Intrusion Detection in Wireless Sensor Network1

8/20/2019 Intrusion Detection in Wireless Sensor Network1

1/16

Probabilistic model forIntrusion Detection in

Wireless Sensor Network

Homogeneous Wireless SensorNetworks.

By RANADIP DAS


2/16


• Wireless Sensor Network WSN! is a collection of s"atiallyde"loyed wireless sensors by w#ic# to monitor $arious c#angesof en$ironmental conditions e.g.% forest &re% air "ollutantconcentration% and ob'ect mo$ing! in a collaborati$e mannerwit#out relying on any underlying infrastructure su""ort.

• Sensor network "arameters suc# as sensing range% transmissionrange% and node density #a$e to be carefully considered at t#enetwork design stage% according to s"eci&c a""lications.

• Sensor nodes are "rone to energy drainage and failure and t#eirbattery source mig#t not be re"laceable% instead new sensors are

de"loyed.• Sensor node ca"able of collecting data from t#e surrounding

regions and sim"le com"utations suc# as data aggregation% datafusion% and com"utation are carried out to corres"ond wit# ot#ersensor nodes.


3/16



4/16

WSN A""lications• Environmental Monitoring - waters#ed management% forest &re

"rediction

• Structural Health and Industrial Monitoring: mac#inery failuredetection. It reduces t#e maintenance costs and "re$ents fromcatastro"#ic failures.

• Civil Structure Monitoring: large ci$il structures% like bridges orskyscra"ers.

• Medical Health-care - o$erall monitoring of ill "atients in#os"itals and at #omes

• Military applications - sensor nodes include battle&eld

sur$eillance% guidance systems of intelligent missiles% and detectionof attacks by wea"ons of mass destruction% suc# as c#emical%biological and nuclear.

• Area monitoring - In area monitoring% t#e WSN is de"loyed o$er aregion w#ere some "#enomenon is to be monitored.


5/16

Intruder Detection in Wireless Sensor et!or"

• Intrusion

any kind of unaut#ori(ed or una""ro$ed acti$ities are calledintrusions.

Intrusion Detection System IDS! An Intrusion Detection System IDS! is a collection of t#e tools%

met#ods% and resources to #el" identify% assess% and re"ort

intrusions.

Intrusion detection i.e.% ob'ect tracking! in a WSN can be regarded

as a monitoring system t#at is installed around a system or de$icefor detecting t#e intruder in t#e network domain.

)#e intruder may be detected as soon as it enters t#e $icinity of

WSNs or after tra$eling some distance wit#in t#e area of interest%since it is mainly de"ending on t#e a$ailability of t#e sensor.


6/16

#ro$a$ilistic Model %or IntruderDetection in Homogeneous WS

• In a WSN% t#ere are two ways to detect anintruder *

single+sensing detection * t#e intruder can be

successfully detected by a single sensor.multi"le+sensing detection * t#e intruder can

only be detected by multi"le collaboratingsensors.


7/16

multi"le+sensing detection &gure

Intruder

Sensornode for

intruderdetectio

n


8/16

Detection Model -

we can deri$e t#e e,"ected intrusion distance w#en

entering t#e wsn +

• Intrusion distance-

)#e intrusion distance D! is t#e distance between t#e"oints w#ere t#e intruder enters t#e WSN and t#e "oint w#eret#e intruder gets detected by any sensors!.

• Ma&imal Intrusion Distance denoted by Dm% Dm /! ist#e ma,imal distance allowable for t#e intruder to mo$ebefore it is detected by t#e WSN.

• Detection pro$a$ility- )#e detection "robability is de&nedas t#e "robability t#at an intruder is detected wit#in a certainintrusion distance e.g.% 0a,imal Intrusion Distance Dm!.

• Average intrusion distance- )#e a$erage intrusiondistance is de&ned as t#e e,"ected distance t#at t#e intrudertra$els before it is detected by t#e WSN for t#e &rst time.


9/16

IN)R1SI2N D3)34)I2N IN A H20253N321S WIR363SS S3NS2RN3)W2R7

• Single+Sensing Detection 8 In t#e single+sensing detection model% t#e intruder

can be recogni(ed once it mo$es into t#esensing co$erage disk of any sensors!.

• 4ase 9- W#en t#e intruder starts from a"oint of t#e network boundary% as s#own

in :ig gi$en an intrusion distance D8/%t#e corres"onding intrusion detection

area SD is almost an oblong area. )#isarea includes a rectangular area wit#lengt# D and widt# ;rs and a #alf disk

wit# radius rs attac#ed to it. )#e area

mo$ed by t#e intruder is *

SD 8 ;


10/16

IN)R1SI2N D3)34)I2N IN A H20253N321S WIR363SS S3NS2RN3)W2R7

Case 2: when the intruder starts from a random point in the network domain,

the corresponding intrusion detection area is –

SD = 2*D*r s+ ( r s2 ! 2 = r s

2 ! 2 "

= 2*D*r s+ r s2


11/16

• )#eorem 9. )#e "robability P9@D88/ t#at an intruder can be

immediately detected once it enters a #omogeneous WSN wit# node

density and identical sensing range rs can be gi$en P9@D88/ 8

9+ e+>rsC; ? ;!

