Research Article Hierarchical Node Replication Attacks ...downloads.hindawi.com/journals/ijdsn/2013/745069.pdf · is a hierarchical distributed algorithm for detecting node replication

Hindawi Publishing CorporationInternational Journal of Distributed Sensor NetworksVolume 2013 Article ID 745069 12 pageshttpdxdoiorg1011552013745069

Research ArticleHierarchical Node Replication Attacks Detection inWireless Sensor Networks

Wassim Znaidi Marine Minier and Steacutephane Ubeacuteda

Universite de Lyon INRIA-INSA-Lyon CITI 69621 Villeurbanne France

Correspondence should be addressed to Marine Minier marineminierinsa-lyonfr

Received 6 September 2012 Revised 13 February 2013 Accepted 28 February 2013

Academic Editor Dan Kim

Copyright copy 2013 Wassim Znaidi et alThis is an open access article distributed under the Creative Commons Attribution Licensewhich permits unrestricted use distribution and reproduction in any medium provided the original work is properly cited

Wireless sensor networks (WSNs) are composed of numerous low-cost low-power sensor nodes communicating at short distancethrough wireless links Sensors are densely deployed to collect and transmit data of the physical world to one or few destinationscalled the sinks Because of open deployment in hostile environment and the use of low-cost materials powerful adversaries couldcapture them to extract sensitive information (encryption keys identities addresses etc) When nodes may be compromisedldquobeyond cryptographyrdquo algorithmic solutions must be envisaged to complement the cryptographic solutions This paper addressesthe problem of nodes replication that is an adversary captures one or several nodes and inserts duplicated nodes at any locationin the network If no specific detection mechanisms are established the attacker could lead many insidious attacks In this workwe first introduce a new hierarchical distributed algorithm for detecting node replication attacks using a Bloom filter mechanismand a cluster head selection (see also Znaidi et al (2009)) We present a theoretical discussion on the bounds of our algorithm Wealso perform extensive simulations of our algorithm for random topologies and we compare those results with other proposals ofthe literature Finally we show the effectiveness of our algorithm and its energy efficiency

1 Introduction

WSNs are composed of a large number of low-cost low-power and multifunctional sensor nodes communicatingat short distances through wireless links They are self-con-figuring self-maintaining and usually deployed in an openand uncontrolled environment that requires secure commu-nication and routing and where attackers may be presentMoreover most of the WSNs use low-cost commodity hard-ware components that are not tamper resistant Due to costconsiderations using shielding to detect changes is imprac-ticable Thus an adversary could access a sensorrsquos internalstate An adversary can easily capture a single node replicateit indefinitely and insert duplicated nodes at any location inthe network Node replication attacks occur when a singleidentity is used by multiple nodes simultaneously in thenetwork If no specific detection mechanism is set up theattacker could lead many insidious attacks such as subvertingdata aggregation protocols by injecting false data revokinglegitimate nodes and disconnecting the network if thereplicated nodes are judiciously placed at chosen locations

In this work we focus on this particularly dangerousattack the node replication attack described in [1] Thereplication attack consists in adding one or more nodes withnodes identities that are already deployed in the networkThis can be done by first capturing nodes in the WSN anddeploying duplicated after However we suppose here as donein [1] that the adversary cannot deploy malicious nodes withnew identities that is the attacker cannot construct newidentities If this attack is not detected many other attackssuch as Wormhole [2] or Sybil [3] can be launched in thenetwork Whereas in a Sybil attack a single Sybil node usesmany identities at the same time in a node replication attackseveral nodes have the same ID in the network In thispaper we detail the algorithm already proposed in [4] whichis a hierarchical distributed algorithm for detecting nodereplication attacks using a Bloom filter mechanism [5] Ouralgorithm could be used by a WSN as soon as the network isbuilt upon a cluster head selection mechanism generating athree tiers hierarchy Without loss of generality in this paperthe local negotiated clustering algorithm (LNCA) protocol[6] is used as the cluster head election mechanism but other

2 International Journal of Distributed Sensor Networks

Figure 1 Nodes replication An attacker compromises a legitimatenode and inserts some copies of this node into the network

cluster head election mechanisms could be used making theapproach generic Our algorithm works as follows each clus-ter head exchanges the member nodes IDs through a Bloomfilter with the other cluster heads to detect eventual nodereplications Thus our proposal is decentralized based on ahierarchical localized approach and no additional hardwareartifact is required We demonstrate the capabilities of ouralgorithm with several extensive simulations

Section 2 describes the node replication attack and pre-sents the related work that develops countermeasures againstthis attack In Section 3 we give the definition of a Bloom fil-ter we introduce the network model the underlying methodfor cluster head election and the adversary model We alsopresent the different assumptions we make In Section 4 wedetail our replication detection algorithm and the networkreplies when a replication is detected Section 5 discussesthe parameters choices and gives theoretical bounds for ouralgorithm Section 6 provides simulation and comparisonresults whereas Section 7 concludes this paper

2 Related Work

As illustrated in Figure 1 the replication attack consists ofintroducing new malicious nodes with existing identities inthe network

Intuitively the most straightforward approach to solvenode replication attacks is the use of a centralized scheme inwhich each node joining the network should broadcast asigned message (referred to as location claim) to its neigh-bors At least one of its neighbors forwards this location claimto the base station If the base station receives more than onelocation claims with the same identity but different locationsthen the base station detects node replication attacks Itbroadcasts a message to the whole network to revoke thereplicated nodeThe centralized scheme achieves 100detec-tion of node replication attacks However the centralizedscheme has some disadvantages in terms of communicationand memory costs

Distributed protocols are much promising due to thedistributive nature of sensors networks In [7] the authors

propose a very specific solution where the node replicationattacks are detected using the probabilistic key sharingscheme described in [8] instead of detecting replicatednodes this method detects replicated keysThe seminal workon distributed methods for node replications detection hasbeen proposed by Parno et al in [1] where two protocols aredescribed randomized multicast and line-selected multicastBoth of them operate similarly the location claims of eachnode are broadcasted to witnesses which record all thereceived claims If a witness receives duplicated claims hefloods the network with an authenticated revocation request

In the randomizedmulticast solution each node120572 broad-casts its location claim to its 119889 neighbors Using a geograph-ical routing protocol each neighbor forwards the locationclaim of 120572 with probability 119901 to 119892 nodes randomly selected(119892 and 119901 are protocol parameters) So collectively all thenodes chosen by all the neighbors of 120572 constitute the set ofwitnesses of node 120572 So if we fix 119901 sdot 119889 sdot 119892 ≃ radic119899 (where 119899 is thenetwork cardinality) each node will have O(radic119899) witnessesand according to the birthday paradox two replicated nodeswill have at least one common witness with high probabilityIn this way if a witness receives a pair of noncoherent locationclaims it will flood the network with an alert message Themain drawback of this protocol is the high communicationcost considering that sending a message to a node costsO(radic119899) messages and that O(radic119899) witnesses are contacted foreach node the general cost for the whole network is O(1198992)messages

To tackle the communication cost problem the line-selectedmulticast algorithmwas proposed in the same paperIn this algorithm the set of witnesses is also composed ofall the intermediate nodes that route the messages from theneighbors of 120572 to the other witnesses The algorithm thusconsiders the lines created between the witnesses (hence thealgorithm name) And so with a little number of lines pernode (eg five lines) replicated nodes can be detected witha probability of 95 In summary when a node 120572 announcesits location claim each of the 119889-neighbors forwards claimsof 120572 with probability 119901 to a chosen random node Along theline between the neighbor node and the random node eachintermediate node stores the 120572rsquos claim and verifies if it hasa duplicated location claim If yes it initiates a revocationrequest in the network else it forwards the 120572rsquos claim tothe next witness node From a global point of view nodereplicationmay be detected by the witness on the intersectionof two lines originated from different network positions byreplicated nodes The total communication cost is O(119899radic119899)messages and the memory requirement per node is O(radic119899)claims

