Clone Attack Detection Research Articles

Classification of HHO-based Machine Learning Techniques for Clone Attack Detection in WSN

Thanks to recent technological advancements, low-cost sensors with dispensation and communication capabilities are now feasible. As an example, a Wireless Sensor Network (WSN) is a network in which the nodes are mobile computers that exchange data with one another over wireless connections rather than relying on a central server. These inexpensive sensor nodes are particularly vulnerable to a clone node or replication assault because of their limited processing power, memory, battery life, and absence of tamper-resistant hardware. Once an attacker compromises a sensor node, they can create many copies of it elsewhere in the network that share the same ID. This would give the attacker complete internal control of the network, allowing them to mimic the genuine nodes' behavior. This is why scientists are so intent on developing better clone assault detection procedures. This research proposes a machine learning based clone node detection (ML-CND) technique to identify clone nodes in wireless networks. The goal is to identify clones effectively enough to prevent cloning attacks from happening in the first place. Use a low-cost identity verification process to identify clones in specific locations as well as around the globe. Using the Optimized Extreme Learning Machine (OELM), with kernels of ELM ideally determined through the Horse Herd Metaheuristic Optimization Algorithm (HHO), this technique safeguards the network from node identity replicas. Using the node identity replicas, the most reliable transmission path may be selected. The procedure is meant to be used to retrieve data from a network node. The simulation result demonstrates the performance analysis of several factors, including sensitivity, specificity, recall, and detection.

NODE BASED CLONE ATTACK DETECTION IN STATIC WIRELESS SENSOR NETWORKS

Wireless Sensor Network (WSN) is a combination of autonomous sensor nodes and used to monitor various physical conditions. Static and mobile are two types of WSN. In static WSN the sensor nodes do not alter their positions after deployment. Due to the security constraints, WSN is vulnerable to various types of attacks. In that, Clone attack is the most dangerous attack on WSN. In Clone attack an adversary physically captures a sensor node. It reprograms the detained node and generates many clone nodes. The real nodes and clone nodes are installed in the sensor field, so clone node identification is a difficult task. The new protocol proposed to identify the clone nodes in the static WSN called as Node Based Clone Attack Detection (NBCAD) protocol. This protocol detects the clones in a efficient manner compare with SET and RED protocols. The advantage of proposed NBCAD protocol include high clone detection ratio, minimum communication overhead, minimum end-to-end delay, minimum latency time and high throughput.

Detection of RFID cloning attacks: A spatiotemporal trajectory data stream-based practical approach

With the rapid development of the internet of things (IoT), radio frequency identification (RFID) technology plays an important role in various fields. However, tags are vulnerable to cloning attacks because they are limited by size and production costs. A cloning attack fabricates one or more replicas of a genuine tag, which behave exactly the same as the genuine tag and can deceive the reader to obtain legitimate authorization, leading to potential economic loss or reputation damage. Many advanced solutions have been proposed to combat cloning attacks. Existing trajectory-based RFID clone detection methods use historical trajectories for model training. However, the environment of the RFID monitoring area is complex and diverse and changes in real time. The features trained based on historical trajectories cannot effectively adapt to the complex environment. In this article, we make a novel attempt to counterattack tag cloning based on real-time trajectories. We propose the clone attack detection approach (deClone), which can intuitively and accurately display the positions of abnormal tags in real time. It requires only commercial off-the-shelf (COTS) RFID devices, unlike methods based on radio frequency (RF) fingerprints and synchronization keys, which require additional hardware devices or software redesign. According to the experimental results, our scheme improves the detection precision by 16.71% compared with that of the existing trajectory-based detection methods.

Collective Memory for Detecting Nonconcurrent Clones: A Localized Approach for Global Topology and Identity Tracing in IoT Networks

