances, automotive safety, and battlefieldsurveillance etc. [1]. Usually, two types of sensor nodes areconsidered in a localization system, i.e. anchors (or beacons)and targets. Anchors represents those sensors whose locationare known prior to the localization process, through manualconfiguration or global positioning system (GPS), whereastargets’ locations are to be estimated.

Numerous localization methods [2–6] have been proposedfor WSNs in recent years. These methods share a two-stage ap-proach. In the first stage, targets receive signals from anchors(and other targets in cooperative methods) and, according tothe received signals, obtain some measurements including timeof arrival (ToA), angle of arrival (AoA), or received signalstrength (RSS) etc. Then, in the second stage, targets estimatetheir own location base on the location references, whichinclude anchors’ locations and the measurements just acquired.

However, in hostile environments, there may be maliciousattacks in order to sabotage or mislead the localization oftargets [7, 8]. The consequences of incorrect location es-timates may be disastrous, e.g. improper military decisionsin battlefield or erroneous navigation for unmanned vehicles.Therefore, reliable location estimation is crucial for practicaluse of localization systems.

A common type of malicious attacks is impersonation.The attackers may impersonate anchors to falsely broadcast

† This work is in part supported by the National Science Foundation undergrant No. 1129043.

their locations [8]. With respect to the level of sophistication,attacks can be classified as uncoordinated attacks, collusionattacks, and pollution attacks. For uncoordinated attacks, anattacker only compromises one anchor node and does notcooperate with other attackers. In collusion attacks, severalattackers may mislead targets to the same location coopera-tively. Pollution attacks are similar to collusion attacks exceptthat attackers attempt to mislead the estimate to a location thatis consistent with some authentic location references.

Many existing localization methods become vulnerable insuch attacks. Authentication can provide some, but limited,reliability through cryptography. Even with encrypted locationreferences, it is still possible for the attackers to compromisesome anchors or simply replay location references interceptedat different locations. Attack-resistant minimum mean squareerror (ARMMSE) in [7], verifiable multilateration in [9] etc.are devised to deal with such situations. ARMMSE is a greedyalgorithm based on a iterative Least Trimmed Squares (LTS)[10] approach to identify and eliminate malicious anchors oneby one. However, these algorithms do not involve cooperationbetween targets, and thus limited the performance to detectthe compromised anchors and to mitigate their influence onthe location estimates.

In this paper, we propose a new semi-definite programming(SDP) based cooperative localization method which is robustto the existence of malicious anchors. Cooperation providesmore accurate location estimates as well as better coveragewith the same anchor deployment. It also enhances the capa-bility to detect malicious anchors. SDP improves the reliabilityof the localization process, which had unstable performancedue to its non-convexity. SDP also outperforms the LS basedlocal search algorithms in the out-of-convex-hull scenarios.

The rest of the paper is organized as follows. We firstintroduce the formulation of the localization system in Sec. II.Secondly, some related former works are briefly describedin Sec. III. Detailed in Sec. IV is our proposed algorithm,cooperative attack resistant SDP (CARSDP). Then, somesimulation results are shown in Sec. V. Finally, Sec. VI givesthe conclusions of this paper.

II. SYSTEM MODEL

In a WSN localization system with M anchors and N targetsin R

D, let Va and Vx be the set of all anchors and targetsrespectively. Their locations are represented by a and x as

978-1-4673-3/12/$31.00 ©2013 IEEE978-1-4673-3/12/$31.00 ©2013 IEEE

follows.

a = [a1 a2 · · · aM ]D×M (1)

x = [x1 x2 · · · xN ]D×N , (2)

where am represents the location of the mth anchor, and xi

denotes the location of the ith target.The ability of communication between anchors and targets

are defined by Ea and Ex as

Ea:={(m,n) :am∈Va,xn∈Vx, and ‖am−xn‖≤Ra}

Ex:={(i, j) :xi,xj ∈ Vx, and ‖xi−xj‖ ≤ Rx},(3)

where Ra and Rx are ranges of anchor-target and target-targetcommunications respectively.