From this original proposal some other schemes havebeen proposed [9ndash11] The first one named SET is basedon computing set operations (intersection and union) ofexclusive subsets in a WSN seen as a set of nonoverlappingsubregions to detect replicated nodes As each node ID isunique the intersection of subsetsmust be empty if not thereare some replicated nodes in the network In [10] Conti et alproposed the RED protocol where the base station broadcastsa one-time seed (changed at each verification) to the wholenetwork The location of the witness nodes of a node is

International Journal of Distributed Sensor Networks 3

determined from the node ID and the seed Then the otheroperations are similar to the Parno schemes In [11] Zhu et alproposed two schemes named single deterministic cell (SDC)and parallel multiple probabilistic Cells (P-MPCs) based ongeographical limited regions

Some other solutions have been proposed Among themost recent ones we could cite [12] where the basic idea isto integrate a constant countervalue into a HELLO messagebroadcasted by each sensor node after its deployment Thecounter is maintained by the node to keep track When tworeceived counter values are not equal it means that two nodeswith the same ID are present in the network However thismethod works only with synchronized clocks In [13] theauthors propose a solution for node replications detectionwhen the nodes are mobile Finally in parallel to our ownstudy [14] also proposes a solution based on a Bloom filter

In this paper we propose a novel node replication detec-tion mechanism based on a hierarchical network structureto limit the communication overhead and with a detectionprobability equal to 100 for a pair of replicated nodes

3 Background and Network andAdversary Models

In this section we first introduce what a Bloom filter is anddescribe our network and our adversarymodelThen we givesome details on the LNCA protocol

31TheBloomFilter ABloomfilter is a simple space-efficientprobabilistic and random data structure usually used formembership tests [5]Themain advantage of the Bloom filteris its compression capability Using a Bloom filter a set 119860 =

1198861 1198862 119886

119899 of elements 119886

119894and of size 119899 is represented by

an array 119879 of 119898 bits all initially set to 0 A Bloom filter uses119896 different hash functions ℎ

1 ℎ2 ℎ

119896outputting119898 bits and

maps each output to a one at the corresponding position ofthe 119879 array To add an element 119886

119894isin 119860 we set to 1 all the

position bits ℎ119895(119886119894) for 119895 isin [1 119896] One bit of 119879 can be

set to 1 multiple times To query if an element 119909 is in the set119860 we check that every hash value ℎ

119895(119909) is set to 1 If one of

the bits at these positions is 0 119909 is not in 119860 Elements can beadded to one set but not removed (remove elements can bedone using counting filter) False positives (ie an element119909 is declared in 119860 even though it is not) are possible butfalse negatives are not The probability 119901 of false positivesis 119901 = (1 minus (1 minus 1119898)

119896119899)119896asymp (1 minus 119890

minus119896119899119898)119896 which is very

small for well-chosen parameters Note also that in order toimprove thememory space requirements of a Bloomfilter the119896 hash functions could be replaced by a single one iterativelyapplied 119896 times to find each filter input We choose this lastsolution due to its limited storage cost Figure 2 illustrates theinsertion of elements in a Bloom filter

32 Network Model We consider here a wireless networkwhere nodes are fixedAccording to the required applicationstwo main kinds of architecture could be considered the flatarchitecture and the hierarchical one In the first case nospecific mechanism is required for the network deployment

ℎ(middot)

ℎ2(middot)

ℎ3(middot)

ℎ119896(middot)

119898 bits

Input

Bloom filter

1198941198890

1198941198891

119894119889119889

0

0

0

0

0

1

1

1

1

Figure 2 Bloom filter computations

which is very simple In the second one network organizationand self-configuration mechanisms are needed to providenetwork management and to finally reduce the energy con-sumption (by reducing the number of transmitted packets)

In our proposal we focus on large-scale wireless sensornetworks based on a three tiers hierarchical architecture asdescribed in Figure 3 low-power sensor nodes 119878 low-powercluster head nodes CH elected by the other nodes and asingle access point which we call the sink or the base stationBS In our approach all the nodes (except the base station)are exactly the same they are supposed to have a uniquepredistributed ID and the cluster heads are elected usingfor example the LNCA protocol [6] Usually a three tiershierarchical architecture works as follows Sensor nodes sendtheir data only to their respective cluster head CH Theneach cluster head aggregates and forwards those data to thebase station Cluster heads communicate each other throughdedicated paths and create a kind of tree with the base stationas a rootWe assume that the network is composed of 119899 sensornodes and 119905 cluster heads Each cluster has one cluster headand many sensor nodes

33 Adversary Model In this work we assume that theadversaryrsquos goal is to replicate nodes (ie to create clones)into the network in order to deceive nodes and to apply anyother types of known attacks We assume that an attackercan capture sensor nodes and construct replicated deviceswith same credentials The attacker can either compromisea sensor node or a cluster head node We will present inSection 43 how we can detect the two cases This attack isdifferent from the Sybil attack which consists of that a singleSybil node broadcasts many identities during the networklife Our security goal is to detect replicated nodes that existinto the network This detection is performed by the clusterhead nodes using a Bloom filter mechanism and based onthe hierarchical architecture of the WSN We also focus on


Base station

Cluster head node

Sensor node

Figure 3 Hierarchical sensor network architecture

minimizing the overhead communication compared to theother solutions presented in Section 2

34 LNCA In this work we have chosen the LNCA protocol[6] as a good candidate for the clusteringmechanismwithoutloss of generality However many other clustering protocolscould be used as LEACH [15] or others Our node replicationdetection approach is relatively independent from the under-lying clustering mechanism We will detail here in Sections45 and 5 the conditions for the underlying clusteringprotocol The only hypothesis we require is a hierarchicaltopology LNCA has been chosen because of its simplicityto manage the size and the number of clusters and its reallysimple implementation The role of a clustering protocolconsists in organizing the network around two tasks

(1) select a set of cluster heads CH among the nodesdeployed in the network

(2) class the rest of the nodes in the different clustersEach nodemust choose a unique cluster head to relateto him

Following those principles LNCA is able to create hierar-chical topologies using clusters of radius119908-hop Each node isat most distant from 119908-hop of the cluster head

The LNCA mechanism works as follows

(1) Data exchange and degree computation each nodesends to its neighbors a physical value sensed in itsenvironment In the LNCA protocol two nodes aredeclared direct neighbors by the protocol if they sharethe same physical value sensed and exchanged Oncedone a node computes its degree that is the totalnumber of its direct neighbors

(2) Degrees diffusion each node sends its local degree toits 119908-hop neighbors This is done using a TTL (timeto live) At the beginning each node sends its degree

and the TTL value initialized to 119908 Each node thatreceives the message first certifies the TTL value Ifthe TTL is greater than 0 it stores the source node andits corresponding degree in its neighbors table Thenthe node decrements the TTL by 1 and retransmits themessage to its neighbors Else if the TTL is negativethe message is ignored and dropped Thus messagescould be easily sent to 119908-hop nodes

(3) Cluster heads election each node compares its localdegree with the degrees received from its 119908-hopneighbors If it possesses the greatest value it self-elects as cluster head (in case of equality the valuesof the residual energy in the nodes are used) Thenthe elected node broadcasts a message announcingits election to its 119908-hop neighbors using the sametechnique as before Thus each node that hears anannouncement from a valid cluster head returns ajoinmessage to be related to this cluster head

(4) Clusters formation each cluster head that receives ajoin message adds the identity of the correspondingnode in its member list If a cluster head does notreceive any join message it becomes a normal nodeand is related to the cluster head of its neighbors

At the end of the LNCA protocol we obtain a 119908-hop radius clustering network structure In our simulationswe have varied the values of 119908 to ensure all the possibletopologies scenariosThe parameter119908 influences the numberand the size of the clusters created in the network We decideto periodically execute the election rule eventually replacingthe highest degree by the second highest degree for energyefficiency point of view

We also need to add a particular hypothesis in order tomake our protocol work To prevent a cluster head from lyingon the members of its cluster we need to add a last step toLNCAwhere the cluster head and all themembers exchangedthemembers list of their own cluster (using the joinmessagesa neighbor intersection algorithm and eventually a votingsystem) This step is executed locally inside each cluster andis directly included in most clustering mechanisms such as inLNCA

