无线传感器网络中基于模糊分簇的入侵检测算法

Abstract

当无线传感器节点被应用到输电线路检测等领域时，由于其自身的计算能力有限、传输环境的开放性等因素，通常容易遭受到攻击。攻击节点通过捕获无线传感器网中的正常节点来获得节点中的有用信息(包括节点位置、密钥、节点身份)并加以复制构成一个能发起各种内部攻击的克隆节点，从而获取网络内部更为机密的信息。为了解决这类问题，我们提出了基于探测克隆节点存在的入侵检测算法(IDA)。在这种算法中，首先，我们提出基于加权变异系数的模糊均值分簇算法并对监测网络进行分簇。然后，我们选择功耗较小的节点作为监测节点(Witness node)，这些监测节点在簇内全覆盖地监测数据传输节点和簇头节点是否被克隆。在监测数据传输节点时，通过分析错失探测概率和有效吞吐量来确定簇内的数据传输节点是否被克隆。在检测簇头节点时，通过设置合适的报警阈值来确定簇头节点是否被克隆。仿真结果表明所提出的入侵检测算法在选择合适的编码函数时，错误探测概率会减小50%以上，网络平均能耗降低20%。 When wireless sensor nodes are applied to the transmission line testing or other areas, they are often easily attacked due to the limited computation capability and the open data transmission environment. Attack nodes can obtain the useful information of nodes (including node location, secret key, and node identity) by capturing the normal nodes in the network, and then copy the information to become clone nodes that can take various internal attacks so that they can obtain more secure information. To solve the problem, we propose an intrusion detection algorithm (IDA) based on detecting the existence of clone nodes. In this algorithm, firstly, we propose the weighted variation coefficient based fuzzy mean clustering algorithm and cluster the networks by the proposed clustering algorithm. Secondly, we choose some nodes with less energy consumption as witness nodes. The witness nodes will monitor the whole network to determine whether the data transmission nodes and the cluster head nodes are replicated. Then, when the witness nodes monitor the data transmission nodes, IDA algorithm will determine whether the data transmission nodes are cloned within the cluster by analyzing the miss detection probability and the effective throughput. In the monitoring of cluster head nodes, IDA algorithm will determine whether the cluster head nodes are replicated by setting the alarm threshold. The simulation results show that our IDA algorithm will decrease the miss detection probability greatly to 50% and reduce the average energy consumption to 20% by choosing appropriate coding function.