Let rmn denote the anchor-target distance measurements as

rmn = ‖am − xn‖+ ηmn, ∀ (m,n) ∈ Ea, (4)

and rij denote the target-target distance measurements as

rij = ‖xi − xj‖+ ηij , ∀ (i, j) ∈ Ex, (5)

where ηmn s and ηij s are i.i.d. Gaussian random variableswith zero mean and variance of σ2.

III. RELATED WORKS

A. Attack Resistant MMSE

Attack resistant minimum mean square error (ARMMSE)is proposed in [7] to accommodate hostile environments inwhich malicious anchors exist.

The algorithm is presented in Algorithm 1, in which[x∗, ς∗] ← Locate(V a) denotes the process that solves theoptimization problem in (6) and gets the location estimatesx∗, i.e. the minimizer, and the minimum mean square error

(MSE) of the distance measurements ς∗, namely the optimalvalue of the objective function, base on the location referencesreceived from the anchors in V a.

minimize ς =1

|Ea|

⎛⎝ ∑

(m,n)∈Ea

(rmn − ‖am − xn‖)2

⎞⎠ . (6)

Algorithm 1 ARMMSE

V ahonest ← V aV amal ← ∅[x∗, ς∗] ← Locate(V a).while ς∗ > ξ AND |V ahonest| > D + 1 do

for all vi ∈ V ahonest do[xi, ςi] ← Locate(V ahonest\{vi})

end fori∗ ← argminvi∈V ahonest

ςix∗ ← xi∗

ς∗ ← ςi∗

V ahonest ← V ahonest\{vi∗}V amal ← V amal

⋃{vi∗}

end whileOutput: x

∗

The threshold ξ for the MSE can be determined base on theχ2 distribution, since the errors are assumed to be Gaussiandistributed when all the anchors are honest and the locationestimate is accurate. Hence, ς∗

σ2 ∼ χ2Nc

, where Nc is thenumber of connections associated with the target. And gradientdescent method is used here to solve the unconstrained LeastSquares (LS) optimization problem in (6).

B. Cooperative Localization

Cooperative localization enhances the performance, in termsof both accuracy and coverage with the same anchor deploy-ment, by making use of target-target distance measurements[3, 6]. Cooperative MSE is defined as

ςc =1

|Ea|+ |Ex|/2

⎛⎝ ∑

(m,n)∈Ea

(rmn − ‖am − xn‖)2

+∑

(i,j)∈Ex,

and i<j

(rij − ‖xi − xj‖)2

⎞⎟⎠ .

(7)

The minimizer x∗ of (7) is the solution for cooperative

localization.

C. Semi-Definite Relaxation

The problem in (6) is non-linear and non-convex withrespect to x. it can be converted into a convex one with semi-definite relaxation. Denote Y = x

Tx, and let

Z =

[ID×D x

xT

Y

] 0. (8)

After relaxation, the problem is reformulated as

minimizeα,α,Z

∑(m,n)∈Ea

αmn +∑

(i,j)∈Ex,

and i<j

αij

subject to

([−aT

m eTn

]Z

[−am

en

]−r2mn

)2

<αmn,

([01×D (ei−ej)

T]Z

[0D×1

ei−ej

]−r2ij

)2

<αij ,

∀(m,n) ∈ Ea, ∀(i, j) ∈ Ex and i < j,

Z(1:D) = ID×D, Z 0,(9)

where ei denotes a vector in RN with a unit entry in the ith

coordinate and zero entries elsewhere. And Z(1:D) denotes theD-by-D principal submatrix at the upper left corner of Z.

SDP has several advantages compared with non-convexlocalization methods [11, 12]. Firstly, because SDP is con-vex optimization, local minimum must also be the globalminimum. Therefore, we can get a global minimum withoutemploying a computationally expensive global search method.Secondly, SDP works well when the target is out of the convexhull formed by the anchors [6].