Clone attack is considered as a severely destructive threat in Internet of Things (IoT), because: 1) the attack may be easily launched due to the deficiency of hardware architecture and the limited resources against physical capture and compromise and 2) it may trigger a large variety of insider and outsider attacks. Different from traditional clone attack detection approaches that ground on a large amount of data traversing the network (e.g., locations and identities), this article tackles this problem by answering the following fundamental questions: do we really need so much raw information? whether there is an alternative for local event detection by a node far away from that event? when acquiring/tracing global knowledge of a system/network, do we really need a global collection effort? These questions are of much importance in a large variety of networks. Specifically, this article provides a collective memory design for global topology and identity tracing (GTI Tracing), via a localized computing paradigm within neighborhood. This localized paradigm computationally builds a connection of identity and topology from time and space domain to a new computation domain. Such a computation domain retains four properties: 1) transitivity; 2) global convergence; 3) determinacy; and 4) causality. With byte-size information at an arbitrary device, it can recover and keep tracing global topology and identity information, and thus providing deterministic detection of clones. Both theoretical analysis and experimental study have shown the advantages of the proposed design in both detection accuracy and privacy protection, at a cost of light communication, storage, and computation overhead at each device.

Detection of Clone Attacks in Manets using Ant Colony Optimization

Wireless and mobile computing enables the spontaneous networking of a system with or without previous set-up. Mobile Ad Hoc Network (MANET) is a Wi-Fi grid that has already been developed and does not require an existing infrastructure for a specific extemporaneous operation. Any node can then connect or exit the network, which will permit the attacker to access the whole system. These networks are liable to various attacks. This paper directs detection of the clone attack from MANETs in which the attacker node steals the id of the closing node, twin it and attracts all the data towards it. ACO noticed the clone attack and measured performance based on the packet drops, packet delivery ratio and network throughput.

Hybrid Multi-Level Detection and Mitigation of Clone Attacks in Mobile Wireless Sensor Network (MWSN).

Wireless sensor networks (WSNs) are often deployed in hostile environments, where an adversary can physically capture some of the sensor nodes. The adversary collects all the nodes’ important credentials and subsequently replicate the nodes, which may expose the network to a number of other security attacks, and eventually compromise the entire network. This harmful attack where a single or more nodes illegitimately claims an identity as replicas is known as the node replication attack. The problem of node replication attack can be further aggravated due to the mobile nature in WSN. In this paper, we propose an extended version of multi-level replica detection technique built on Danger Theory (DT), which utilizes a hybrid approach (centralized and distributed) to shield the mobile wireless sensor networks (MWSNs) from clone attacks. The danger theory concept depends on a multi-level of detections; first stage (highlights the danger zone (DZ) by checking the abnormal behavior of mobile nodes), second stage (battery check and random number) and third stage (inform about replica to other networks). The DT method performance is highlighted through security parameters such as false negative, energy, detection time, communication overhead and delay in detection. The proposed approach also demonstrates that the hybrid DT method is capable and successful in detecting and mitigating any malicious activities initiated by the replica. Nowadays, crimes are vastly increasing and it is crucial to modify the systems accordingly. Indeed, it is understood that the communication needs to be secured by keen observation at each level of detection. The simulation results show that the proposed approach overcomes the weaknesses of the previous and existing centralized and distributed approaches and enhances the performance of MWSN in terms of communication and memory overhead.

A Low Resource Consumption Clone Detection Method for Multi-Base Station Wireless Sensor Networks

To make up the existing deficiencies of clone attack detection methods of wireless sensor networks, a low resource consumption clone detection method (MSCD) for multi-base station wireless sensor networks is proposed. MSCD has the following characteristics: (1) Running in each ring network with base station as the center and using nodes in non-hotspot area to complete clone attack detection, which reduces the effect of clone attack detection on the network lifetime; (2) Combine the head node rotation mechanism and the backup head node mechanism to ensure the energy balance of the network; (3) The ring head node path can find clone nodes that come from different local networks, which makes the MSCD method be suitable for the whole multi-base station network. Meanwhile, in the detection domain of the head node, local broadcast is used to ensure the encounter of legitimacy verification messages and witness nodes; (4) It is proved theoretically that the clone detection probability of MSCD can reach 1 when the witness is credible. The theoretical analysis and the simulation results show that the MSCD clone detection probability is still above 98% when the number of clone nodes accounts for 10% of the total number of nodes, and the network lifetime and storage requirements are significantly better than the existing similar methods.

