Anomaly Detection Based on a Multi-class CUSUM Algorithm for WSN
نویسندگان
چکیده
Security is one of the most important research issues in wireless sensor networks (WSN) applications. Given that the single detection threshold of the cumulative sum (CUSUM) algorithm causes longer detection delays and a lower detection rate, a multi-class CUSUM algorithm is hereby proposed. Firstly a maximum and minimum thresholds, which sensor nodes are able to reach during sending packet, are set to eliminate abnormal flow to enhance the detection efficiency. Secondly, CUSUM algorithms of different thresholds, all of which are selected according to the mean of traffic sequences, are applied to detect anomalous nodes. This study aims to optimize threshold parameters, the size of which increases with the number of traffic sequence. Using the NS2 tool, the different values of network traffic sequence are generated and simulated. Based on these values, the detection rates of the CUSUM algorithm and multi-class CUSUM algorithms, as well as their false positive rates, are then evaluated. Results show that the proposed algorithm achieves a higher and more accurate rate of detection and lower false positive rates than do the current important intrusion detection schemes of WSN. Index Terms WSN, CUSUM algorithm, multi-class CUSUM algorithm, threshold, anomaly detection
منابع مشابه
Anomaly Detection Based on a Multi-class CUSUM Algorithm for WSN
Security is one of the most important research issues in wireless sensor networks (WSN) applications. Given that the single detection threshold of the cumulative sum (CUSUM) algorithm causes longer detection delays and a lower detection rate, a multi-class CUSUM algorithm is hereby proposed. Firstly a maximum and minimum thresholds, which sensor nodes are able to reach during sending packet, ar...
متن کاملAn Adaptive Anomaly Threshold in Artificial Dendrite Cell Algorithm
The dendrite cell algorithm (DCA) relies on the multi-context antigen value (MCAV) to determine the abnormality of a record by comparing it with anomaly threshold. In practice, the threshold is pre-determined before mining based on previous information and the existing MCAV is inefficient when expose to extreme values. This causes the DCA fails to detect unlabeled data if the new pattern distin...
متن کاملAdaptive CUSUM for Anomaly Detection and Its Application to Detect Shared Congestion
It is a major challenge for a detection algorithm to maintain high detection probability and low false alarms simultaneously. In this paper, we propose an adaptive CUSUM algorithm (ACS) to robustly detect an anomaly, which is defined as system behavior that deviates from its expected values. By embedding a sliding model control (SMC) controller into a CUSUM detector, ACS effectively prevents un...
متن کاملEvaluation of an Intrusion Detection System for Routing Attacks in Wireless Self-organised Networks
Wireless Sensor Networks (WSNs) arebecoming increasingly popular, and very useful in militaryapplications and environmental monitoring. However,security is a major challenge for WSNs because they areusually setup in unprotected environments. Our goal in thisstudy is to simulate an Intrusion Detection System (IDS)that monitors the WSN and report intrusions accurately andeffectively. We have thus...
متن کاملDetecting Network Anomalies Using CUSUM and EM Clustering
Intrusion detection has been extensively studied in the last two decades. However, most existing intrusion detection techniques detect limited number of attack types and report a huge number of false alarms. The hybrid approach has been proposed recently to improve the performance of intrusion detection systems (IDSs). A big challenge for constructing such a multi-sensor based IDS is how to mak...
متن کامل