IV. PROPOSED ALGORITHM

A. Residual Normalization

The method in (9) is not a good approximation to maximumlikelihood (ML) estimator given the distance measurementmodel in (4) and (5) is assumed. The likelihood function is

p(r, r|x) ∝ exp

⎧⎪⎨⎪⎩−

1

σ2

⎛⎜⎝ ∑

(m,n)∈Ea

η2mn +∑

(i,j)∈Ex,

and i<j

η2ij

⎞⎟⎠⎫⎪⎬⎪⎭ . (10)

Thus the ML estimator is

minimizex

∑(m,n)∈Ea

η2mn +∑

(i,j)∈Ex,

and i<j

η2ij . (11)

Nonetheless, the residuals in (9) are of the form r2mn −‖am − xn‖2. They are approximately Gaussian distributedwhen ηmn � ‖am − xn‖, but with different variances.

This issue can be tackled by residual normalization. Let εmn

be the normalized residual of the measurement between am

and xn.

εmn =r2mn − ‖am − xn‖2

2rmn

=η2mn + 2ηmn‖am − xn‖

2rmn

=2ηmn(ηmn + ‖am−xn‖)−η2mn

2(ηmn + ‖am−xn‖)= ηmn−

η2mn

2rmn

.

(12)And similar results can be easily derived for target-targetresiduals εij .

Note that when ‖am − xn‖ � |ηmn|, εmn ≈ ηmn ∼N (0, σ2). This proposition is supported by the simulationresults in Fig. 1.

Remark 1 All the three curves in Fig. 1 are roughly linearfrom probability of 0.01 to 0.95. That means the normalizedresiduals are approximately Gaussian distributed over a prob-ability of 94% when the measurement error standard deviationσ � 5, and even higher probability with smaller errors.

Given this observation, we can approximate the ML esti-mator of targets’ locations by

minimizex

∑(m,n)∈Ea

ε2mn +∑

(i,j)∈Ex,

and i<j

ε2ij . (13)

B. Cooperative Attack-Resistant SDP (CARSDP)

In [3], it is shown that cooperation can improve the ac-curacy and coverage of the localization system. In hostileenvironment, it is also beneficial to integrate localizationbelief from distant anchors that were not available in non-cooperative situations. As in ARMMSE, local algorithms,e.g. gradient descent, Newton’s method etc., are more likelyto be trapped at local minima. On the other hand, globaloptimization algorithms such as simulated annealing, particleswarm and genetic algorithm, are computationally heavy andstill have no assurance of global optimal solution [13]. In otherwords, the solution may be far away from the true location oftargets even if all the location references are genuine and the

−10 −8 −6 −4 −2 0 2 4 6 8

0.001

0.003

0.010.02

0.05

0.10

0.25

0.50

0.75

0.90

0.95

0.980.99

Data

Pro

babi

lity

Normal Probability Plot

Standard Normal

σ = 1

σ = 3

σ = 5

Fig. 1: Graphical distribution comparison (Q-Q plot) betweenstandard Gaussian samples and normalized residuals collectedin a 30 by 30 area with 8 anchors and 10 targets under differentnoise levels. The horizontal axis denotes the values of datapoints. The vertical axis shows the corresponding cumulativeprobability function values which are scaled properly such thatthe plot will be linear if the two data sets come from the samedistribution.

measurement errors are small. Using the solution LinearizedLeast Squares (LLS), which is adopted for location estimationin [14], as initial point for local search is a good work-around for this problem, but, unfortunately, it is not availablein the cooperative case, and this gives rise to the motivationto develop our proposed algorithm.

Therefore, to take advantage of cooperation effectively, wewill need to resort to SDP, since it guarantees global optimalityand can be solved efficiently using interior point method [11].

