Weak Process Models for Attack Detection in a Clustered Sensor Network Using Mobile Agents

This paper proposes a methodology for detecting networklayer anomalies in wireless sensor networks using weak process models (WPM). Weak process models are a non-parametric version of Hidden Markov models (HMM), wherein state transition probabilities are reduced to rules of reachability. Specifically, we present an intrusion detection system based on anomaly detection logic. It identifies any observable event correlated to a threat by applying a set of anomaly rules to the incoming traffic. Attacks are classified into low and high potential attacks according to its final state. Alarms are issued as soon as one or more high potential attacks are detected. We model hello flooding, sinkhole and wormhole. We introduced single threat models and aggregated models and study how effective they are to detect each attack. We present the design approach for the proposed WPM-based detection technique using mobile agents. Early implementations of the agent based secure platform have already been implemented.