• 한국컴퓨터정보학회논문지
• /
• 제11권6호
• /
• pp.211-219
• /
• 2006

무선 네트워크의 확대로 무선 트래픽에 대한 침입 탐지/차단 시스템의 필요성이 강조되고 있다. 본 연구에서는 캠퍼스 망에서 무선망을 통하여 유선망을 공격하는 트래픽들을 탐지하고 분석된 결과를 통합적으로 관리하여 공격 트래픽을 효과적으로 차단하는 시스템을 제안한다. 제안하는 시스템은 무선 트래픽의 침입 탐지를 위해 기존의 W-Sensor 기능을 소프트웨어 형태로 개발하고 탐지된 공격 트래픽을 차단하는 통합 보안 관리 시스템 W-TMS를 개발하여 연동하게 하였다. 개발된 W-Sensor SW를 통해 무선 트래픽의 공격에 대해 효율적인 탐지 기능을 수행하고 변화되는 공격 유형에 대해 신속하게 대응할 수 있다. 또한 노트북 등에 SW를 설치함으로써 기존 AP 기반 시스템에 비해 이동성을 증가시킬 수 있다.

• Journal of Communications and Networks
• /
• 제15권2호
• /
• pp.164-172
• /
• 2013

We consider the problem of secure and robust clustering for quantized target tracking in wireless sensor networks (WSN) where the observed system is assumed to evolve according to a probabilistic state space model. We propose a new method for jointly activating the best group of candidate sensors that participate in data aggregation, detecting the malicious sensors and estimating the target position. Firstly, we select the appropriate group in order to balance the energy dissipation and to provide the required data of the target in the WSN. This selection is also based on the transmission power between a sensor node and a cluster head. Secondly, we detect the malicious sensor nodes based on the information relevance of their measurements. Then, we estimate the target position using quantized variational filtering (QVF) algorithm. The selection of the candidate sensors group is based on multi-criteria function, which is computed by using the predicted target position provided by the QVF algorithm, while the malicious sensor nodes detection is based on Kullback-Leibler distance between the current target position distribution and the predicted sensor observation. The performance of the proposed method is validated by simulation results in target tracking for WSN.

• Journal of information and communication convergence engineering
• /
• 제9권6호
• /
• pp.676-682
• /
• 2011

Sybil attack can disrupt proper operations of wireless sensor network by forging its sensor node to multiple identities. To protect the sensor network from such an attack, a number of countermeasure methods based on RSSI (Received Signal Strength Indicator) and LQI (Link Quality Indicator) have been proposed. However, previous works on the Sybil attack detection do not consider the fact that Sybil nodes can change their RSSI and LQI strength for their malicious purposes. In this paper, we present a Sybil attack detection method based on a transmission power range. Our proposed method initially measures range of RSSI and LQI from sensor nodes, and then set the minimum, maximum and average RSSI and LQI strength value. After initialization, monitoring nodes request that each sensor node transmits data with different transmission power strengths. If the value measured by monitoring node is out of the range in transmission power strengths, the node is considered as a malicious node.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제12권12호
• /
• pp.5819-5840
• /
• 2018

Considering the topology of hierarchical tree structure, each cluster in WSNs is faced with various attacks launched by malicious nodes, which include network eavesdropping, channel interference and data tampering. The existing intrusion detection algorithm does not take into consideration the resource constraints of cluster heads and sensor nodes. Due to application requirements, sensor nodes in WSNs are deployed with approximately uncorrelated security weights. In our study, a novel and versatile intrusion detection system (IDS) for the optimal defense strategy is primarily introduced. Given the flexibility that wireless communication provides, it is unreasonable to expect malicious nodes will demonstrate a fixed behavior over time. Instead, malicious nodes can dynamically update the attack strategy in response to the IDS in each game stage. Thus, a multi-stage intrusion detection game (MIDG) based on Bayesian rules is proposed. In order to formulate the solution of MIDG, an in-depth analysis on the Bayesian equilibrium is performed iteratively. Depending on the MIDG theoretical analysis, the optimal behaviors of rational attackers and defenders are derived and calculated accurately. The numerical experimental results validate the effectiveness and robustness of the proposed scheme.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제9권11호
• /
• pp.4644-4661
• /
• 2015

