Sunteți pe pagina 1din 8

32 (IJCNS) International Journal of Computer and Network Security,

Vol. 2, No. 9, September 2010

Detection of Selective Forward Attack in Mobile


Wireless Sensor Networks
S.Sharmila1, and G.Umamaheswari2
1
Research Scholor, Anna University, Coimbatore
hod@dit.psgtech.ac.in
2
Assistant Professor, Department of Electronics and Communication Engineering,
PSG College of Technology

Abstract: Mobile Wireless sensor networks are composed of 1.1 Motivation


a large number of wireless sensors and they require a careful Wireless sensor networks are vulnerable to many routing
consumption of available to prolong the life time of the network. attacks such as Selective forward attack , HELLO flood
From the security point of view, detecting schemes must be very
attack , sinkhole attack, Wormhole attack ,etc because of
light to increase the life time of the network. In this paper,
defensive mechanism is proposed to detect selective forward
broadcast nature of transmission medium, resource
attack in mobile wireless sensor networks. The proposed limitation on sensor nodes and uncontrolled environments
mechanism is simulated with Berkeley Mica 2 Motes where they are left unattended [7]. The existing security
configuration in Network Simulator Version 2. The scheme is mechanisms are inadequate and new approaches are
evaluated in terms of packet delivery ratio and throughput. The required for each routing attack since each attack has its
simulation results show that the scheme achieves high detection own nature and characteristics. The major aim of this work
rate. is to detect the selective forward attack which also meets the
security goals such as data authenticity, integrity, and
Keywords: Selective Forward attack, Dynamic Window, availability.
Mobile Wireless Sensor Networks. The major security objectives are as follows:
• To design defensive mechanisms against
1. Introduction selective forward attack considering the resource
Recent advances in wireless communications and micro constraints of mobile nodes.
electro-mechanical system (MEMS) technologies have • To identify the malicious node on forward
enabled the development of low-cost, low power and small routing path.
size wireless sensor nodes. Wireless sensor nodes perform • To provide data authenticity and data
significant signal processing, computation and network self integrity.
configuration to achieve scalable, robust and long-life • To improve the detection accuracy and data
networks. Many sensor nodes are capable of local processing availability.
to reduce communications and energy costs consequently.
Wireless sensors have been used in hazard alarms, 1.2 Our Contribution
monitoring and tracking wild life, heartbeat monitoring for Selective forwarding is one of the routing methods. The
patients, habitat monitoring, and many more applications. packet is forwarded to the destination node/base station
In Wild life applications, sensors are cast in the field as well based on routing table and network conditions. The
as equipped on animals to monitor. The self organized defensive mechanism against selective forward attack based
nodes are mobile as animals move. In telemedicine on Dynamic Window based concept is formulated. Window
applications and human tracking applications, sensors are refers the session between the complete transmission of
attached to patients and thus constitutes mobile wireless message from the source and destination node/base station.
sensor network. Certain applications such as rescue The message transmission timings of the sessions are
management, emergency care and military applications different. With the particular window malicious node is
require secure information transfer between the source and identified based on the cumulative acknowledgement packet
destination [1]. Considering an example where sensors are and drop ratio of the node which lies in the forward routing
used to sense the blood pressure and temperature of patients path. It is detected by checkpoint, source node, ordinary
and reports to the intensive care unit of the hospital. The node, and node id. Once the node is identified, it is removed
patients are monitored remotely. In this case, if any data is from the network and the packet is routed through the
hacked by malicious node lead a chaos .It is necessary to alternate path. Detection accuracy also depends upon the
detect the malicious node in the network. transmission and reception range since the nodes are
mobile. Simulation results show that the communication
In Selective forward attack malicious node selectively overhead is slightly high but the detection accuracy is 90%
drops the packet and degrades the performance of the when the drop ratio is less.
network. This paper focuses on detection mechanism against The remaining of this paper is structured as follows. In
selective forward attack based on Dynamic Source Routing Section II represents the Back ground, reviews the existing
Protocol for mobile wireless sensor networks. works, and proposes the detection scheme. Sections III
(IJCNS) International Journal of Computer and Network Security, 33
Vol. 2, No. 9, September 2010