Distributed Clone Attack Detection Algorithm Using Mobility Energy Prediction in Mobile Wireless Sensor Networks

Distributed Clone Attack Detection Algorithm Using Mobility Energy Prediction in Mobile Wireless Sensor Networks

Hybrid Internal Anomaly Detection System for IoT: Reactive Nodes with Cross-Layer Operation

We present a hybrid internal anomaly detection system that shares detection tasks between router and nodes. It allows nodes to react instinctively against the anomaly node by enforcing temporary communication ban on it. Each node monitors its own neighbors and if abnormal behavior is detected, the node blocks the packets of the anomaly node at link layer and reports the incident to its parent node. A novel RPL control message, Distress Propagation Object (DPO), is formulated and used for reporting the anomaly and network activities to the parent node and subsequently to the router. The system has configurable profile settings and is able to learn and differentiate between the nodes normal and suspicious activities without a need for prior knowledge. It has different subsystems and operation phases that are distributed in both the nodes and router, which act on data link and network layers. The system uses network fingerprinting to be aware of changes in network topology and approximate threat locations without any assistance from a positioning subsystem. The developed system was evaluated using test-bed consisting of Zolertia nodes and in-house developed PandaBoard based gateway as well as emulation environment of Cooja. The evaluation revealed that the system has low energy consumption overhead and fast response. The system occupies 3.3 KB of ROM and 0.86 KB of RAM for its operations. Security analysis confirms nodes reaction against abnormal nodes and successful detection of packet flooding, selective forwarding, and clone attacks. The system’s false positive rate evaluation demonstrates that the proposed system exhibited 5% to 10% lower false positive rate compared to simple detection system.

Trust and mobility based clone attack detection in mobile wireless network

Trust and mobility based clone attack detection in mobile wireless network

CBCD: Cluster based Clone Detection in Mobile Wireless Sensor Networks

Wireless Sensor Network consists of independent sensor nodes that are responsible for monitoring physical conditions. WSN is deployed in hostile environments. So it is vulnerable to capture and compromise by an attacker. An adversary can launch various types of attacks on WSN that can be classified as layer-dependent attack and layer-independent attacks. The layer-independent attacks are Sybil attack and Clone attack. In Clone attack an adversary can capture a sensor and creates clone of a captured node. These clone nodes are deployed in network area. It is difficult to detect clone nodes in the sensor network. There are so many clone detection protocols are available in static and mobile sensor networks. It is more challenging to detect clone attack in mobile WSN compared to the static WSN. The proposed clone attack detection protocol called as Cluster Based Clone Attack Detection (CBCD) discovers the clone nodes available in Mobile WSN. In this protocol sensor network divided into clusters. All the clusters have a cluster head and random number of sensors nodes. This protocol detect clone node according to the movement of sensor nodes. The clone is identified when sensor node move within the cluster or other clusters in the sensor network. Theoretical analysis and simulations have been conducted to evaluate the protocol in terms of clone detection time, clone detection ratio, memory consumption.

Energy and memory efficient clone detection in wireless sensor networks

In this paper, we propose an energy-efficient location-aware clone detection protocol in densely deployed WSNs, which can guarantee successful clone attack detection and maintain satisfactory network lifetime. Specifically, we exploit the location information of sensors and randomly select witnesses located in a ring area to verify the legitimacy of sensors and to report detected clone attacks. The ring structure facilitates energy-efficient data forwarding along the path towards the witnesses and the sink. We theoretically prove that the proposed protocol can achieve $100$ percent clone detection probability with trustful witnesses. We further extend the work by studying the clone detection performance with untrustful witnesses and show that the clone detection probability still approaches $98$ percent when $10$ percent of witnesses are compromised. Moreover, in most existing clone detection protocols with random witness selection scheme, the required buffer storage of sensors is usually dependent on the node density, i.e., $O(\sqrt{n})$ , while in our proposed protocol, the required buffer storage of sensors is independent of $n$ but a function of the hop length of the network radius $h$ , i.e., $O(h)$ . Extensive simulations demonstrate that our proposed protocol can achieve long network lifetime by effectively distributing the traffic load across the network.

Optimal Clone Attack Detection Model using an Energy-Efficient GSA based Simulated Annealing in Wireless Sensor Networks

Security of Wireless Sensor Networks (WSN) is an essential challenge as the sensors are deployed in open environment and they are prone to various attacks. One among them is the clone attack. Hence clone node discovery is a vital challenge in WSN. Various clone node discovery approaches have been projected to sense these clone nodes. These approaches deserve control overheads and the finding accuracy is low when the clone is chosen as a witness node. In this proposed method, a Residual Energy and Gravitational Search Algorithm based Simulated Annealing (RE-GSASA) for identifying and isolating the clone node in WSN is investigated. The performance of the proposed model is calculated using detection rate, packet delivery rate and sensor node density. The results show that the effectiveness of RE-GSASA method in terms of optimized energy consumption and improves clone node detection probability rate by minimizing the clone node detection time. The implementation is done using ns-2 to exhibit the actuality of the proposed work.

