English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools annual

Global: Zendy Free Plan

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Sybil attack is a destructive attack in wireless sensor networks, where a node illegitimately takes on multiple identities. Some scholars focus on how to defense against Sybil attack if the attackers launch selective forwarding attack. However, threat of network lifespan caused by Sybil attack is ignored. In this paper, we demonstrate that network lifespan is possible to be shortened by Sybil attackers and then we put forward a countermeasure against Sybil attack based on RSSI ranging and data flows monitoring. First, we detect suspicious nodes (we call them as node M and node N) if all of their common neighbors find node M and N have the same distance to them. Second, a suspicious node will be marked as Sybil node if its data flow is abnormal according to criterion. Simulation results show that proposed secure mechanism can effectively detect Sybil nodes with a misdetection rate of 6.7% and a false alarm rate of 3.3%. Additionally, proposed security scheme extends the network lifespan by 26.3%. 1.Introduction Sybil attack, first described by Douceur [1], refers to a kind of malicious behave undermining the network by steal or fabricate multiple identities by only a physical device. Sybil attack has two purposes. One is that it will damage the network by dropping or modifying data[2]. The other is that it will also narrow the lifespan of the network by transmitting data frequently in a certain area. Many scholars have done research on Sybil attack. Karlof and Wagner[2] found that Sybil attack would pose a threat to routing mechanisms in sensor networks. James Newsome et al. pointed out that position verification was a promising approach[3] to defend against the Sybil attack, but it was difficult to verify a node’s exact position. Demirbas M et al. gave a Sybil detection method based on the Received Signal Strength Indicator (RSSI[4]). Sharmila Sivaraj combined the transmission power with the distance detection between the nodes to detect the Sybil node [5]. Bin Tian argued that we can use three neighbor nodes which position have been known to detect Sybil node [6]. Udaya Suriya Raj Kumar Dhamodhar et al. proposed a positioning-related CAM-PAM (compare and match-position verification method) algorithm[7]. In this paper, a lightweight Sybil attack detection scheme based on data flow monitoring and RSSI ranging is put forward in this paper. The detection scheme considers the error of RSSI and remedies it by other approaches which exploit the characteristics of Sybil attack. Simulation results show that our scheme can detect the Sybil node effectively. 2017 2nd International Conference on Mechatronics and Information Technology (ICMIT 2017) Copyright © (2017) Francis Academic Press , UK 110 2.Proposed Security Scheme to Defense Sybil Attack 2.1 Shortening the network lifespan Before the description of our scheme, we will make some assumptions. We assume that sink node is trustworthy and nodes in the network are immobile. Moreover, we assume that there is only a Sybil node with two identities in the network. We can make a preliminary detection about which nodes may be Sybil nodes according to their position feature. If nodes locate in the network randomly and uniformly, once a node C scouts that it has the same distance to its two neighbors (node M and N), it will ask its other neighbors which are also the common neighbors of node M and node N for assistance to verify legitimacy of them. If one of the common neighbors (node C1) assures that the distance N C M C 1 1 ≠ , we can think of node M and node N as normal nodes. Conversely, if all of the common neighbors find node M and N have the same distance to them, they will be regard as suspicious nodes. Fig. 1 The detection of normal node RSSI [8] is applied to measure distance between two points. Unfortunately, the error of this method is above 10% due to environmental factors, the limit of hardware, etc. Therefore, we introduce confidence interval as the criterion to tell which node is impossible to be Sybil node. Result shows that with a confidence level 99%, if the difference between two measured distance ' OA and ' OB range from -10m to 10m, we will hold that the actual distance between O and A is the same as distance between O and B. However, this error range brings a certain misdetection rate and a false alarm, so we introduce data flow monitoring to distinguish Sybil nodes from suspicious nodes. When the energy consumption of the network is balanced, the data flow transported by the same hop nodes should be approximately equal, while the data flow of Sybil nodes is larger than normal nodes’. Assume that the mean data flow of suspicious nodes is s and the range of data flow of the same hop node is ( ) 2 1 s s , , where ' ' σ μ 3 s1 − = , ' ' 2 σ μ 3 s + = , ' μ is the mean data for the same hop nodes and ' σ is the standard deviation of data for the same hop nodes. The suspicious nodes will be regard as normal nodes if 1 1 s s s ≤ ≤ , otherwise, they are multiple identifies of Sybil node. 2.2 Selective forwarding Position is a unique characteristic of Sybil attack. Therefore, the RSSI ranging described in section ‘Shortening the network lifespan’ is also use to detect suspicious nodes when Sybil attackers launch selective forwarding. The adaptive threshold model [9] is introduced to determine suspicious nodes as Sybil nodes if the trust value T of a suspicious node is low than the trust threshold. The trust value T [10] of a node is shown in equation 1 and the threshold of trust value is defined as equation 2. 2 f s 1 s T + + + = (1) where s is the number of packets sent correctly and f is the number of packet dropped. )} ( ] [ { ) ( n p Pt 1 Pt t n T × − + × = (2) where t is a variable( 1 t 0 < < ) used to ensure that the threshold is reasonable, Pt is the average forwarding rate of a certain monitor area and ) (n p is the forwarding rate of a sensor node in n turn . 2.3 Comprehensive security scheme Based on two security schemes above, a comprehensive security scheme to defense against Sybil attack is put forward. It can be described as follows:

Sybil Attack Detection Scheme Based on Data Flow Monitoring and RSSI ranging in WSN