discuss the performance evaluation. Section IV concludes is used. The limitation of the scheme is high communication
with the scope of the scheme in future. overhead and high energy consumption is high.
2.3 Assumptions
2. Background and proposed Scheme Seven assumptions are proposed in detection mechanism.
First, the Nodes are mobile and transmit the messages
This section describes the selective forward attack and during different sessions. Second, the size of the window is
reviews the existing works. constant i.e. the total time duration for transmission of
2.1 Selective Forward Attack messages per session is kept constant. Third, the Dynamic
Source Routing protocol is implemented in nodes. Fourth,
during a particular session topology is static .Fifth; the node
id is different per session. Sixth, the malicious node only
drops maximum number of packets. And finally, the
messages are authenticated using one-way hash chains.
2.4 Detection Scheme
The existing detection scheme consists of inclusion of
packets such as cumulative acknowledgement of each node,
event packet, acknowledgement packet, control packets and
alert packet. With the inclusion of packets for detections,
communication overhead will be more. The proposed
detection schemes consist of cumulative acknowledgement
packet between the check points of the forward path and the
check point generates the trap message and is sent to the
Figure 1 shows an example of selective forward attack. It next node of the forwarding path.
drops packet and refuses to forward the message to neighbor The different phases of the proposed mechanism are as
node. If the malicious nodes drop the entire message, the follows:
node is called black hole. Malicious node can forward the 1. Node id assignment phase and location
message in a wrong path and gives unfaithful routing phase
information in the network. It creates unnecessary packet 2. Topology identification
delay and it leads to confusion in forwarding the message. It 3. Forward route selection path
also creates false information and transmission in the 4. Check Point assignment
network. It is difficult to detect the malicious node when 5. Data transmission
there is collision, packet drop due to timer expiry and link 6. Malicious node detection
failure, since the nodes are mobile nodes. Selective forward 2.4.1 Node id and Location Phase
attack affects the exsisting routing protocols such as DSR, Node id is activated only when the transmission is
GPSR, GEAR and Tinos beaconing. required. Node id is configured dynamically per session by
2.2 Review the sink node/base station. Whenever the sink node/base
Selective forward attack may corrupt some mission- station needs any information it broadcasts the set of node
critical applications such as military surveillance and forest ids and activates the timer. Node id is valid until timer
fire monitoring in wireless sensor networks. BinXiao[3][4] expires. Base station stores the allotted node id temporarily
proposed a lightweight security scheme and detected the for each session temporarily.
selective forward attack using multi-hop 2.4.2 Topology identification phase
acknowledgements. It has limitations as it requires nodes to After receiving the node id, the node identifies its
be loosely time synchronized and keep one-way key chains neighbor node and stores the next hop neighbor id to dentify
for authentication. Kim[5] suggested cumulative the topology of the network.
acknowledgement based detection. The limitations, data- 2.4.3Forward route selection path
reply packets are transmitted through multiple paths. But, The source node sends the route_ request packet to the
the communication overhead will be high because of destination node/base station. It responds the route_reply
cumulative acknowledgement and there by reducing the packet with the selected forward path through which data is
node energy. Y.B.Reddy[7] proposed a new framework to transmitted. Forward path is selected based on the Dynamic
detect the selective forward attack using game theory model, source routing protocol.
the detection of a malicious node is found between the 2.4.4Check point selection phase
selective acknowledgement points irrespective of the Base station/Destination node assigns the nodes to be
dropping rate. J.Brown[8] proposed a sequential the check point in the forward path randonly. In the
probability ratio test for detecting the attacks in downstream link, check point generates a trap message after
heterogeneous sensor networks. Mathematical foundations the successful reception of the packet.
are also be helpful in detecting the attack. The major 2.4.5Data transmission phase
concept of the existing works adopted a scheme in routing Once the forward path is selected, data is transmitted
protocols and analyzed its performance in terms of from the source to the base station/destination node. Upon
communication overhead, network throughput, and energy successful reception of data, each node sends an
consumption. In this paper, the light weight scheme based acknowledgement packet to its next node which lies in the
on dynamic source routing protocol for detecting the attack forward path. The acknowledgement packet of next node
34 (IJCNS) International Journal of Computer and Network Security,
Vol. 2, No. 9, September 2010

and previous node is forwarded to next neighbor node in the


forward path. In this way ,acknowledgement packets are 1
32
31
cumulated. Once the check point receives the cumulative 2 41
35
6
acknowledgement packet, it generates the trap message and 46
36
30 47
sends to its next node in the forward path. If the destination 14
20
13 45 37
receives the trap message generated by the last check point, 17
21 38
it shows that the data has been successfully transmitted from 28
5