Wireless sensor networks are often organized in the form of clusters leading to the new framework of WSN called cluster or hierarchical WSN where each cluster head is responsible for its own cluster and its members. These hierarchical WSN are prone to various routing layer attacks such as Black hole, Gray hole, Sybil, Wormhole, Flooding etc. These routing layer attacks try to spoof, falsify or drop the packets during the packet routing process. They may even flood the network with unwanted data packets. If one cluster head is captured and made malicious, the entire cluster member nodes beneath the cluster get affected. On the other hand if the cluster member nodes are malicious, due to the broadcast wireless communication between all the source nodes it can disrupt the entire cluster functions. Thereby a scheme which can detect both the malicious cluster member and cluster head is the current need. Abnormal energy consumption of nodes is used to identify the malicious activity. To serve this purpose a learning based energy prediction algorithm is proposed. Thus a two level energy prediction based intrusion detection scheme to detect the malicious cluster head and cluster member is proposed and simulations were carried out using NS2-Mannasim framework. Simulation results achieved good detection ratio and less false positive.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제17권6호
• /
• pp.1706-1727
• /
• 2023

Under Water Sensor Networks (UWSN) has gained attraction among various communities for its potential applications like acoustic monitoring, 3D mapping, tsunami detection, oil spill monitoring, and target tracking. Unlike terrestrial sensor networks, it performs an acoustic mode of communication to carry out collaborative tasks. Typically, surface sink nodes are deployed for aggregating acoustic phenomena collected from the underwater sensors through the multi-hop path. In this context, UWSN is constrained by factors such as lower bandwidth, high propagation delay, and limited battery power. Also, the vulnerabilities to compromise the aquatic environment are in growing numbers. The paper proposes an Energy-Efficient standalone Intrusion Detection System (EEIDS) to entail the acoustic environment against malicious attacks and improve the network lifetime. In EEIDS, attributes such as node ID, residual energy, and depth value are verified for forwarding the data packets in a secured path and stabilizing the nodes' energy levels. Initially, for each node, three agents are modeled to perform the assigned responsibilities. For instance, ID agent verifies the node's authentication of the node, EN agent checks for the residual energy of the node, and D agent substantiates the depth value of each node. Next, the classification of normal and malevolent nodes is performed by determining the score for each node. Furthermore, the proposed system utilizes the sheep-flock heredity algorithm to validate the input attributes using the optimized probability values stored in the training dataset. This assists in finding out the best-fit motes in the UWSN. Significantly, the proposed system detects and isolates the malicious nodes with tampered credentials and nodes with lower residual energy in minimal time. The parameters such as the time taken for malicious node detection, network lifetime, energy consumption, and delivery ratio are investigated using simulation tools. Comparison results show that the proposed EEIDS outperforms the existing acoustic security systems.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제13권11호
• /
• pp.5354-5369
• /
• 2019

Sensor networks are deployed in unheeded environment to monitor the situation. In view of the unheeded environment and by the nature of their communication channel sensor nodes are vulnerable to various attacks most commonly malicious packet dropping attacks namely blackhole, grayhole attack and sinkhole attack. In each of these attacks, the attackers capture the sensor nodes to inject fake details, to deceive other sensor nodes and to interrupt the network traffic by packet dropping. In all such attacks, the compromised node advertises itself with fake routing facts to draw its neighbor traffic and to plunge the data packets. False routing advertisement play vital role in deceiving genuine node in network. In this paper, behavior based routing misbehavior detection (BRMD) is designed in wireless sensor networks to detect false advertiser node in the network. Herein the sensor nodes are monitored by its neighbor. The node which attracts more neighbor traffic by fake routing advertisement and involves the malicious activities such as packet dropping, selective packet dropping and tampering data are detected by its various behaviors and isolated from the network. To estimate the effectiveness of the proposed technique, Network Simulator 2.34 is used. In addition packet delivery ratio, throughput and end-to-end delay of BRMD are compared with other existing routing protocols and as a consequence it is shown that BRMD performs better. The outcome also demonstrates that BRMD yields lesser false positive (less than 6%) and false negative (less than 4%) encountered in various attack detection.

