Detecting Compromised Nodes in Wireless Sensor Networks

While wireless sensor networks are proving to be a versatile tool, many of the applications in which they are utilized have sensitive data. Therefore, security is crucial in many of these applications. Once a sensor node has been compromised, the security of the network degrades quickly if measures are not taken to deal with this event. There have been many approaches researched to tackle the issue. In this thesis, an anomaly-based intrusion detection protocol is developed to detect compromised nodes in wireless sensor networks. The proposed protocol is implemented after the sensors are deployed into the environment in which they will be used. They will start to learn the normal behavior of each of their neighbors with whom they communicate. All legitimate sensor nodes have the same code running on them. A compromised node that is present in the network is assumed to have different code running on it in order to cause some form of damage to the network. These malicious nodes are detected when one of its neighboring nodes identifies its behavior as deviating from what is expected, or in other words an anomaly. The base station is then contacted to confirm whether the suspected node is in fact compromised. If the base station concludes that the node is compromised, the rest of the network will be informed, and the appropriate actions will be taken. One of the unique features of the algorithm is that it is not only capable of sustaining security in wireless sensor networks, but handling the computing restraints as well as other limitations characteristic of these systems. Extensive simulations are performed to verify the algorithm designed