44
the source and the destination. 48
9
7
43
16
22 39
2.4.6Detection process 49
15
12

8
23
10 24
Step: 1 Base station issues the node id and it is dynamic 50
42
40
18
and unique for a window. 11 25
26
Step 2: Base station sends the data request to all the 33
19
nodes. 3
4
27
Step 3: Source nodes send a route request packet to the 34
B
base station. S

Step 4 : Base station sends a route reply packet to the Window-A


source station . 46 11 44
99 19
Step 5: Base station selects the node in the forward path 14
9
as check points. 45 18 77
14 27 43
Step 6. : Source node sends the data packet to the next 26
78 88
node which lies in the forward path. Upon receiving the data 13
91 66 23
the node sends the acknowledgement packet and the 44
21
5

receiving node sends its acknowledgement packet along 22 6 48


54
15
with the data packet and thus frames the cumulative 52 17
62
43
acknowledgement. 26 4
3 36
Step 7: Once the check point receives the cumulative 83
17
44
acknowledgement, it generates the trap message and it is 81 80 B
5
forwarded along with the data to the next check point. 2
S
7 8
Step 8: Upon receiving the cumulative acknowledgement 1
10 72
packet and the trap message, the base station detects the 98 54

exact malicious node in the forward path based on the Window B


negative acknowledgement. If any node holds its id after a Figure 2. Node-id Detection
predetermined time interval of the window that node is also
suspected as a malicious node and is illustrated in 2.5 Detection Analysis
Algorithm. The proposed detection mechanism has been analyzed
Step 9: Once the malicious node is detected it is removed based on following background:
from the network and the packet is forwarded through the Scenario 1: Based on node id
alternate path. If any node holds the id after the timer expires, that node
Algorithm: Determining malicious node is suspected to be a malicious node. The value of the timer
Input:
CAKP : A cumulative packet received
depends on the number of hops in the forward routing path
{Datan,ACKo,ACK1,…….ACKn} and maximum transmission delay. Packet delivery ratio,
Trap :{check point id, rds, node id of NACK} throughput are further analyzed to confirm the node to be a
n: Total # of ACKs in CAKP
m: Total # of nodes in the forwarding path
compromised node. In Fig 2. the node id’s of Window A
1. create a list of responses [] and traps[] and Window B are different except the node ids such as
of length m 45,15 and 21 and such nodes are treated as malicious nodes.
2. for i=0,….n-1 Scenario 2: Check-point detection
responses [n-1]<- ack n-i 46 11 44
99 19
remove ack n-i from CAKP 14
9
if ack n-I == n then 45 18 77
return {rds=1 } 14 27 43
88
67 78
else {rds=0} 13
91 66 23
retrun ckpid
44 51
endif 22 6 16
21
3. for i=0,……., n-1 54
15
52 17
traps [n-i] <- nids(nack) 62
43
remove and ckpid and rds from 26
3
4
36
trap[] 83
17
4. for i=0,……., n-1 44
81 80 B
5
if ckpidi [trap] != ckpidi+1 then 2
S
if (rdstrap[]==1) then 1
7 8
return ckpids 10 72
98 54
else
return the nids(nack) Figure 3. Check-point detection
end if
(IJCNS) International Journal of Computer and Network Security, 35
Vol. 2, No. 9, September 2010