35 Secure Communications As done in [1] and in manyother node replication detection proposals we assume thatthere are security mechanisms in the network we considerWe therefore consider that there exist secure cryptographicschemes to cipher data safely generate signatures and thatthere exist methods to build keys (see [16] eg) Methodsusing symmetric cryptography or asymmetric cryptographycan be used (as done in [10 17 18]) even if asymmetric cryp-tography remains more costly in terms of energy Similarlywe do not describe here the underlying routing mechanismused for communication between the nodes we just assumethat such a mechanism exists Note that those choices do notaffect our results and that our proposition is independent ofthe security mechanism of the used clustering protocol andof the routing protocol


Table 1 Notations

Notation SignificanceCH119897

Cluster head of cluster 119897119889119888119897

The number of nodes in cluster CH119897

119889119894

The degree of node 119894119878119897

Set of nodes of cluster CH119897

ID119894

Identity of node 119894BF119897

The Bloom filter related to CH119897

119864119896(119898) Encrypted message of119898 using key 119896

ℎ() A one-way hash functionSig119896(119898) The signature of the message119898 using key 119896

(a MAC (message authentication code) ora signature according the cryptography used)

119896119890119894

Encryption key of node 119894119896119904119894

Signature key of node 119894119886 || 119887 119886 concatenated to 119887

4 Our Proposal

Based on a three-tier hierarchical networkmodel we proposea node replication attack detection algorithm for large-scalewireless sensor networks Our approach is based on the use ofa Bloom filter which is computed by cluster head nodes Thenotations used in this paper are listed in Table 1

Our algorithmwill be divided in three stepsThe first onepredistributes in each sensor node all the material requiredfor the Bloom filter computations and for cryptographicoperations that will be performed in the networkThe secondstep consists in the cluster head election (we do not detail thisstep the reader could refer to [6] for more details) The laststep consists in the Bloom filter construction performed byeach cluster head and the Bloom filter verification performedby the other cluster headsThe routing method used betweenthe cluster heads is out of the scope of this paper

41 Predistribution Phase During the predistribution phasethe base station generates the required cryptographic materi-als a hash function ℎ() and a unique ID and pushes them inthe memory of each node

42 Election Phase The cluster heads election is performedhere using the LNCA protocol (note that other protocols(especiallymore energy efficient) could easily replace LNCA)This election could be periodically restarted (each periodtime 119905) The detection phase could not be applied at each 119905period (due to its cost) but for example at each 2119905 period tolimit the communication overhead

43 Detection Phase In our protocol replicated nodes detec-tion is performed by the cluster heads The main idea is thateach cluster head computes a dynamic Bloom filter thatcontains the node identities of its cluster set Here the termdynamic means that clusters have different densities so clus-ter heads construct the Bloom filter with different sizes (thesize 119898 of the bloom filter depends on the size of the cluster

Base stationCluster head nodeSensor node

CH119894

CH119897

BF119897BF998400 119897

CH119894 checks if any of its cluster nodes is in BF119897and if so a double check with CH119897 is requested

Figure 4 Illustration of our algorithm

in such a way that we minimize the probability of false posi-tives)

In the following even if all the cluster heads perform allthe next steps we focus on two particular cluster heads CH

119897

that computes and sends its Bloomfilter andCH119894that receives

and verifies it We illustrate our algorithm in Figure 4 Asdescribed later step (5) is required to detect if a cluster headhas been replicated The detection phase works as follows

(1) The cluster head CH119897builds the list of all node IDs

of its cluster 119878119897= cupID119895isinCH119897ID119895 including itself If CH119897

detects two nodes with the same IDs it sends an alertmessage into the network and the other cluster headsperform step 5

(2) It computes the Bloom filter BF119897for the set 119878

119897accord-

ing to the hash function ℎ()(3) It sends to CH

119894the message 119872

119897 119872119897

= (119864119896119890119894

(BF119897)Sig119896119904119894

(BF119897)) where 119896

119890119894and 119896

119904119894are respectively

the encryption key and the signature key of CH119894

(4) CH119894that receives119872

119897verifies Sig

119896119904119894

(BF119897) and deciphers

119864119896119890119894(BF119897) to recover BF

119897

(5) CH119894asks a particular node ID

119903(one or more) in 119878

119897

(different from CH119897) to build again the Bloom filter

of the cluster 119897 ID119903securely sends back to CH

119894this

new Bloom filter BF1015840119897 CH119894checks if BF1015840

119897= BF119897 If yes

the Bloomfilter is accepted and the verification begins(see step (6)) If not an alert is sent to the other clusterheads that will perform themselves verifications con-cerning the cluster 119897 To find ID

119903 either CH

119894already

knows an acceptable node ID119903or it performs a search

on BF119897testing random selected IDs until one belongs

to BF119897

(6) With its own IDs list 119878119894= cupID1015840

119895isinCH119894ID

1015840

119895 the cluster

head CH119894checks if each IDID1015840

119895belongs to BF

119897or not

If yes it sends the encrypted ID ID1015840119895to the cluster head

CH119897for a true verification If CH

119897answers yes the last


step of our protocol is activated and a node replicationis detected If not CH

119897stores ID

119903= ID1015840119895

(7) When a node replication is detected and verified inthe network CH

119897and CH

119894(because the same steps

have been performed for BF119894) start together a revoca-

tion protocol concerning the node ID1015840119895

44 Network Replies When Node Replications Are DetectedTwo different responses are expected in the network duringthe steps (5) and (7) The first response (step (5)) concerns aBloom filter problem the cluster head CH

119894and a given node

ID119903of the cluster do not compute the same Bloom filter BF

119894

This can occur for two main reasons CH119894lies or ID

119903lies In

all the cases there is a problem in this particular cluster fromthe CH

119897point of view In this case CH

119897alerts the other cluster

heads that will detect a problem or not in the same clusterThe probability that the other clusters use the same IDID

119903is

smallThus if other problems occurwith the same cluster anddifferent IDs a voting majority method could be applied todestitute CH

119894in a first time to elect a new cluster head and

to test the validity of the new Bloom filterIn the case where (step (7)) a replicated node ID

119894is

detected by both CH119894and CH

119897 a sample flooding message

is sent to all the cluster heads that relay this information to alltheir members and the sink and all the nodes with identityID119894are blacklisted in each cluster

45 Security Analysis of Our Protocol First of all due to theuse of encryption and signature provided by cryptographicalgorithms the Bloomfilters exchanged between nodes couldnot be compromised by an attacker

Now let us analyze how our algorithm could efficientlydetect one or many replicated nodes If a single simple nodeis replicated in order to act into the network it needs to beincluded in a cluster If the two nodes with the same identitybelong to the same cluster then the protocol will detect thisreplication at step 1 by an honest cluster head and at step5 by a dishonest cluster head but an honest simple nodeAs this step 5 is repeated by the different cluster heads anddifferent simple nodes the nondetection probability is reallyreally low Thus our protocol is able to detect two replicatednodes in a cluster head even if the cluster head itself isdishonest or replicated Two nodes that belong to differentclusters will also be detected with a really high probabilityeven if the corresponding cluster heads are dishonest orreplicated thanks to step 5 In the same way with the samehigh probability a cluster head and a single node that belongor not to the same cluster will be detected

As previously mentioned our protocol works correctlyif each member of a cluster has the same vision of thecluster than the cluster head This is why in Section 34we add the hypothesis that each cluster member knows allthe members of its cluster Thus under this hypothesis tworeplicated nodes whatever there are cluster heads or not willbe detected essentially because of step 5

If a complete cluster is replicated the protocol under itspresent form will not be able to detect it because there isno comparison at each cluster head level between all the

Table 2 Notations

Definition NotationAverage degree of each node 119889

Size of an ID in bits |id|Number of nodes 119899

Number of cluster heads 119905

Average number of members dc119894

Size of the Bloom filter in bits 119898

Number of hash applications 119896 7Corresponding probability 119901 asymp 2

receivedBloomfiltersThis step could be easily added becauseit only requires local computation on each cluster head and aglobal voting decision of all the cluster heads as proposed inSection 44

In summary our protocol shares the detection of repli-cated nodes into twomain steps a local detectionmechanismat step 1 and a global aggregated detection step at step 5 andstep 7

