DATA ALTERATION ATTACKS IN WIRELESS SENSOR NETWORKS: DETECTION AND ATTRIBUTION

Wireless sensor networks are an emerging field where a large number of cheap sensors are dispersed over an area in order to gather information. This paradigm of a large number of relatively low power platforms brings a number of challenges. Because the lack of physical security associated with traditional networking environments, sensor networks are much more likely to be taken over by insider attacks where the attacker gains access to all the information on the node and can perfectly emulate its behavior if they so choose. In addition the lack of computing resources means care must be taken due to the overhead introduced by additional protocols. This work elaborates on the dangers presented by insider attacks in wireless sensor networks. In particular, an adversary node that appears to be a legitimate member of the network can alter data that passes through it. This is a more dangerous attack than the traditional packet dropping models because standard networking models will not be able to tell which node altered the data. In this way, even a small number of insider’s nodes (even 1) can negate a large fraction of the network’s functionality because, even if the data alteration is detected, there is no way to determine the node responsible. The large spectrum of possible applications and behaviors for sensor networks makes it difficult come up with a single best solution. Because of that fact, this work introduces a number of different protocols to both detect malicious data alteration and attribute the malicious behavior to a specific node. It then describes what properties of a sensor network make specific solutions appealing as well as providing analysis of how the strengths and weaknesses of each interact with possible sensor network configurations