Proof. In a uniformly distributed WSN wit# node density % t#e"robability of m sensors located wit#in t#e area S. according toPoisson distribution *

Pm% S! 8 S%!Cm ?m ! e+s

t#e "robability of no sensor in t#e immediate intrusion detection area

S/ 8 >rsC; ? ; is P/% >rsC; ? ; !! 8 e+>rsC; !? ; )#e com"lement of P/% >rsC; ? ; !! is t#e "robability t#at t#ere is at

least one sensor located in S/ 8 >rsC; ? ;

)#us% t#e "robability t#at t#e intruder can be detected immediately

by t#e WSN once it enters t#e WSN isP9@D88/ 8 9 + P/% >rsC; ? ; !! 8 9+ e+>rsC; ? ;!

)#is result s#ows t#at t#e immediate detection "robability P9@D88/

is determined by t#e node density and t#e sensing range. Byincreasing t#e node density or enlarging t#e sensing range% P 9@D88/

can be im"ro$ed.


12/16

• )#eorem ;. Su""ose is t#e ma,imal intrusion distance allowablefor a gi$en a""lication. )#e "robability P9@DE D0 t#at t#e intruder

can be detected wit#in in t#e gi$en #omogeneous WSN can bederi$ed as

P9@DE8 D0 8 9+ e+;


13/16

• 0ulti"le+sensing detection 7+Sensing Detection!.

• In t#e k+sensing detection model% an intruder #as to be sensed byat least k sensors for intrusion detection in a WSN.

• )#eorem G. let Pk @D8/ be t#e "robability t#at an intruder is

detected immediately once it enters a WSN wit# node density and identical sensing range rs in 7 * sensing detection model.

Pk@D8/ 8 9+ >rsC; ? ;i i!e+>rsC; ? ;! Proof.

• Pi%>rsC; ? ; !! is t#e "robability t#at t#ere are i sensors locatedin t#e immediate detection area S/ 8 >rsC; ? ; .

• i8/ k+9 Pi% >rsC; ? ; !! is t#e "robability t#at t#ere are less t#an

k sensors in t#e area S/.

• 9+ i8/ k+9 Pi% >rsC; ? ; re"resents t#e "robability t#at t#ere

are at least k sensors located in t#e area S/ . In t#is case% t#eintruder can be sensed by at least k sensors w#en it accesses t#enetwork boundary. 4onseFuently% it can be said t#at

• Pk@D8/ 8 9+ i8/ k+9 Pi% >rsC; ? ; !!

8 9+ i8/ k+9 >rsC; ? ;i i!e+>rsC; ? ;!

7+9

i8/


14/16

• )#eorem . let Pk @D E8 D0 be t#e "robability t#at t#e intruder is detected

wit#in t#e ma,imal intrusion distance in a k+sensing detection model fort#e gi$en #omogeneous WSN. )#en% Pk @D E8 D0 can be calculated as

Pk@D E8 D0 8 9+ SD0 !i ? i !e C + SD0 !

w#ere SD0 8 ;rs; ?

; ! Proof. SD0 8 ;rs; ? ; ! is t#e intrusion detection area wit# res"ect

to t#e ma,imal intrusion distance . If t#ere are at least k sensors in t#earea SD0% t#e intruder can be sensed by t#e k sensors.

• Pi% SD0!8 SD0 !i ? i ! e C + SD0 ! denotes t#e "robability t#at i sensors are located in t#e area of SD0.

So i8/ k+9 Pi% SD0!8 i8/ k+9 SD0 !i ? i !e C + SD0 ! is t#e "robability t#att#ere are less t#an k sensors in t#e area SD0 .

• 9+ i8/ k+9 SD0 !i ? i !e C + SD0 ! re"resents t#e com"lement of

"robability i8/k+9

Pi% SD0! t#at t#ere are at least k sensors located in t#earea SD0 % before intruder tra$el distance of SD0 .

• :inally% t#e "robability Pk@D E8 D0 t#at t#e intruder is detected wit#in t#e

ma,imal intrusion distance in k+sensing detection model can be deri$ed as

Pk@D E8 D0 8 9+ SD0 !i ? i ! e C + SD0 !

7+9

i8/


15/16

4onclusion

We #a$e de$elo"ed a "robabilistic modelfor intrusion detection and a""lied t#esame into single+sensing detection for a

;D #omogeneous WSNs. )#is model gi$esan insig#t to t#e reFuired number ofsensors in a gi$en de"loyment area% t#eirsensing and transmission range to

securely detect an intruder in WSNs.


16/16

'e%erences• Jun Wang% Kiaodong Wang% Bin Kie% Demin Wang and D#arma P

Agrawal% Intrusion Detection in Homogeneous and HeterogeneousWireless Sensor Networks% in I333 )ransactions on 0obile4om"uting% LM!% ;//% MO+L99.

• S#aila 7% Sa'it#a 0% )e'aswi % S H 0an'ula% enugo"al 7 R and 6 0Patnaik% S33DI- Secure and 3nergy 3Qcient A""roac# forDetection of an Intruder in Homogeneous Wireless Sensor

Networks% in Proceedings of the International Conference onIntelligent Network and Computing (ICINC-2010) ;/9/% ;LO+;G.

• Ismail Butun% Sal$atore D. 0orgera% and Ra$i Sankar % A Sur$ey ofIntrusion Detection Systems in Wireless Sensor Networks I33342001NI4A)I2NS S1R3JS )1)2RIA6S% A443P)3D :2R

P1B6I4A)I2N.• 7es#a$ 5oyal% Nid#i 5u"ta% 7es#awanand Sing#%A Sur$ey on

Intrusion Detection in Wireless Sensor Networks International ournal of Scienti&c Researc# 3ngineering )ec#nology ISR3)!olume ; Issue; "" 99G+9;M 0ay ;/9G

Documents

Intrusion Detection in Wireless Sensor Network1