Node or Link? Fine-Grained Analysis of Packet-Loss Attacks in Wireless Sensor Networks

Abstract

In wireless sensor networks, packet losses are often an indicator of possible undergoing attacks. Therefore, security solutions aiming at providing comprehensive protection must include functions for packet-loss detection. Determining the actual cause of these losses is crucial to a quick and automated reaction to the attack, be it a simple reporting of the attack or a more sophisticated action such as packet rerouting and retransmission. Packet losses in wireless sensor networks can be caused by either attacks affecting the nodes or attacks focused on the wireless links. The efficacy of the response to such attacks is highly dependent on an accurate identification of the actual attack cause. Therefore, approaches to correctly identifying the cause of packet losses are needed. The work presented in this article addresses this problem by designing and implementing a fine-grained analysis (FGA) tool that investigates packet-loss events and reports their most likely cause. Our FGA tool profiles the wireless links between the nodes, as well as their neighborhood, by leveraging resident parameters, such as RSSI and LQI, available within every received packet. The design of the system is fully distributed and event-driven, and its low overhead makes it suitable for resource-constrained entities such as wireless motes. We have validated our approach through real-world experiments, showing that our FGA tool is effective in differentiating between the various attacks that may affect nodes and links.