The Check-points are randomly selected, if the base mobile nodes. Overlap of window causes the packet drop in
station/destination selects the malicious node as check- the network. Check point should not misjudge an ordinary
points that generate acknowledgement and trap message on node to be a compromised node. In Fig. 5 Node 4 drops the
its own and forward the packet to its neighbor node. In that cumulative acknowledgement packet and it is treated as
case, detection of malicious node may be suspected based on compromised node. Based on the Negative
the node id and packet delivery ratio. Check point id is valid acknowledgement, the compromised node is identified.
until window expires. In Fig. 3 Node 26 and 67 are source
Destina
nodes whereas BS is the base station and it is treated as Source 1 5 8
tion
destination node and forward paths are 26-54-22-6-52-36
and 67-13-44-78-21-88-17-62 respectively. Check points are
22, 16 and 21.The forward path from the source 26 to base Figure 5. Node as Compromised Node
station does not contain any malicious node. But the forward
path from 67 to the Base station contains 21 as check point Format of the Cumulative Acknowledgement packet
but it is also a malicious node. In this case, check point is a Dat Ac Ac … Ack NACK
malicious node and it is detected based on node id and a k0 k1 N
packet drop ratio. Format of the Trap message
Scenario 3: Source node detection Check point RDS Node ids of NACK
The base station broadcasts the request to nodes, and the Node id
malicious node responds to the base station with route
request packet station to gather the routing information and If NACK is set to 0, it denotes that it is a negative
misguide the route in the network. Fig. 4 shows that acknowledgement of data packet and if itis set to 1, it
malicious node 67 voluntarily responds to the base station denotes that it is a negative acknowledgement of route, if the
after receiving the route request and misguides the route. node has not seen the route packet sent by the base
The actual forward path is 67-6-16-52-3 instead of 67-13- station/destination.
44-78-21-88-17-62. The node is detected based on the Received data successfully (RDS=1) denotes that data is
packet drop ratio and based on cumulative received upto the particular check point indicated by its
acknowledgement packet. node id.Once the destination/base station identifies the
46 11 44
99
14
19 malicious nodes, the destination broadcasts the node id of
9
NACK packet .Source requests the destination to send the
45 18 77
14 27
88
43 alternate forward path.
67 78
91 66
13
23 3. Performance Evaluation
44
21
51 The proposed algorithm is implemented in ns2 [6] and
22 6 16
54 the performance is evaluated in terms of network throughput
15
52 17
62 and packet delivery ratio
43
26
3
4
36
Evaluation Metrics:
83
17 The following metrics [6][8] evaluate the effectiveness of
44
81
5
80 B the proposed detection Scheme.
S
2
7 8
Packet delivery ratio: It is the ratio of number of packets
1
10 72 received and the number of packets sent.
98 54
Throughput: This gives the fraction of channel capacity
Figure 4. Source Node Detection. used for data transmission.
Communication Overhead: It is the ratio of overheads
Scenario 4: Node can be a compromised node with and without the detection scheme.
The existing methods such as CHEMAS, CADE, Average Latency: Mean time in seconds taken by the
[2][3][4][5] detect any two nodes in the selective forward packets to reach their respective destination.
path as malicious node . In CHEMAS, authors suggest that Undetected ratio: It is the ratio of number of undetected
malicious node lies within the rang of check points. In maliciously dropped packets to the total number of
CADE, authors present the detection mechanism to identify maliciously dropped packets.
the two malicious nodes in the forward path. The proposed 3.1 Simulation parameters
mechanism detects the exact compromised nodes. Check The parameters used in our simulations are shown in
point generates a trap message and forwards it to the next Table 1. Window is static and malicious nodes are randomly
check point stating that there is no packet drop exists upto located on the forward paths of source and base station.
that check point. Between the two check points, Node ids, check points, source and destination are assigned
acknowledgements of each node are cumulated if the data before the transmission starts.
has been transmitted successfully. Once the check point
receives the cumulative acknowledgement successfully then
it generates the trap message. If any node between the
check points fail to forward the data packet, Cumulative
acknowledgment and trap message, that node is suspected to
be compromised node. Cumulative Acknowledgment packet
can also drop by collision and timer expiry since nodes are
36 (IJCNS) International Journal of Computer and Network Security,
Vol. 2, No. 9, September 2010

Table 1: Parameters used in simulations During the data transmission, malicious nodes are
Area 2000mX2000m detected, and the authors have detected that node 2 is a
Nodes 50 check point node and also malicious node and other
Packet size 512 bytes malicious nodes are 7, 14 and 41 as shown in Fig. 8.
Transmission protocol UDP
Application Traffic CBR
Transmission rate 10 Mbits/sec
Pause time 24.73 sec
Maximum speed 31sec
Simulation time 100 sec
Propagation model Radio Propagation
Maximum Malicious node 50
Type of attack Selective forward attack
Examined DSR

3.2 Performance Results


In this section, the performance of the proposed
detection mechanisum is evaluated in terms of packet
delivery ratio and network throughput. The check points,
source node and destination nodes with its id are depicted
in the Fig. 6.