Clone attack detection and data loss prevention in mobile ad hoc networks

Wireless ad hoc networks, mobile ad hoc networks (MANETs) in particular, are not protected by tamper-resistant or equipped with high-storage-capacity hardware because of their low-cost and small size. So they are highly vulnerable to intrusion, node compromise, physical capture attacks and data loss. Due to harsh environments where these devices operate, they face data loss and reduced data availability, and if captured by an attacker, the devices can easily be compromised and cloned. The cloned devices will have the same identity as legitimate devices and interact with other devices to compromise them. In this paper, we propose two mechanisms: 1) novel clone attack detection scheme – log in log out detection (LLD) and system-wide announcement detection (SWAD) using low-energy dynamic (LED) clustering; 2) combinatorial replication and partition (CORP) of data – pairwise balanced design property of combinatorial arrangement – to prevent data loss. These mechanisms can be extrapolated to geospatial networks as well.

An energy-efficient random verification protocol for the detection of node clone attacks in wireless sensor networks

It is easy for adversaries to mount node replication attacks due to the unattended nature of wireless sensor networks. In several replica node detection schemes, witness nodes fail to work before replicas are detected due to the lack of effective random verification. This paper presents a novel distributed detection protocol to counteract node replication attacks. Our scheme distributes node location information to multiple randomly selected cells and then linear-multicasts the information for verification from the localized cells. Simulation results show that the proposed protocol improves detection efficiency compared with various existing protocols and prolongs the lifetime of the overall network.

Clone Attack Detection Protocols in Wireless Sensor Networks: A Survey

ABSTRACT Wireless Sensor Network (WSN) is a collection of autonomous sensor nodes which are low cost hardware components consists of sensor nodes with constraints on battery life, memory size and computation capabilities to monitor physical (or) environmental conditions. WSN is deployed in unattended and unsecure environments, so it is vulnerable to various types of attacks. One of the physical attacks is node replication attack (or) clone attack. An adversary can easily capture one node from the network and extract information from captured node. Then reprogram it to create a clone of a captured node. Then these clones can be deployed in all network areas, they can be considered as legitimate members of the network, so it is difficult to detect a replicated node. WSN can be either static (or) mobile, in that centralized and distributed clone attack detection methods are available. In this paper we analysis various centralized and distributed protocols in the static and mobile environments. We review these protocols and compare their performance with the help of witness selection, communication and memory overhead, detection probability of replicated nodes, resilience against adversary’s node compromise.

