Evaluating the Feasibility of Traffic-Based Intrusion Detection in an 802.15.4 Sensor Cluster

We investigate the feasibility of a simple, traffic volume-based intrusion detection for an IEEE 802.15.4 compliant sensor cluster operating in beacon-enabled, slotted CSMA-CA mode. We have used simple exponential averaging to filter out some of the inherent variability in individual device arrival rate, and introduced a small hysteresis in the decision process in order to avoid false alarms due to dithering. Initial results demonstrate that the intrusion detection implemented in this manner may indeed operate quickly and efficiently.

[1]  Jelena V. Misic,et al.  MAC layer security of 802.15.4-compliant networks , 2005, IEEE International Conference on Mobile Adhoc and Sensor Systems Conference, 2005..

[2]  Ian F. Akyildiz,et al.  Wireless sensor networks: a survey , 2002, Comput. Networks.

[3]  Qilian Liang,et al.  Secure media access control (MAC) in wireless sensor networks: intrusion detections and countermeasures , 2004, 2004 IEEE 15th International Symposium on Personal, Indoor and Mobile Radio Communications (IEEE Cat. No.04TH8754).

[4]  Shairmina Shafi,et al.  The impact of MAC parameters on the performance of 802.15.4 PAN , 2005, Ad hoc networks.

[5]  Jelena V. Misic,et al.  Performance of a beacon enabled IEEE 802.15.4 cluster with downlink and uplink traffic , 2006, IEEE Transactions on Parallel and Distributed Systems.

[6]  Elaine Shi,et al.  Designing secure sensor networks , 2004, IEEE Wireless Communications.

[7]  Huirong Fu,et al.  Intrusion Detection System for Wireless Sensor Networks , 2008, Security and Management.

[8]  Adrian Perrig,et al.  Security and Privacy in Sensor Networks , 2003, Computer.

[9]  J.A. Stankovic,et al.  Denial of Service in Sensor Networks , 2002, Computer.

[10]  S. Delurgio.  Forecasting Principles and Applications , 1998 .

[11]  Michalis Faloutsos,et al.  Denial of service attacks at the MAC layer in wireless ad hoc networks , 2002, MILCOM 2002. Proceedings.