Figure 8. Detection of Compromised Nodes

In the simulation, the authors used different types of field


configurations including the forward path nodes which are
moving randomly, pausing for a fixed time of 25 seconds
and moving randomly in a 2000m X 2000m area. The
simulation time is 100 seconds and results are taken after 50
simulation runs. The same trends are observed in the results.
The Constant Bit Rate (CBR) traffic is introduced while
data transmission to check the detection accuracy. It is
observed that Node 15 has dropped the packets due to CBR
traffic and the proposed mechanism does not suspect the
node to be a compromised node. The undetected ratio is 20
% which proves that detection accuracy is 80%. Further, it
is observed that though the packet drop occurs with the
Figure 6. Node Deployment Phase overlap of different windows. The proposed mechanism does
not suspect the nodes as compromised node because of
Few packet drops are occurred during the data different time interval and dynamic node id configuration. It
transmission Phase and are indicated in Fig. 7. is observed that the packet drop due to traffic exists due to
overlap of the window. During the time interval from 30
seconds to 40 seconds and from 95 seconds to 96 seconds,
the packet is dropped only due to CBR traffic window
overlap. Few nodes hold the node id after the expiry of
timer. Its packet delivery ratio is 30% where as packet
delivery of normal nodes is 100% and it has been detected
as compromised node. This is depicted in Fig. 9. It is also
shown that packet delivery rate of normal nodes are from
70% to 100% and compromised node is only 30%.
It is observed that Node2 is a check point and is detected
as compromised node. The packet delivery ratio is 80% like
normal nodes. The proposed scheme detects the check point
based on node id. The timer of that particular node holds
above the maximum time delay. The authors observed that
timer of normal node id is 40 seconds but the timer of check
point is 120 seconds for a specific window. Fig. 10 depicts
the packet delivery ratio of check point node, normal node,
and malicious node. Further, the authors observed that
malicious node in the forward path drops 270 packets /100
Figure 7. Data transmission Phase
(IJCNS) International Journal of Computer and Network Security, 37
Vol. 2, No. 9, September 2010

seconds and throughput is 47 packets /second .The average


latency is 38.26 seconds after the detection of malicious
node and 50 seconds before the detection of malicious node.

Figure 11. Packet drop ratio

Figure 9. Packet Delivery Rate of normal nodes are from


70 % to 100% and compromised node is only 30 %.

Figure 12.Throughput
The researcher observes that the number of packets sent
and throughput vary due to the presence of malicious nodes.
In Fig. 11 and Fig. 12, the malicious nodes increase the
packet drop ratio and decrease the throughput of the
network, the presence of malicious node affects the
performance of the network. A cumulative
acknowledgement is transmitted up to the check point and
thus reduces the communication overhead in the forward
path.
The packet drop rate of the normal nodes is significantly
different from that of the compromised node. The proposed
detection scheme can achieve 90% of detection rate when
drop rate is less.
The performance of the scheme is compared with the
other existing schemes and it is tabulated in Table 2. The
overall performance of the proposed scheme is better than
the existing schemes. Though the scheme consumes 60% of
node energy, it provides better accuracy than the existing
schemes.

Figure 10. Check point as compromised node


38 (IJCNS) International Journal of Computer and Network Security,
Vol. 2, No. 9, September 2010