Additionally, it also achieves higher accuracy in the out-of-convex-hull scenarios [6].

Apply similar semi-definite relaxation for (13), we have

minimizeα,α,Z

∑(m,n)∈Ea

αmn +∑

(i,j)∈Ex

αij

subject to

⎛⎜⎜⎝[−aT

m eTn

]Z

[−am

en

]

rmn

−rmn

⎞⎟⎟⎠

2

<αmn,

⎛⎜⎜⎝[01×D (ei−ej)T

]Z

[0D×1

ei−ej

]

rij−rij

⎞⎟⎟⎠

2

<αij ,

∀(m,n) ∈ Ea, ∀(i, j) ∈ Ex and i < j,

Z(1:D) = ID×D, Z 0.(14)

Now we substitute the “Locate” procedure in Algorithm 1with CARSDP, discard the location information received fromthe malicious anchors and treat them as targets. Thereafter, byemploying cooperation, we are able to not only identify the

0 0.5 1 1.5 2 2.5 3 3.5 40

1

2

3

4

5

6

7

8

9

10

σ

MS

EM = 8, N = 10, No malicious anchors

Not normalizedNormalized

Fig. 2: Influence of residual normalization on the MSE of SDPlocalization algorithm with different noise standard deviationσ. Anchors are all honest.

malicious anchors but also estimate their true location. This isespecially important for the systems in which anchors are alsomobile. With the location of compromised anchors, retrievingthem and identifying the attackers become possible.

V. SIMULATIONS

The deployment for the simulations in this section is de-scribed as follows. 8 anchors are pre-settled at designated posi-tions. Targets are randomly placed subject to some constraints(inside or outside the convex hull formed by the anchors)at the beginning of each run of the algorithm. We run thesimulation 1000 times with each set of parameters, i.e. anchordeployment and noise strength. Mean square error (MSE) isused as performance metric. The MSE of a set of locationestimates x = {x(1), x(2), · · · , x(Nrun)}, in which x

(i) is thematrix of N targets’ location estimates in the ith run, is definedas

MSE(x) =1

N ·Nrun

Nrun∑i=1

tr{(x− x(i))T (x− x

(i))}, (15)

where tr(·) represent the trace operation for matrices.

A. Effectiveness of Residual Normalization

At high SNR, residual normalization will improve the local-ization accuracy of SDP based methods significantly as shownin Fig. 2. Within the typical range of standard deviation ofdistance measurement errors [3, 15, 16], residual normalizationis beneficial for SDP localization methods, for it improves theaccuracy while does not increase the computational complex-ity.

B. Improvement by Semi-Definite Relaxation

As mentioned in Sec. IV-B, when cooperative measurementsare introduced into the optimization problem, the possibilitythat local search algorithms converge to local minimizers

7 8 9 10 11 12 13 14 15 16 17 18 19 2010

11

12

13

14

15

16

17

18

19

20

Anchors’ True Location

Anchors’ Claimed Location

Fig. 3: Anchor deployment for the LS vs. SDP comparisons.

(instead of a global one) is considerably higher. In Fig. 4, wecompare the performance of SDP localization algorithms andLS local search algorithms (with and without cooperation).The result substantiates this proposition. This simulation isconducted with the anchors deployed as in Fig. 3.

Remark 2 Fig. 4 shows that LS local search methods performpoorly, because they converge to local minima at times. In thisfigure, the MSE curves for LS methods are not as smoothas those for SDP methods, and the boxes’ height and thewhiskers’ length of plots for LS based methods are muchlarger than those for SDP based methods, even when the noiseis weak. And the performance variation of cooperative LSmethod are much worse than the non-cooperative one, whereasthe variation of SDP methods are almost the same for bothcooperative and non-cooperative methods.

Presented in Fig. 5 is the comparison between ARMMSEand CARSDP.

