LAD: Location Anomaly Detection for Wireless Sensor Networks Wenliang (Kevin) Du (Syracuse Univ.) Lei Fang (Syracuse Univ.) Peng Ning (North Carolina State Univ.) Sponsored by the NSF CyberTrust Program

Location Discovery in WSN Sensor nodes need to find their locations Rescue missions Geographic routing protocols. Constraints No GPS Low cost

Existing Positioning Schemes Beacon Nodes

Attacks Beacon Nodes

Attacks Beacon Nodes

What is Anomaly Localization error: | L estimation – L actual | L e = L estimation L a = L actual Anomaly: |L e – L a | > MTE MTE: Maximum Tolerable Error. D-Anomaly: |L e – L a | > D

The Anomaly Detection Problem Is |L e – L a | > D ? Find another metric A and a threshold T A > T |L e – L a | > D 

False Positive and Negative Ideal Situation: A > T  |L e – L a | > D False Positive (FP): A > T, but |L e – L a | < D False Negative (FN): A D Detection Rate: 1 – (False Negative Rate)

Our Task We assume that the location discovery is already finished. Find a good metric A What metric can help a sensor find out whether it is in a “wrong” location? It should be more robust than the location discovery itself.

A Group-Based Deployment Scheme

Modeling of The Group-Based Deployment Scheme Deployment Points: Their locations are known.

The Observations A B Actual Observation Expected Observation

Modeling of the Deployment Distribution Using pdf function to model the node distribution. Example: two- dimensional Gaussian Distribution.

The Idea A B D C LaLa LeLe

The Problem Formulation Is Z abnormal? Observation a = (a 1, a 2, … a n ) LAD Location Discovery Z

The Problem Formulation Actual Observation a = (a 1, a 2, … a n ) Estimated Location: Z Expected Observation e(Z) = (e 1, e 2, … e n ) Are e(Z) and a consistent?

Various Metrics Diff Metric: A = | e(Z) – a | Probability Metric: A = Pr (a | Z) Others

How to Find the Threshold? Recall: we use A > T to decide |L e – L a | >? D How to obtain T T is obtained for a non-compromised network. One location discovery scheme is used Derivation: preferable but difficult Simulation: e.g., Find T, such that Pr(|L e – L a | > D | A > T) = 99.99%, We use T as the threshold for A. False positive = 1 – 99.99% = 0.01%.

Attacks A B

I am actually from group 5, But I am not telling anybody. Silence AttackRange-Change Attack

Attacks (continued) I am actually from group 5. Impersonation AttackMulti-Impersonation Attack and Wormhole Attack I am from group 9 Group 3 Group 5 Group 6

Arbitrary Attack Attackers can arbitrarily change a sensor’s observation (both increasing and decreasing). There is no hope. Observation: decreasing is more difficult. a = (1, 2, 8, 10) a’ = (10, 9, 3, 1) Arbitrary Change

Dec-Bounded Attack a’ i can be arbitrarily larger than a i (multi- impersonation attacks). But a’ i cannot be arbitrarily smaller than a i. Difficult in preventing non-compromised nodes from broadcasting their membership.  (a i – a’ i ) a’ i a = (1, 2, 8, 10)a’ = (10, 9, 7, 8)Dec-Bounded Change

Dec-Only Attack Prevent impersonation attacks Authentication No wormhole attacks. Attackers cannot move sensors. Attackers cannot enlarge the transmission power. a = (1, 2, 8, 10) a’ = (1, 2, 5, 7)Dec-Only Change

Evaluation via Simulation X nodes are compromised Random pick a node at L a (actual location) with the actual observation a Find a location L e s.t. |L e - L a | = D Compute expected observation u from L e Generate a new observation a ’ from a (attacking) Find L e, s.t. a ’ is as close to u as possible

The ROC Curves Evaluating Intrusion Detection Detection rate False positive We need to look at them both Receive Operating Characteristic (ROC) Y-axis: Detection rate X-axis: False positive ratio

ROC Curves for Different Metrics

ROC Curves for Different Attacks

Detection Rate vs. Degree of Damage False Positive = 0.01

Detection Rate vs. Node Compromise Ratio False Positive = 0.01

Conclusion We have developed an effective anomaly detection scheme for location discovery Future Studies How the deployment knowledge model affect our scheme How the location discovery schemes affect our scheme How to correct the location errors caused by the attacks.