Table 2: Comparision with the Exsiting Schemes


References
Parameters CHEM CAD SPR Game Multi- Prop
AS E T theory hop osed [1] C.Karlof and D. Wagner, “Secure Routing in Sensor
Acknowl meth
edgement od
Networks: Attacks and Countermeasures”, In the
Detection High Not Hig Channe 95% 90% Proceedings of first IEEE International Workshop on
rate analy h l rate when Sensor Network Protocols and Applications, 2003.
zed and channel [2] H. Lee, T. Cho, “Fuzzy-Based Reliable Data Delivery
droppi error rate
ng rate is 15% for Countering Selective Forwarding in Sensor
Communicati Reason Not smal Not high high Networks”, Lecture Notes in Computer Science, pp.
on overhead able analy l analyze 535-544, 2007.
zed d
Includes base No No No No No no
[3] B. Xiao, B. Yu, and C. Gao, “CHEMAS: Identify
station for Suspect Nodes in Selective Forwarding Attacks”,
detection Journal of Parallel and Distributed Computing, Vol. 67,
Time Yes Not Yes Yes Not yes Issue 11, pp. 1218-1230, 2007.
synchronizati requi required
on red [4] B. Yu and B. Xiao, “Detecting Selective Forwarding
Identifies the Yes Not yes No yes yes Attacks in Wireless Sensor Networks”, in the
original analy Proceedings of. 20th International Sympsium on
reason for zed
packet loss Parallel and Distributed Processing (IPDPS 2006),
Security No Yes No No No yes pp.1-8, 2006.
against [5] Young Ki Kim, Hwaseong Lee, Kwantae Cho, and
sinkhole
attack
Dong Hoon Lee, “CADE:Cumulative
One-way key Requir Not No No Not requi Acknowledgement Based Detection of Selective
chains ed requi required red Forwarding Attacks in Wireless Sensor Networks”, in
the Proceedings of third International Conference on
red
Convergence and Hybrid Information Technology,
Duplicate None Data- No No Data Data
2008.
packet reply packet pack [6] N Bhalaji and Dr A Shanmugam, “Reliable Routing
et against Selective Packet Drop Attack in DSR based
ACK Alway pack No No none pack MANET”, Journal of Software, Vol.4 , No.6,2009.
generation s et is et is [7] Yenumula B reddy and S .Srivathsan, “Game Theory
drop dropp
Model for Selective Forward Attacks in Wireless Sensor
Networks”, in the proceedings of 17th Mediterranean
ped ed
conference on control and automation, Greece, June
Energy Not Not Not Not Not 60% 2009.
Consumption analyze analy anal analyze analyzed [8] Jeremy brown, Xiaojiang Du, “Detection of Selective
d zed yzed d Forward Attacks in Heterogeneous Sensor Networks”,
Nodes Station Stati Stati station stationary Mobi published in the Proceedings of ICC 2008.
ary onary onar ary les [9] Zia, T.A., and Zomaya, A.Y. “Secure Localization in
Wireless Sensor Networks. In the Proceedings of fourth
y
Asian Conference on Communication Systems and
4. Conclusions Networks (AsiaCSN 2007), April 2-4, 2007.
This paper has presented a dynamic window based [10] Zia, T.A., and Zomaya, A.Y. “Malicious Node
mechanism to detect selective forward attack. In packet Detection Mechanism in Wireless Sensor Networks” ,
forwarding routing algorithms need the detection in the Proceedings of International Conference on
mechanisms to identify the exact compromised nodes. A Network Security (ICONS 2007), Jan 29-31, 2007.
number of recent works have been studied before proposing [11] Zia, T.A., and Zomaya, A.Y, “Security issues in
this new methodology The drawbacks of the existing scheme Wireless Sensor Networks. In the Proceedings of
is compromised nodes may be any two nodes in the forward International Conference on Systems and Networks,
path and lies between the check points . We overcome the 2006.
drawbacks and we detected the exact compromised node [12] Zia, T.A., and Zomaya, A.Y. “A Secure Triple Key
which lies in the forward path base on Negative Management Scheme for Wireless Sensor Networks”.
acknowledgement, node id, and packet drop ratio. The In the proceedings of IEEE INFOCOM 2006.
simulation using 50 nodes has proved the effectiveness of
the proposed algorithm. The proposed scheme is equipped
with technique to identify and isolate the malicious nodes
from the active data forwarding and routing. Further studies
are required to reduce the packet drop due to overlap of
window and to evaluate the detection accuracy of proposed
detection mechanism using probabilistic approach.
(IJCNS) International Journal of Computer and Network Security, 39
Vol. 2, No. 9, September 2010

Authors Profile
S.Sharmila received the B.E and M.E
degrees in Electronics and Communication
Engineering and Applied Electronics from
Bharathiyar University and Anna University,
India in 1999 and 2004 respectively. Her
research interest includes wireless sensor
networks,
computer networks and security.

G. Umamaheswari is Assistant professor in


Electronics and Communication Department,
PSG College of Technology, Coimbatore,
India. She completed her B.E. degree in
Electronics and Communication from Madras
University in 1989 and M.E. in Electronics
Engineering from Anna University, in 1992.
She is now supervising 5 Ph.D. candidates

S-ar putea să vă placă și