5 Theoretical Discussion andParameters Evaluations

In this section we describe the complexity bounds whencomparing our proposal and the Parno algorithms describedin [1] We also compute all the parameters required for ourapproach given a concrete example

51 Theoretical Discussion We will now theoretically com-pare our solution with and without a Bloom filter to theline-selected multicast (LSM) algorithm proposed in [1] anddescribed in Section 2We choose the LSMalgorithmbecausethis is one of the best existing proposalsWe sumup in Table 2the different notations So for a network of size 119899 and aspreviously explained the total communication cost of theLSM algorithm is O(119899radic119899) messages of size |ID| bits and thememory requirement per node is O(radic119899) claims (of size |ID|bits)

The general complexity of our algorithmmainly dependson the number of cluster heads 119905 Each cluster head sends2(119905minus1)messagesThus the total communication cost isO(1199052)messages of size 119898 bits and the total memory requirementsper cluster head is O(119905) messages of size 119898 bits because eachcluster head stores the old value of each Bloom filter and aparticular node ID for each cluster

Thus without considering the Bloom filter use (suppos-ing that each cluster head sends the concatenation of itsmember IDs) our algorithm is more efficient than the LSMalgorithm in terms of communications (ie number of bitsexchanged) when

119899radic119899 times |ID| ge 1199052 times 119899

119905

|ID| (1)

where 119889 = 119899119905 is the average number of cluster membersThis gives that our algorithm is more efficient than the LSMalgorithm when 119905 le radic119899


Considering the Bloom filter use that compresses infor-mation the evaluation in terms of communications becomes

119899radic119899 times |ID| ge 1199052 timesminus (119899119905) ln119901(ln 2)2

(2)

because the optimal value of the size 119898 in bits of a Bloomfilter given119873 the number of inserted elements and a desiredfalse positive probability 119901 (and assuming the optimal valueof 119896 is used) is

119898 = minus

119873 ln119901(ln 2)2

(3)

This leads that our algorithm is more efficient than the LSMalgorithm when 119905 le radic119899|ID|(ln 2)2 minus ln119901

But in this last case each cluster head CH119894must perform

supplementary operations (step (5)) to find a particularidentity that belongs to the received Bloom filter CH

119897 The

average number of hash computations performed by CH119894to

find ID119903is 119896 sdot (119899119889119888

119897) So the moremembers of the cluster are

the less CH119894will have to make computations More precisely

the Bloom filter use allows to decrease the communicationcost by compressing information but that defers some com-putations on the node itself Moreover and if the step (6)(ie the Bloom filter verification) is omitted the probabilityof false positive of our algorithm (ie the probability that anode that is not replicated is detected as a replicated node) is1199012 because the two Bloom filters are symmetrically verified

(step (7)) to detect one replicated nodeIn summary our algorithm ismore efficient than the LSM

algorithmwhen 119905 le radic119899 (or around this value if a Bloom filteris used)This fact is always true if the underlying cluster headelection mechanism builds big clusters (this is the case withLNCA and 119908 = 2) This fact stays most of the time truefor dense networks or for large networks whatever theunderlying cluster head electionmechanism is Furthermorelarger the clusters are less the calculations related to Bloomfilter are numerous

Moreover in this subsection we have not taken intoaccount the communication cost required for the clusterhead election because we assume that our algorithm onlyworks with networks that are already self-organized throughclusters

52 A Concrete Example So let us now give a completeexample for the different parameters given a network of 119899 =1000 nodes with an average degree equal to 119889 = 10 whichrepresent a large network with a small density In this casethe number of cluster heads using the LNCA protocol with119908 = 2 becomes 119905 = 119899119889

119908= 10 and the average number of

members is 119889119888119894= 100 whereas the size of the Bloom filter is

119898 = 800 bits with 119896 = 7 and 119901 = 2Using those parameters the communication cost of the

LSM algorithm will be about 31600 identity messageswhereas our own algorithm using a Bloom filter requires thesent 200 Bloom filters which is about the sent 16000 singleidentities considering identities of 10 bits

In step (5) the average number of hash computationsperformed by CH

119894to find ID

119903is 119896 sdot (119899119889119888

119897) With the previous

parameters the number of hash evaluations is equal to 70The performance of SHA-1 on a Pentium D is equal to10 cyclesbyte (see httpbenchcryptoresults-hashhtml formore details)The computation effort (considering that on an8-bit microcontroller SHA-1 goes four times slowly) is about60000 CPU cycles to find a correct ID Compared to the timerequired by public key cryptography for small architecturesas described in [19] the deduced time stays reasonable if weconsider a microcontroller cadenced at 8MHz as done in[19] Moreover particular lightweight hash functions couldbe considered here such as universal hash functions (see [20]for more details) Furthermore note that those computationswill be performed essentially during the first use of theprotocol because the set of identities stored in the first roundswill help the nodes to find IDs belonging to clusters in thenext steps

Note also that in the example given above the networkis large but has not a high degree for higher degrees (ie119889 ge 20) a better choice for 119908 will be 119908 = 1 whereas theparameters choices follow the same rules than the previousones

6 Simulation Results

We run a set of simulations using theWSNet simulator [21] tocompare the performances of our proposal with the Parno etal protocols described in Section 2 The tests are performedover random topologies and concerned the detection ratesthe communication overheads and the energy gains betweenour proposal and the Parno et al protocols

Note also that the tests are performed without thecryptographic layer for all schemes Finally note that in allthe simulations presented here the cost of the clusteringmechanism is not taken into account Our protocol could beseen as a particular feature that could be implemented at lowcost when a clustering mechanism is used in the network

For our proposition we have simulated different scenar-ios we have varied the number and the size of the clustersto study its influence on network performances we have alsovaried the number of replicated nodes between 1 and 17

61 Simulation Parameters We implement our node replica-tion detection algorithm with 119908 = 1 2 and 3 For the Bloomfilter we choose the optimum parameter 119896 = 7 calls to thehash function which is the universal hash function proposedby Krawczyk in [22] and known as cryptographic CRC toreduce the computational hash cost As already explainedand to maintain a false positive probability 119901 around 2the Bloom filter size is computed dynamically by each clusterhead according to the number of its members Moreover thenumber of nodes involved in step (5) of Section 43 is equal 3

For the Parno et al protocols (RM and LSM) we set 119901 =

015 and 119892 such as 119901 lowast 119889 lowast 119892 ≃ radic119899 for randomized multicastalgorithm and we have used 6 lines for the line-selectedprotocol

The tests are performed using the IEEE 80211 phys-ical and MAC layers which are fully simulated in theWSNet environment Each simulation is run with 119899 nodes


(a) (b)

Figure 5 Neighborhood with different radio range modeling (a)perfect unit disk and (b) Links with pathloss and shadowing

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te

Number of nodes

Our algorithmLine-selected multicastRandomized multicast

Figure 6 Detection probability average probability of a single nodereplication detection for the three considered algorithms

119899 isin [200 600] distributed randomly over a square field of400 times 400m2 verifying a degree 119889 between 15 and 45 witha real model of propagation fully simulated in WSNet Thesimulations are averaged over 100 trials for each protocol

To model interference WSNet replaces the SNR by asignal to interference plus noise ratio SINR which can bederived according to

120574119894119895= ℎ119894119895sdot

119875119894

119873119895+ sum119896 = 119894119895

ℎ119896119895sdot 119875119896

(4)

where ℎ119894119895is the path loss and 119875

119894and119873

119895are the transmission

power and the noise level respectively It should be notedthat this assumption leads to a neighborhood instability andcoverage areas which are deformed as illustrated in Figure 5

We have computed the average detection probability ofa single node replication as defined in [1] It represents thenumber of times the protocol must run to detect the attackWe have also compared the communication cost of each ofthe three protocols and the energy gain consumption Notealso that in the three figures of Section 62 (Figures 6 7 and8) our algorithm is implemented with 119908 = 2

0

200

400

600

800

1000

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode

Figure 7 Communication overhead average number of packetssent and received per node for the three algorithms

0

1

2

3

4

5

200 300 400 500 600

Ener

gy g

ain

for o

ur al

gorit

hm

Number of nodes

Energy gain over line-selected multicastEnergy gain over randomized multicast

Figure 8 Energy gain energy consumption gain of our protocolcompared with the Parno et al protocols

