1. Ahmad Salam AlRefai

2.  Introduction  System Features  General Overview (general process)  Details of each component  Simulation Results  Considerations  References  Questions & Answers 2

3.  Security is critical for many sensor network application.  Sensor network has a number of limitations  Trustworthy sensor collaboration might fail.  Effective, light, flexible algorithm is required to detect internal adversary given that only localized information is available. 3

4.  Each sensor monitor the neighboring sensors.  Might refer to other neighbor results in sparse.  The sensor explore the spatial correlation among networking behaviors.  Majority vote is conducted to get the final decision. 4

5.  No prior knowledge  Generic  Localized  Application friendly 5

6. Information Collection False Information Filtering Outlier DetectionMajority Vote 6

7.  closed set of nodes monitored by x directly, (one hop neighborhood).  represent another neighborhood (dense ), while sparse ( may include two hop neighbors).  Expressing the resulting q component vector.  Packet dropping rate, Packet sending rate, Forwarding delay time, and sensor reading. 7

8.  F(x) may inaccurate when and F(x) contains indirect monitoring results. (sparse).  Trust-Based False Information Filtering Protocol: sensor x assigns a trust value to each neighbor in the range [0,1], closer to 1 indicates higher probability that X i is normal. 8

9.  is studied to detect outliers.  Xi is considered as outlier if the distance between it and the center of the data set is greater than some threshold.  F(xi) form a sample of multivariate normal distribution (as ).  The Mahalanobis squared distance 9

10.  If the mahalanobis distance is very large, the node should be treated as an insider attacker.  If xi is declared as an outlier.  Since the mean and covariance matrix are very sensitive to the presence of outlier, a robust estimators are required.  The mean and the covariance matrix are estimated according to Orthogonalized Gnanadesikan-kettenring (OGK) estimators. Others (low breaking point or high computational overhead.  The value of is chosen to be the percentile of the chi square distribution q degree of freedom, thus outlier is declared 10

11.  Each sensor announce all identified outlying neighbors to a neighborhood.  They send all the sensors they know with their status 0/1 outlier or not.  If more than half the nodes identify the sensor as outlier, then we consider the sensor as insider attacker. 11

12. 12

13. 13

14.  Simulation to implementation.  In the majority vote 0/1 outlaying/normal.  Consider designing special detection scheme for some specific attributes.  Consider using different robust statistics scheme like fast MCD. 14

15.  Fang Liu, Xiuzhen Cheng and Dechang Chen. “Insider Attacker Detection in Wireless Sensor Networks. In IEEE INFOCOM 2007 proceedings. 15

16. 16