• 정보처리학회논문지C
• /
• 제12C권6호
• /
• pp.865-874
• /
• 2005

컴퓨터 시스템에 저장된 정보는 불법적인 접근, 악의적인 파괴 및 변경, 우연적인 불일치 등으로부터 보호되어야 한다. 본 논문에서는 이러한 공격을 탐지하고 방어할 수 있는 센서기반 침입탐지시스템을 제안한다. 제안된 시스템은 각 중요 디렉터리에 센서 파일을 각 중요 파일에 센서 데이터를 설치한다. 이들 센서 객체는 일종의 덫으로서, 센서 객체에 대한 접근은 침입이라고 간주된다. 이를 통해 불법적으로 정보를 복사하거나 빼내 가려는 가로채기 위협을 효과적으로 방어할 수 있다. 제안된 시스템은 리눅스 시스템 상에서 적재 가능한 커널 모듈(LKM: Loadable Kernel Module) 방식을 사용하여 구현되었다. 본 시스템은 폭 넓은 침입탐지를 위해 호스트 기반의 탐지 기법과 네트워크 기반의 탐지 기법을 서로 결합함으로써 잘 알려지지 않은 가로재기 공격도 탐지 가능하게 하였다.

• 한국콘텐츠학회논문지
• /
• 제9권1호
• /
• pp.115-122
• /
• 2009

본 논문에서는 유비쿼터스 환경에서 OTP가 적용된 Diffie-Hellman 방식을 이용하여 노드간 키를 전달할 때 타임스탬프의 시간 차이를 이용하여 악의적인 노드를 검출할 수 있는 방법을 제안한다. 기존의 방식들은 정확한 시간 동기화나 방향성 안테나를 이용한 방법으로 악의의 노드 검출을 시도하였다. 본 논문에서는 방향성 안테나 추가 혹은 제 3 신뢰기관(TTP) 없이 타임스탬프를 이용한 OTP를 Diffie-Hellman 방식에 적용하여 중간의 악의노드 검출 방법을 제안하고 이에 대한 안전성을 검증한다. 본 논문에서 제안하는 방법은 유비쿼터스 환경에서도 쉽게 적용이 가능한 방법이다.

• 한국융합학회논문지
• /
• 제8권8호
• /
• pp.51-57
• /
• 2017

무선 센서 네트워크는 자원 제약적인 센서 노드들로 구성되는 네트워크로, 분산 서비스 거부 공격, 라우팅 공격 등 다양한 악의적인 공격이 발생될 수 있다. 본 논문에서는 소프트웨어 정의 네트워킹 기술과 보안 기술을 융합하여 무선 센서 네트워크에 발생하는 다양한 공격을 탐지하고 방어하는 기법을 제안한다. 제안 기법에서는 서버에 있는 침입 탐지 및 방지 시스템이 SDN 컨트롤러를 통해 전달되는 오픈플로우 스위치의 로그 정보들을 축적하여 침입을 탐지하며, 침입을 탐지했을 때 오픈플로우 프로토콜을 이용하여 오픈플로우 스위치에 해당 침입에 대한 대응방안을 설정함으로써 침입을 방지할 수 있다. 본 논문에서는 분산 서비스 거부 공격 및 라우팅 공격 발생 시 침입 탐지 및 방지를 보임으로써 제안기법의 타당성을 보였다. 제안기법은 다른 기법과 달리 중앙 집중 서버에서 그래프 모델과 침입 탐지 모델을 융합하여 효과적이고 메시지 효율적으로 다양한 침입을 탐지하고 방지할 수 있다.