62 Results for One Replicated Node Figure 6 presents thedetection probability of a single node replication (ie a singleidentity present at two places in the network)This probabilityreaches 100 in our case whereas it is equal to 75 forthe Parno protocols (this probability is the one described inthe Parno et al paper [1]) The probability is equal to 1 inour case because our approach is mostly deterministic andnot probabilistic any replicated node who belongs to a filterwill be detected by any other cluster head excluding falsepositives of the Bloom filter (step (6)) The only case wherethe detection will not reach 100 is when a node and itscluster head are replicated they thus lie on the correspondingBloom filter and all the other cluster heads verify the samereplicated node This case is really improbable Moreover


0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te

1-hop2-hopLine-selected multicast

Number of nodes 2 nodes replicated

(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)

Figure 9 Real propagation model replicated node detection probability (a) for 2 replicated nodes (b) for 7 replicated nodes

the really low false positives rate (of 2 when consideringthat step (6) is omitted ie the detected identities are notverified) will be reduced to 04 in the symmetric step (7)Thus our algorithm is really efficient when considering thenode replication detection probability better than the twoalgorithms proposed in [1]

Figure 7 presents the average number of packets sent andreceived per node for the three algorithms Clearly the RMalgorithm generates many traffic and is less efficient thanthe LSM algorithm Moreover our algorithm generates lesstraffic than the two other protocols because our protocolrequires only communication between cluster heads andwith witness nodes randomly chosen for the Bloom filterverifications Note also that the number of nodes of step(5) is equal to 3 So decreasing this number implies evenless communication traffic Another way to decrease thecommunication overhead induced by our protocol is tointroduce cluster heads cooperation where each cluster headonly verifies a subset of all the clusters So simulations showthat our proposal needs fewer packets to better detect areplication attack even if the size of the packets generated byour approach is bigger

In order to take into account the different packet sizesFigure 8 shows the energy consumption gain between ourprotocol and the Parno ones To do so we have computed theenergy ratio using the following equation 119864Parno119864ourprotocol where 119864Parno is the energy consumption of one of the Parnoalgorithms and where 119864ourprotocol is the energy consumed byour own protocolThismetric takes into account each bit sentand received by each node This gain is between 12 and 45according to the number of nodes considered meaning thatour protocol is at least 12 energy efficient than the Parno onesThis is really interesting because in wireless sensor networksenergy preservation is critical Those improvements directlycome from the better communication overhead shown inFigure 7 and confirm the theoretical discussion presented in

Section 5 So our protocol ismuchmore energy efficient thanthe Parno protocols which is very important in a WSN

So all the results confirm that our hierarchical replicationdetection mechanism is more efficient than the Parno et alones in terms of communication overhead and of energyconsumption with a detection probability equal to 100 ofdetections most of the time

63 Results for Several Replicated Nodes Figures 9 and 10compare the detection probability of replicated nodes whenmany replicated nodes are introduced in the network for ourown protocol with 119908 = 1 and 119908 = 2 and the LSM algorithmproposed by Parno et al in [1] In those figures we keepthe same simulation parameters as defined in Section 61 Allthe replicated nodes are randomly placed in the network atthe beginning of the simulations The three approaches arethen executed during a single period We could note herethat our proposal for the two cases 119908 = 1 and 119908 = 2

offers better detection rates (greater than 90 in most ofcases) This probability decreases for our approach when thenumber of replicated nodes increases and does nomore reacha detection rate equal to 100This fact is directly linked withthe step (5) of our algorithmwhere the verification step of theBloomfilter fails if malicious nodes are chosenTherefore therest of our algorithm is interrupted to go to a vote betweenclusterheads on the filters validityThe same casemay happenfor other clusterheads and in this case all the replicatednodes may not be detected The LSM protocol presents adetection probability varying between 60 and 80 whichis in adequacy with the theoretical study made in the originalpaper [1]

Figure 11 shows the influence of communication overheadof our approach for 119908 = 1 119908 = 2 and 119908 = 3 comparedwith the LSM protocol The value 119908 = 1 induces themaximal number of cluster heads in the network whereas thenumber of members is minimized Of course with 119908 = 1


0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)


0

50

100

150

200

200 300 400 500 600Number of nodes

Line selected multicast

Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode

1-hop2-hop

3-hop

Figure 11 Communication overhead in a real propagation modelthis figure presents the influence of clusters size on the averagenumber of packets sent and received for each node

the communication overhead is more important than for119908 = 2 or 119908 = 3 but stays lower than the one of the LSMprotocol This is due to the fact that the number of clusterheads stays reasonable because the densities of the chosennetworks are sufficiently high but realistic (note than in thecase of smaller degrees the solutions with 119908 = 2 and 119908 = 3

must be privileged) The values 119908 = 2 and 119908 = 3 allow tovary the number of cluster heads and the size of the clustersAs discussed in Section 5 the communication overheaddecreases when the number of cluster heads decreases tooThis is directly linked with the overall complexity of ourprotocol which is fully determined by the number of cluster

heads whereas the Bloom filter sizes logarithmically dependon the number of members in each cluster Thus decreasingthe number of cluster heads reduces the number of exchangedmessages whereas the size of each message containing aBloom filter only logarithmically increases As done beforethree witness nodes are chosen for validating the Bloom filterat step (5) We have also performed some other tests withgreater values of 119908 but implementing the LNCA protocolas explained in the original paper (see [6] for more details)leads to having a minimal number of cluster heads equalto 9 (this depends on the LNCA implementation and onsimulation parameters essentially the size and the diameterof the network) because the network is cut in 9 parts Thuswe obtain the same results for 119908 gt 3 and 119908 = 3

In summary our approach staysmore efficient in terms ofcommunication overhead than the LSMprotocol proposed in[1] with better detection rates even if many replicated nodesare present in the network However Figure 11 does not takeinto account the packet sizes which are smaller for the LSMapproach As shown in Section 51 and in our simulations ourapproach stays more energy efficient than the LSM protocolfor well chosen parameters (119908 = 2 seems to be relevant inall cases with a better detection rate in all cases) The choiceof 119908 is crucial in our case and mainly depends on the sizeand on the density of the network as shown in Section 51the choice of 119908 for the LNCA protocol is conditioned by theequation 119905 le radic119899

64 Other Simulation Results We have also simulated thecase where a complete cluster is duplicated and inserted in thenetwork (as already mentioned in Section 45) In this casethis attack could not be detected by our approach as describedhere because each member of the cluster and the cluster headagree on the same Bloom filter value and the invalidity ofthe Bloom filter could not be detected A solution to detectthis particular kind of attack could be to add a test for each


cluster head that test the consistency between the differentBloom filter it receives it tests the correlation between eachpair of the Bloom filters and when this correlation is near 1 itsends an alert message to the other cluster heads As done instep (5) a voting process could thus be launched between thedifferent cluster heads to decide whether a complete cluster isreplicated or not

We have also simulated the case where the cluster headsare duplicated nodes In this case the duplicated cluster headis detected with a probability of about 98 in all cases bystep (5) of our algorithm In this last study we have notstudied the case wheremore than twomalicious cluster headscooperate to dissuade the other legitimate cluster heads aboutthe validity of their filters A solution to detect this kind ofattacks consists in the periodical use of a secure clusteringmechanism In this case malicious cluster heads introducedat period 119879 will be detected at the next period 119879 + 1

A last case could emerge in the network if other clusteringmechanism rather than LNCA is used in the network a singlecluster is presented in the network with a single cluster headIn this case the cluster head is going to play the role of acentral entity that will be responsible for the node replicationdetection If the cluster head is itself an attacker we couldimagine that the base station itself verifies the Bloom filterbuilt by the unique cluster head by asking somenodes to buildagain the Bloom filter

65 Conclusion In conclusion our algorithm stays alwaysmore efficient than the ones of Parno et al proposed in [1]in terms of detection probability but the energy efficiencymainly depends on the number of cluster heads So ourprotocol could be easily implemented jointly with a clusteringmechanism that verifies that the number of cluster heads 119905present in the network is such that 119905 le radic119899 where the Bloomfilters are not used and such that 119905 le radic119899|ID|(ln 2)2 minus ln119901when Bloom filters are used

