Ahmad Salam AlRefai

 Introduction  System Features  General Overview (general process)  Details of each component  Simulation Results  Considerations  References  Questions & Answers 2

 Security is critical for many sensor network application.  Sensor network has a number of limitations  Trustworthy sensor collaboration might fail.  Effective, light, flexible algorithm is required to detect internal adversary given that only localized information is available. 3

 Each sensor monitor the neighboring sensors.  Might refer to other neighbor results in sparse.  The sensor explore the spatial correlation among networking behaviors.  Majority vote is conducted to get the final decision. 4

 No prior knowledge  Generic  Localized  Application friendly 5

Information Collection False Information Filtering Outlier DetectionMajority Vote 6

 closed set of nodes monitored by x directly, (one hop neighborhood).  represent another neighborhood (dense ), while sparse ( may include two hop neighbors).  Expressing the resulting q component vector.  Packet dropping rate, Packet sending rate, Forwarding delay time, and sensor reading. 7

 F(x) may inaccurate when and F(x) contains indirect monitoring results. (sparse).  Trust-Based False Information Filtering Protocol: sensor x assigns a trust value to each neighbor in the range [0,1], closer to 1 indicates higher probability that X i is normal. 8

 is studied to detect outliers.  Xi is considered as outlier if the distance between it and the center of the data set is greater than some threshold.  F(xi) form a sample of multivariate normal distribution (as ).  The Mahalanobis squared distance 9

 If the mahalanobis distance is very large, the node should be treated as an insider attacker.  If xi is declared as an outlier.  Since the mean and covariance matrix are very sensitive to the presence of outlier, a robust estimators are required.  The mean and the covariance matrix are estimated according to Orthogonalized Gnanadesikan-kettenring (OGK) estimators. Others (low breaking point or high computational overhead.  The value of is chosen to be the percentile of the chi square distribution q degree of freedom, thus outlier is declared 10

 Each sensor announce all identified outlying neighbors to a neighborhood.  They send all the sensors they know with their status 0/1 outlier or not.  If more than half the nodes identify the sensor as outlier, then we consider the sensor as insider attacker. 11

12

13

 Simulation to implementation.  In the majority vote 0/1 outlaying/normal.  Consider designing special detection scheme for some specific attributes.  Consider using different robust statistics scheme like fast MCD. 14

 Fang Liu, Xiuzhen Cheng and Dechang Chen. “Insider Attacker Detection in Wireless Sensor Networks. In IEEE INFOCOM 2007 proceedings. 15

16