Detection of Clone Attack in Wsn

One of the most vexing problems in wireless sensor network security is the node Clone attack. In this attack, an adversary breaks into a sensor node, reprograms it, and inserts several copies of the node back into the sensor network. Cloning gives the adversary an easy way to build an army of malicious nodes that can cripple the sensor network. A few distributed solutions to address this fundamental problem have been recently proposed. However, these solutions are not satisfactory. Therefore first, the desirable properties of a distributed mechanism for the detection of node Clone attacks have been analyzed. Second, the known solutions for this problem do not completely meet our requirements. Third, a new self healing, Randomized, Efficient, and Distributed (RED) protocol for the detection of node Clone attacks has been proposed, and it satisfies the intended requirements. Index Terms: clone attack, RED, witness distribution, oblivious, performance, WSN. I. Introduction Wireless Sensor Networks (WSN) are developing as both a vital new domain in the IT environment and a hot research including system design, networking, distributed algorithms, programming models, data management, security and social components. Wireless sensor networks are rapidly picking up the popularity as they are potentially low cost solutions. The fundamental thought of sensor network is to scatter minor sensing gadgets over a particular geographic zone for some specific purposes like target tracking, surveillance, environmental screening and so on. These tiny devices are equipped for sensing a few progressions of parameters and communicating with different units. A wireless sensor network (WSN) is a remote system comprising of an extensive number of geologically dispersed sensor nodes. These sensor nodes could be effectively conveyed at vital districts easily at a low cost. Sensor nodes collaborate with one another to screen physical or ecological conditions, for example, temperature, sound, picture, vibration, weight, movement or contaminations with the assistance of different sorts of sensors. However, while much consideration is constantly paid to the routing strategies and wireless sensor network modeling, the security issues are yet to receive extensive focus. Essentially the utilization of any effective security conspire in wireless sensor systems is encouraged by the span of sensors, the processing power, memory and kind of functions anticipated from the sensors. Sensor networks are not universally traditional computing devices; subsequently the existing security models and strategies are lacking to run with them. In sensors, the geographic dissemination of the units allows an attacker to physically have control of nodes and study mystery key material, or to capture messages. The hierarchical nature of sensor networks and their route maintenance protocols permit the attacker to confirm where the root node is placed. WSNs are picking up interest in the research community due to their unique qualities. WSNs are very little watched. Consequently it is effectively conceivable for an assaulter to catch a hub physically, altering its code and getting private data like cryptographic keys. Wireless medium is inherently broadcast in nature which makes them vulnerable to attacks. These attacks can disturb the operation of WSN and can even kill the purpose of their deployment. Wireless networks can be recognized of two sorts: infrastructure network and ad-hoc (infrastructure less) network. Infrastructure network is a sort of a network with fixed and wired gateways. A mobile host interacts with a bridge in the network within its communication radius. The mobile unit can mobile geographically while it is communicating. When it goes out of range of one base station, it connects with new base station and starts communicating through it. This phenomenon is termed as handoff. On the other hand, Mobile ad hoc network is an aggregation of wireless mobile nodes in which nodes team up by sending packets for each other to permit them to communicate outside range of direct wireless transmission. Ad hoc networks require no fixed network infrastructure such as base stations or access points, and could be rapidly and economically set up as required.

Clone wars: Distributed detection of clone attacks in mobile WSNs

Among security challenges raised by mobile Wireless Sensor Networks, clone attack is particularly dreadful since it makes an adversary able to subvert the behavior of a network just leveraging a few replicas of some previously compromised sensors. In this work, we provide several contributions: first, we introduce two novel realistic adversary models, the vanishing and the persistent adversary, characterized by different compromising capability. We then propose two distributed, efficient, and cooperative protocols to detect replicas: History Information-exchange Protocol (HIP) and its optimized version (HOP). Both HIP and HOP leverage just local (one-hop) communications and node mobility, and differ for the amount of computation required. We study their behavior against the introduced types of attacker, considering two different mobility models and comparing our solutions against the state of the art. Both analysis and simulation results show that our solutions are effective and efficient, providing high detection rate, while incurring limited overhead.

Detection System of Clone Attacks based on RSSI in Wireless Sensor Networks

Most of the existing node clone attack detection methods in wireless sensor networks depend on the accurate position information and the synchronization clock information of the network node. However, it is often very difficult to guarantee real-time node location information and synchronization clock information in actual network. Therefore, those detection schemes are either difficult to achieve or is with high cost and low availability. A new detection method based on distance measurement is proposed for detecting node clone attacks in wireless sensor networks, in which three detection rules are defined. It has provided that the design and implementation of the detection system. The system has low requirements for the hardware configuration of the node and is easy to implement; it can make real-time detection of clone node for network security. The analysis and the experiment show the system is secure and reliable.

Single Hop Detection of Node Clone Attacks in Mobile Wireless Sensor Networks

Wireless sensor networks (WSNs) are often deployed in hostile and unattended environments; they are vulnerable to physical capture and compromise. In a node replication attack or a node clone attack, an adversary physically captures a sensor node, extracts cryptographic secrets from the node, and distributes a large number of replicas of captured node throughout the network, in order to launch a variety of insider attacks. Existing node clone attack detection schemes are mainly focused on stationary sensor networks. Also most existing detection schemes make unrealistic assumptions on the ability of replicas. In this paper, we propose a novel node clone attack detection protocol, namely the Single Hop Detection (SHD) protocol, which is fully distributed, highly robust against node colluding, specifically designed for mobile WSNs. We show analytically under popular mobility models that our protocol provides effective and robust node clone attack detection capability.