So the use of our protocol could be easily consideredwith 1-hop clustering protocols when the network is dense(eg FISCO [23] CDS [24] MIS [25] or RNG [26]) and isrecommended with 119896-hop (119896 gt 1) clustering mechanisms(eg LNCA [6] LEACH[27] or 119896-Max-Min [28])Moreoverwhen considering the clustering cost which is in most casesin O(119899) our proposal stays competitive with the Parno onesand has always a better detection rate

7 Conclusion

In this paper we have proposed a simple practical andhierarchical algorithm to detect node replications in WSNsbased on the optional use of Bloom filters The simulationresults show that our proposal is really efficient with areally high detection probability of replicated nodes (100 ofdetection in most cases) This mechanism could be directlyimplemented when a 119896-hop hierarchical protocol is alreadydeployed in a WSN for a really low complexity add Ourgeneral aim is to provide particular security mechanismslinked with the implemented routing methods to limit thegeneral size of code and the general network overheadrequired by security mechanisms

In furtherworks wemainly focus on twomain directionson the one hand studying the influence of the underlyingclustering mechanism to optimize the energy consumptionof our protocol and on the other hand establishing a securemechanism for cluster heads election to be able to trustcluster heads This last remark would thus reduce energyconsumption by failing to verify the validity of Bloom filterthrough witnesses and thus achieving the same results interms of detection

References

[1] B Parno A Perrig and V Gligor ldquoDistributed detection ofnode replication attacks in sensor networksrdquo in Proceedings ofthe 2005 IEEE Symposium on Security and Privacy (SampP rsquo05) pp49ndash63 Oakland Calif USA May 2005

[2] W Znaidi M Minier and J P Babau ldquoDetecting wormholeattacks in wireless networks using local neighborhood informa-tionrdquo in Proceedings of the IEEE 19th International Symposiumon Personal Indoor andMobile Radio Communications (PIMRCrsquo08) pp 1ndash5 IEEE Cannes France September 2008

[3] J Newsome E Shi D Song and A Perrig ldquoThe Sybil attack insensor networks analysis amp defensesrdquo in Proceedings of the 3rdInternational Symposium on Information Processing in SensorNetworks (IPSN rsquo04) K Ramchandran J Sztipanovits J CHouand T N Pappas Eds pp 259ndash268 Berkeley Calif USA April2004

[4] W ZnaidiMMinier and S Ubeda ldquoHierarchical node replica-tion attacks detection in wireless sensors networksrdquo in Proceed-ings of the IEEE 20th Personal Indoor and Mobile Radio Com-munications Symposium (PIMRC rsquo09) Tokyo Japan September2009

[5] M Mitzenmacher ldquoCompressed bloom filtersrdquo in Proceedingsof the 20th Annual ACM Symposium on Principles of DistributedComputing (PODC rsquo01) pp 144ndash150 ACMNewYorkNYUSA2001

[6] D Xia and N Vlajic ldquoNear-optimal node clustering in wirelesssensor networks for environment monitoringrdquo in Proceedingsof the 21st International Conference on Advanced InformationNetworking and Applications (AINA rsquo07) pp 632ndash641 IEEEComputer Society Washington DC USA May 2007

[7] R Brooks P Y Govindaraju M Pirretti N Vijaykrishnanand M T Kandemir ldquoOn the detection of clones in sensornetworks using randomkey predistributionrdquo IEEE Transactionson Systems Man and Cybernetics Part C vol 37 no 6 pp 1246ndash1258 2007

[8] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security (CCSrsquo02) V Atluri Ed pp 41ndash47 ACM Washingtion DC USANovember 2002

[9] H Choi S Zhu and T F L Porta ldquoSET detecting node clonesin sensor networksrdquo in Proceedings of the 3rd InternationalConference on Security and Privacy in Communication Networks(SecureComm rsquo07) pp 341ndash350 September 2007

[10] M Conti R Di Pietro L V Mancini and A Mei ldquoA random-ized efficient and distributed protocol for the detection of nodereplication attacks in wireless sensor networksrdquo in Proceedingsof the 8th ACM International Symposium on Mobile Ad HocNetworking and Computing (MobiHoc rsquo07) E Kranakis E MBelding and E Modiano Eds pp 80ndash89 ACM MontrealCanada September 2007


[11] B Zhu V G K Addada S Setia S Jajodia and S Roy ldquoEfficientdistributed detection of node replication attacks in sensornetworksrdquo in Proceedings of the 23rd Annual Computer SecurityApplications Conference (ACSAC rsquo07) pp 257ndash266 IEEE Com-puter Society Miami Beach Fla USA December 2007

[12] T T Dai and J I Agbinya ldquoEarly and lightweight distributeddetection of node replication attack in sensor networksrdquo in Pro-ceedings of the IEEE Wireless Communications and NetworkingConference (WCNC rsquo10) pp 1ndash6 IEEE Sydney Australia April2010

[13] C-M Yu C-S Lu and S-Y Kuo ldquoEfficient and distributeddetection of node replication attacks in mobile sensor net-worksrdquo in Proceedings of the IEEE 70th Vehicular TechnologyConference Fall (VTC rsquo09) IEEE Anchorage Alaska USA2009

[14] M Zhang V Khanapure S Chen and X Xiao ldquoMemory effi-cient protocols for detecting node replication attacks in wirelesssensor networksrdquo in Proceedings of the 17th IEEE InternationalConference on Network Protocols (ICNP rsquo09) pp 284ndash293 IEEEComputer Society Princeton NJ USA October 2009

[15] W R Heinzelman A Chandrakasan and H BalakrishnanldquoEnergy-efficient communication protocol for wireless micro-sensor networksrdquo in Proceedings of the 33rd Annual HawaiiInternational Conference on System Siences (HICSS rsquo00) p 223January 2000

[16] Y Cheng and D P Agrawal ldquoAn improved key distributionmechanism for large-scale hierarchical wireless sensor net-worksrdquo Ad Hoc Networks vol 5 no 1 pp 35ndash48 2007

[17] C Castelluccia ldquoSecuring very dynamic groups and data aggre-gation in wireless sensor networksrdquo in Proceedings of the IEEEInternatonal Conference on Mobile Adhoc and Sensor Systems(MASS rsquo07) pp 1ndash9 Pisa Italy October 2007

[18] S C Seo D G Han H C Kim and S Hong ldquoTinyECCK effi-cient elliptic curve cryptography implementation over GF(2119898)on 8-bit micaz moterdquo IEICE Transactions on Information andSystems vol 91 no 5 pp 1338ndash1347 2008

[19] H Wang and Q Li ldquoEfficient implementation of public keycryptosystems on mote sensors (short paper)rdquo in Proceedingsof the 8th International Conference on Information and Commu-nications Security (ICICS rsquo06) P Ning S Qing and N Li Edsvol 4307 of Lecture Notes in Computer Science pp 4519ndash7528Springer Raleigh NC USA December 2006

[20] D E KnuthTheArt of Computer Programming vol 3 of Sortingand Searching Addison-Wesley 1973

[21] E BHamidaGChelius and JMGorce ldquoScalable versus accu-rate physical layer modeling in wireless network simulationsrdquoin Proceedings of the 22nd Workshop on Principles of AdvancedandDistributed Simulation (PADS rsquo08) pp 127ndash134 Rome ItalyJune 2008

[22] H Krawczyk ldquoLfsr-based hashing and authenticationrdquo in Pro-ceedings of the 14th Annual International Cryptology Conference(CRYPTO rsquo94) Y Desmedt Ed vol 839 of Lecture Notes inComputer Science pp 21129ndash25139 Springer Santa BarbaraCalif USA August 1994

[23] J Fan J Chen J Lu Y Zhang and Y Sun ldquoThe implementationof a fully integrated scheme of self-configuration and self-organization (fisco) on imote2rdquo in Proceedings of the 3rd Inter-national Conference Mobile Ad-Hoc and Sensor Networks (MSNrsquo07) H Zhang S Olariu J Cao and D B Johnson Edsvol 4864 of Lecture Notes in Computer Science pp 672ndash682Springer Beijing China December 2007