Remark 3 When the targets are outside the convex hullformed by the anchors, our proposed CARSDP algorithmperforms much better than the ARMMSE algorithm. For thein-convex-hull situations, the MSE of the two algorithms aresimilar, CARSDP is slightly better than ARMMSE, mainlybecause that LS local search algorithms performs OK whenall the targets are in the convex hull.

C. Improvement in Robustness through Cooperation

In this subsection, we compare the performance of non-cooperative SDP and cooperative SDP with the deploymentof anchors and location of targets shown in Fig. 6. The rangesof communications are set to: Ra = 6 and Rx = 4.

Fig. 7 gives the performance comparison. The results areinteresting as discussed in the following.

0.5 1 1.5 2 2.5 3 3.5 40

100

200

300

σ

MS

E

Non−Cooperative LS

0.5 1 1.5 2 2.5 3 3.5 40

200

400

σ

MS

E

Cooperative LS

(a) LS local search algorithms

0.5 1 1.5 2 2.5 3 3.5 40

50

100

σ

MS

E

Non−Cooperative SDP

0.5 1 1.5 2 2.5 3 3.5 40

50

100

σ

MS

E

Cooperative SDP

(b) SDP based algorithms

Fig. 4: Box plot of the MSE of the location estimates withdifferent noise standard deviation σ. All anchors are honest.The upper plot shows the MSE of solutions of (12) obtained bylocal algorithm and the bottom one shows MSE of estimatesobtained from SDP algorithm (14). On each box, the centralmark is the median, the edges of the box are the 25th and75th percentiles, the whiskers extend to the most extreme datapoints. The curves in each subplot show the correspondingaverage values.

0.2 0.4 0.6 0.8 1 1.20

1

2

3

4

5

6

7

σ

MS

E

CARSDP OutsideARMMSE OutsideCARSDP InsideARMMSE inside

Fig. 5: The performance comparison between ARMMSEand out proposed CARSDP under in-convex-hull and out-of-convex-hull situations with anchor deployment in Fig. 3.

0 5 10 15 20 25 300

5

10

15

20

25

30

Fig. 6: Anchors’ deployment for the non-cooperative vs.cooperative simulation. Blue square markers are the anchors’true locations. Red cross markers show their claimed locations.Red dotted lines represents the correspondence. The targets’true location are at the green diamond markers. Blue solid linesand green dashed lines shows anchor-target and target-targetcommunications respectively (for a single target).

Remark 4 With the deployment in Fig. 6, it is impossiblefor any of the target to identify the malicious anchors andcorrectly locate themselves without cooperation. Note that onlytwo honest anchors can communicate with any of the 4 targets,therefore the targets are not able to correctly locate themselves on their own. But with cooperation, they can exchangeinformation to get a clue of other anchors indirectly, and makea joint estimation such that the malicious anchors can beidentified and all the targets can acquire their true locationwith reasonable accuracy.

0.2 0.4 0.6 0.8 1 1.20

10

20

30

40

50

60

70

Non−Cooperative ARSDPCARSDP

Fig. 7: Performance comparison between cooperative and non-cooperative attack resistant SDP algorithms. σ is the standarddeviation of measurement errors.

Remark 5 In a practical view, malicious anchors may bedominant locally, no matter they are colluding or non-colluding, and that makes the standalone detection difficult.However, it is unrealistic for the attackers to overwhelm thehonest anchors from a global perspective. In this case, ourproposed algorithm cannot be defeated. Therefore, CARSDPcan handle many attack situations that are difficult, or evenimpossible, for the original ARMMSE.

VI. CONCLUSIONS

In this paper, an SDP based cooperative secured localizationmethod was proposed. Our method improves the existingones in the following three main aspects. First, cooperation isintroduced so that the algorithm can survive more difficult sce-narios with relaxed requirement on the density of the anchors.Secondly, semi-definite relaxation is adopted, which makes thealgorithm more reliable by ensuring global optimal estimates.Last but not least, we proposed residual normalization, whichimproves existing SDP localization algorithms by making itan ML estimator approximately.