[24] J Wu and H Li ldquoOn calculating connected dominating set forefficient routing in Ad Hoc wireless networksrdquo in Proceedings

of the 3rd International Workshop on Discrete Algorithms andMethods for Mobile Computing and Communications (DIAL-Mrsquo99) pp 7ndash14 Seattle Wash USA August 1999

[25] P J Wan K M Alzoubi and O Frieder ldquoDistributed construc-tion of connected dominating set in wireless AdHoc networksrdquoMobile Networks and Applications vol 9 no 2 pp 141ndash1492004

[26] J Cartigny F Ingelrest D Simplot-Ryl and I StojmenovicldquoLocalized LMST and RNG based minimum-energy broadcastprotocols in Ad Hoc networksrdquo Ad Hoc Networks vol 3 no 1pp 1ndash16 2005

[27] W R Heinzelman A Chandrakasan and H BalakrishnanldquoEnergyefficient communication protocol for wireless micro-sensor networksrdquo in Proceedings of the 33rd Hawaii Interna-tional Conference on System Sciences (HICSS rsquo00) vol 8 p 8020IEEE Computer Society Washington DC USA January 2000

[28] A D Amis R Prakash T H P Vuong and D T HuynhldquoMax-min d-cluster formation in wireless Ad Hoc networksrdquoin Proceedings of the 19th Annual Joint Conference of the IEEEComputer andCommunications Societies (IEEE INFOCOM rsquo00)vol 1 pp 32ndash41 Tel Aviv Israel 2000

International Journal of

AerospaceEngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

RoboticsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014


Active and Passive Electronic Components

Control Scienceand Engineering

Journal of



RotatingMachinery


Hindawi Publishing Corporation httpwwwhindawicom

Journal ofEngineeringVolume 2014

Submit your manuscripts athttpwwwhindawicom

VLSI Design



Shock and Vibration


Civil EngineeringAdvances in

Acoustics and VibrationAdvances in



Electrical and Computer Engineering

Journal of

Advances inOptoElectronics


Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

SensorsJournal of


Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014


Chemical EngineeringInternational Journal of Antennas and

Propagation




Navigation and Observation



DistributedSensor Networks



Figure 1 Nodes replication An attacker compromises a legitimatenode and inserts some copies of this node into the network

cluster head election mechanisms could be used making theapproach generic Our algorithm works as follows each clus-ter head exchanges the member nodes IDs through a Bloomfilter with the other cluster heads to detect eventual nodereplications Thus our proposal is decentralized based on ahierarchical localized approach and no additional hardwareartifact is required We demonstrate the capabilities of ouralgorithm with several extensive simulations

Section 2 describes the node replication attack and pre-sents the related work that develops countermeasures againstthis attack In Section 3 we give the definition of a Bloom fil-ter we introduce the network model the underlying methodfor cluster head election and the adversary model We alsopresent the different assumptions we make In Section 4 wedetail our replication detection algorithm and the networkreplies when a replication is detected Section 5 discussesthe parameters choices and gives theoretical bounds for ouralgorithm Section 6 provides simulation and comparisonresults whereas Section 7 concludes this paper

2 Related Work

As illustrated in Figure 1 the replication attack consists ofintroducing new malicious nodes with existing identities inthe network

Intuitively the most straightforward approach to solvenode replication attacks is the use of a centralized scheme inwhich each node joining the network should broadcast asigned message (referred to as location claim) to its neigh-bors At least one of its neighbors forwards this location claimto the base station If the base station receives more than onelocation claims with the same identity but different locationsthen the base station detects node replication attacks Itbroadcasts a message to the whole network to revoke thereplicated nodeThe centralized scheme achieves 100detec-tion of node replication attacks However the centralizedscheme has some disadvantages in terms of communicationand memory costs

Distributed protocols are much promising due to thedistributive nature of sensors networks In [7] the authors

propose a very specific solution where the node replicationattacks are detected using the probabilistic key sharingscheme described in [8] instead of detecting replicatednodes this method detects replicated keysThe seminal workon distributed methods for node replications detection hasbeen proposed by Parno et al in [1] where two protocols aredescribed randomized multicast and line-selected multicastBoth of them operate similarly the location claims of eachnode are broadcasted to witnesses which record all thereceived claims If a witness receives duplicated claims hefloods the network with an authenticated revocation request

In the randomizedmulticast solution each node120572 broad-casts its location claim to its 119889 neighbors Using a geograph-ical routing protocol each neighbor forwards the locationclaim of 120572 with probability 119901 to 119892 nodes randomly selected(119892 and 119901 are protocol parameters) So collectively all thenodes chosen by all the neighbors of 120572 constitute the set ofwitnesses of node 120572 So if we fix 119901 sdot 119889 sdot 119892 ≃ radic119899 (where 119899 is thenetwork cardinality) each node will have O(radic119899) witnessesand according to the birthday paradox two replicated nodeswill have at least one common witness with high probabilityIn this way if a witness receives a pair of noncoherent locationclaims it will flood the network with an alert message Themain drawback of this protocol is the high communicationcost considering that sending a message to a node costsO(radic119899) messages and that O(radic119899) witnesses are contacted foreach node the general cost for the whole network is O(1198992)messages

To tackle the communication cost problem the line-selectedmulticast algorithmwas proposed in the same paperIn this algorithm the set of witnesses is also composed ofall the intermediate nodes that route the messages from theneighbors of 120572 to the other witnesses The algorithm thusconsiders the lines created between the witnesses (hence thealgorithm name) And so with a little number of lines pernode (eg five lines) replicated nodes can be detected witha probability of 95 In summary when a node 120572 announcesits location claim each of the 119889-neighbors forwards claimsof 120572 with probability 119901 to a chosen random node Along theline between the neighbor node and the random node eachintermediate node stores the 120572rsquos claim and verifies if it hasa duplicated location claim If yes it initiates a revocationrequest in the network else it forwards the 120572rsquos claim tothe next witness node From a global point of view nodereplicationmay be detected by the witness on the intersectionof two lines originated from different network positions byreplicated nodes The total communication cost is O(119899radic119899)messages and the memory requirement per node is O(radic119899)claims

From this original proposal some other schemes havebeen proposed [9ndash11] The first one named SET is basedon computing set operations (intersection and union) ofexclusive subsets in a WSN seen as a set of nonoverlappingsubregions to detect replicated nodes As each node ID isunique the intersection of subsetsmust be empty if not thereare some replicated nodes in the network In [10] Conti et alproposed the RED protocol where the base station broadcastsa one-time seed (changed at each verification) to the wholenetwork The location of the witness nodes of a node is








1198861 1198862 119886




1 ℎ2 ℎ






119895(119909) is set to 1 If one of


119896119899)119896asymp (1 minus 119890




ℎ(middot)

ℎ2(middot)

ℎ3(middot)

ℎ119896(middot)

119898 bits

Input

Bloom filter

1198941198890

1198941198891

119894119889119889

0

0

0

0

0

1

1

1

1






Base station

Cluster head node

Sensor node

















Table 1 Notations




119889119894



ID119894






119896119890119894



4 Our Proposal







CH119894

CH119897

BF119897BF998400 119897





119897







119897accord-



119897 119872119897

= (119864119896119890119894

(BF119897)Sig119896119904119894

(BF119897)) where 119896

119890119894and 119896




119897verifies Sig

119896119904119894


119864119896119890119894(BF119897) to recover BF

119897


119903(one or more) in 119878

119897



119894this


119897= BF119897 If yes


119903 either CH

119894already



to BF119897



1015840

119895 the cluster


119895belongs to BF

119897or not






119897stores ID

119903= ID1015840119895


119897and CH







119894


119903lies In





119903is




119894is








Table 2 Notations















119905

|ID| (1)





(2)


119898 = minus

119873 ln119901(ln 2)2

(3)




119897 The


find ID119903is 119896 sdot (119899119889119888













119894to find ID

119903is 119896 sdot (119899119889119888













(a) (b)


0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te

Number of nodes





120574119894119895= ℎ119894119895sdot

119875119894

119873119895+ sum119896 = 119894119895

ℎ119896119895sdot 119875119896

(4)


119894and119873




0

200

400

600

800

1000

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode


0

1

2

3

4

5

200 300 400 500 600

Ener

gy g

ain

for o

ur al

gorit

hm

Number of nodes





0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)











0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)


0

50

100

150

200

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode

1-hop2-hop

3-hop













7 Conclusion



References

































RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation
















1198861 1198862 119886




1 ℎ2 ℎ






119895(119909) is set to 1 If one of


119896119899)119896asymp (1 minus 119890




ℎ(middot)

ℎ2(middot)

ℎ3(middot)

ℎ119896(middot)

119898 bits

Input

Bloom filter

1198941198890

1198941198891

119894119889119889

0

0

0

0

0

1

1

1

1






Base station

Cluster head node

Sensor node

















Table 1 Notations




119889119894



ID119894






119896119890119894



4 Our Proposal







CH119894

CH119897

BF119897BF998400 119897





119897







119897accord-



119897 119872119897

= (119864119896119890119894

(BF119897)Sig119896119904119894

(BF119897)) where 119896

119890119894and 119896




119897verifies Sig

119896119904119894


119864119896119890119894(BF119897) to recover BF

119897


119903(one or more) in 119878

119897



119894this


119897= BF119897 If yes


119903 either CH

119894already



to BF119897



1015840

119895 the cluster


119895belongs to BF

119897or not






119897stores ID

119903= ID1015840119895


119897and CH







119894


119903lies In





119903is




119894is








Table 2 Notations















119905

|ID| (1)





(2)


119898 = minus

119873 ln119901(ln 2)2

(3)




119897 The


find ID119903is 119896 sdot (119899119889119888













119894to find ID

119903is 119896 sdot (119899119889119888













(a) (b)


0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te

Number of nodes





120574119894119895= ℎ119894119895sdot

119875119894

119873119895+ sum119896 = 119894119895

ℎ119896119895sdot 119875119896

(4)


119894and119873




0

200

400

600

800

1000

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode


0

1

2

3

4

5

200 300 400 500 600

Ener

gy g

ain

for o

ur al

gorit

hm

Number of nodes





0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)











0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)


0

50

100

150

200

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode

1-hop2-hop

3-hop













7 Conclusion



References

































RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation










Base station

Cluster head node

Sensor node

















Table 1 Notations




119889119894



ID119894






119896119890119894



4 Our Proposal







CH119894

CH119897

BF119897BF998400 119897





119897







119897accord-



119897 119872119897

= (119864119896119890119894

(BF119897)Sig119896119904119894

(BF119897)) where 119896

119890119894and 119896




119897verifies Sig

119896119904119894


119864119896119890119894(BF119897) to recover BF

119897


119903(one or more) in 119878

119897



119894this


119897= BF119897 If yes


119903 either CH

119894already



to BF119897



1015840

119895 the cluster


119895belongs to BF

119897or not






119897stores ID

119903= ID1015840119895


119897and CH







119894


119903lies In





119903is




119894is








Table 2 Notations















119905

|ID| (1)





(2)


119898 = minus

119873 ln119901(ln 2)2

(3)




119897 The


find ID119903is 119896 sdot (119899119889119888













119894to find ID

119903is 119896 sdot (119899119889119888













(a) (b)


0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te

Number of nodes





120574119894119895= ℎ119894119895sdot

119875119894

119873119895+ sum119896 = 119894119895

ℎ119896119895sdot 119875119896

(4)


119894and119873




0

200

400

600

800

1000

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode


0

1

2

3

4

5

200 300 400 500 600

Ener

gy g

ain

for o

ur al

gorit

hm

Number of nodes





0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)











0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)


0

50

100

150

200

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode

1-hop2-hop

3-hop













7 Conclusion



References

































RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation










Table 1 Notations




119889119894



ID119894






119896119890119894



4 Our Proposal







CH119894

CH119897

BF119897BF998400 119897





119897







119897accord-



119897 119872119897

= (119864119896119890119894

(BF119897)Sig119896119904119894

(BF119897)) where 119896

119890119894and 119896




119897verifies Sig

119896119904119894


119864119896119890119894(BF119897) to recover BF

119897


119903(one or more) in 119878

119897



119894this


119897= BF119897 If yes


119903 either CH

119894already



to BF119897



1015840

119895 the cluster


119895belongs to BF

119897or not






119897stores ID

119903= ID1015840119895


119897and CH







119894


119903lies In





119903is




119894is








Table 2 Notations















119905

|ID| (1)





(2)


119898 = minus

119873 ln119901(ln 2)2

(3)




119897 The


find ID119903is 119896 sdot (119899119889119888













119894to find ID

119903is 119896 sdot (119899119889119888













(a) (b)


0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te

Number of nodes





120574119894119895= ℎ119894119895sdot

119875119894

119873119895+ sum119896 = 119894119895

ℎ119896119895sdot 119875119896

(4)


119894and119873




0

200

400

600

800

1000

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode


0

1

2

3

4

5

200 300 400 500 600

Ener

gy g

ain

for o

ur al

gorit

hm

Number of nodes





0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)











0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)


0

50

100

150

200

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode

1-hop2-hop

3-hop













7 Conclusion



References

































RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation











119897stores ID

119903= ID1015840119895


119897and CH







119894


119903lies In





119903is




119894is








Table 2 Notations















119905

|ID| (1)





(2)


119898 = minus

119873 ln119901(ln 2)2

(3)




119897 The


find ID119903is 119896 sdot (119899119889119888













119894to find ID

119903is 119896 sdot (119899119889119888













(a) (b)


0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te

Number of nodes





120574119894119895= ℎ119894119895sdot

119875119894

119873119895+ sum119896 = 119894119895

ℎ119896119895sdot 119875119896

(4)


119894and119873




0

200

400

600

800

1000

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode


0

1

2

3

4

5

200 300 400 500 600

Ener

gy g

ain

for o

ur al

gorit

hm

Number of nodes





0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)











0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)


0

50

100

150

200

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode

1-hop2-hop

3-hop













7 Conclusion



References

































RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation












(2)


119898 = minus

119873 ln119901(ln 2)2

(3)




119897 The


find ID119903is 119896 sdot (119899119889119888













119894to find ID

119903is 119896 sdot (119899119889119888













(a) (b)


0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te

Number of nodes





120574119894119895= ℎ119894119895sdot

119875119894

119873119895+ sum119896 = 119894119895

ℎ119896119895sdot 119875119896

(4)


119894and119873




0

200

400

600

800

1000

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode


0

1

2

3

4

5

200 300 400 500 600

Ener

gy g

ain

for o

ur al

gorit

hm

Number of nodes





0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)











0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)


0

50

100

150

200

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode

1-hop2-hop

3-hop













7 Conclusion



References

































RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation










(a) (b)


0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te

Number of nodes





120574119894119895= ℎ119894119895sdot

119875119894

119873119895+ sum119896 = 119894119895

ℎ119896119895sdot 119875119896

(4)


119894and119873




0

200

400

600

800

1000

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode


0

1

2

3

4

5

200 300 400 500 600

Ener

gy g

ain

for o

ur al

gorit

hm

Number of nodes





0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)











0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)


0

50

100

150

200

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode

1-hop2-hop

3-hop













7 Conclusion



References

































RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation










0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)











0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)


0

50

100

150

200

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode

1-hop2-hop

3-hop













7 Conclusion



References

































RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation










0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(a)

0

02

04

06

08

1

200 300 400 500 600

Aver

age p

roba

bilit

y of

det

ectio

n ra

te



(b)


0

50

100

150

200

200 300 400 500 600Number of nodes


Aver

age n

umbe

r of p

acke

tse

ntan

d re

ceiv

ed p

er n

ode

1-hop2-hop

3-hop













7 Conclusion



References

































RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation















7 Conclusion



References

































RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation































RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation











RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation









Documents

Research Article Hierarchical Node Replication Attacks ...downloads.hindawi.com/journals/ijdsn/2013/745069.pdf · is a hierarchical distributed algorithm for detecting node replication