REFERENCES

[1] M. Win, A. Conti, S. Mazuelas, Y. Shen, W. Gifford,D. Dardari, and M. Chiani, “Network localization andnavigation via cooperation,” IEEE Communications Mag-azine, vol. 49, no. 5, pp. 56–62, May 2011.

[2] K. Yang, L. Jiang, and Z.-Q. Luo, “Efficient semidefiniterelaxation for robust geolocation of unknown emitter bya satellite cluster using tdoa and fdoa measurements,”in Proc. of Intl. Conf. on Acoustics, Speech, and SignalProcessing, Prague, Czech Republic, May 22–27, 2011,pp. 2584–2587.

[3] H. Wymeersch, J. Lien, and M. Win, “Cooperative local-ization in wireless networks,” Proceedings of the IEEE,vol. 97, no. 2, pp. 427–450, February 2009.

[4] K. Yang, G. Wang, and Z.-Q. Luo, “Efficient convexrelaxation methods for robust target localization by asensor network using time differences of arrivals,” IEEETrans. on Signal Processing, vol. 57, no. 7, pp. 2775–2784, July 2009.

[5] P. Biswas, T. Liang, K. Toh, Y. Ye, and T. Wang,“Semidefinite programming approaches for sensor net-work localization with noisy distance measurements,”IEEE Trans. on Automation Science and Engineering,vol. 3, no. 4, pp. 360–371, October 2006.

[6] N. Wang and L. Yang, “A semidefinite programming ap-proach for cooperative localization,” in Proc. of AsilomarConf. on Signals, Systems, and Computers, Pacific Grove,CA, November 7–10, 2010, pp. 487–491.

[7] D. Liu, P. Ning, and W. K. Du, “Attack-resistant locationestimation in sensor networks,” in Proc. of Intl. Sympo-sium on Information Processing in Sensor Networks, LosAngeles, CA, 2005.

[8] Y. Zeng, J. Cao, J. Hong, and L. Xie, “Secure localizationand location verification inwireless sensor networks,” inProc. of Intl. Conf. on Mobile Adhoc and Sensor Systems,Hangzhou, China, October 12–15, 2009, pp. 864–869.

[9] S. Capkun and J. Hubaux, “Secure positioning in wirelessnetworks,” IEEE Journal on Selected Areas in Commu-nications, vol. 24, no. 2, pp. 221–232, February 2006.

[10] P. Rousseeuw, A. Leroy, and J. Wiley, Robust regressionand outlier detection. Wiley-Interscience, 1987, vol. 3.

[11] S. Boyd and L. Vandenberghe, Convex optimization.Cambridge University Press, 2004.

[12] Z. Wang, S. Zheng, Y. Ye, and S. Boyd, “Further relax-ations of the semidefinite programming approach to sen-sor network localization,” SIAM Journal on Optimization,vol. 19, no. 2, pp. 655–673, 2008.

[13] E. Chong and S. Zak, An Introduction to Optimization,ser. Wiley-Interscience Series in Discrete Mathematicsand Optimization. Wiley-Interscience, 2008.

[14] A. Sayed, A. Tarighat, and N. Khajehnouri, “Network-based wireless location: challenges faced in developingtechniques for accurate wireless location information,”IEEE Signal Processing Magazine, vol. 22, no. 4, pp.24–40, July 2005.

[15] D. Dardari, A. Conti, U. Ferner, A. Giorgetti, andM. Win, “Ranging with ultrawide bandwidth signalsin multipath environments,” Proceedings of the IEEE,vol. 97, no. 2, pp. 404–426, February 2009.

[16] X. Li and K. Pahlavan, “Super-resolution TOA estimationwith diversity for indoor geolocation,” IEEE Trans. onWireless Communications, vol. 3, no. 1, pp. 224–234,January 2004.