Search

An accurate and synchronized clock time is crucial in many sensor network applications. A number of time synchronization schemes have been proposed for wireless sensor networks recently to address the resource constraints in such networks. However, most of these techniques assume benign environments, thus cannot survive malicious attacks in hostile environments, especially when there are compromised nodes. In this chapter, we present the clock model for time synchronization, and briefly introduce the insecure time synchronization techniques in wireless sensor networks. We then present the challenges and requirements to secure time synchronization and summarize the recent progress on secure time synchronization in wireless sensor networks. [ABSTRACT FROM AUTHOR]

Recent technological advances have made it possible to develop distributed sensor networks consisting of a large number of low-cost, low-power, and multi-functional sensor nodes that communicate in short distances through wireless links [1]. Such sensor networks are ideal candidates for a wide range of applications such as health monitoring, data acquisition in hazardous environments, and military operations. The desirable features of distributed sensor networks have attracted many researchers to develop protocols and algorithms that can fulfill the requirements of these applications (e.g., [1,12,14,17,28,29,32]). [ABSTRACT FROM AUTHOR]

In wireless sensor networks (WSNs), sensor location plays a critical role in many applications. Having a GPS receiver on every sensor node is costly. In the past, a number of location discovery schemes have been proposed. Most of these schemes share a common feature: they use some special nodes, called beacon nodes, which are assumed to know their own locations (e.g., through GPS receivers or manual configuration). Other sensors discover their locations based on the information provided by these beacon nodes. [ABSTRACT FROM AUTHOR]

Sensors’ locations are critical to many wireless sensor network applications. In this chapter, we identified the vulnerabilities of current localization schemes for sensor networks in hostile environments where there are malicious attacks. To deal with such attacks, we proposed an attack-resistant MMSE-based location estimation and a voting-based location estimation technique. When beacon packets are authenticated and beacon nodes are uniquely identified, these techniques substantially improve the security and the robustness of location estimation in wireless sensor networks. We also developed a number of techniques to detect malicious beacon nodes that supply incorrect information for location discovery. Our experiences indicate that the proposed techniques are practical solutions for securing location discovery in wireless sensor networks. Our future research is two-fold. First, we will study alternative and potentially more efficient and effective ways for secure localization in wireless sensor networks. Second, we will study how to combine the proposed techniques with other protection mechanisms such as wormhole detection. [ABSTRACT FROM AUTHOR]

In this chapter, we presented several techniques to utilize sensor nodes’ prior deployment knowledge, post deployment knowledge, or group-based deployment knowledge to improve pairwise key establishment in static sensor networks. The analysis shows that when certain deployment knowledge is available, we can improve the performance of existing key pre-distribution techniques significantly. Several research directions are worth further study, including detailed performance evaluation through simulation and the implementation of these techniques on real sensor platforms. [ABSTRACT FROM AUTHOR]

In this chapter, we first developed a multi-level key chain scheme to efficiently distribute the key chain commitments for the broadcast authentication scheme named μTESLA. By using pre-determination and broadcast, our approach removed μTESLA’s requirement of a unicast-based distribution of initial key chain commitments, which introduces high communication overhead in large distributed sensor networks. We also proposed several techniques, including periodic broadcast of commitment distribution messages and random selection strategies, to improve the survivability of our scheme and defeat some DOS attacks. The resulting protocol, named multi-level μTESLA, satisfies several nice properties, including low overhead, tolerance of message loss, scalability to large networks, and resistance to replay attacks as well as DOS attacks. We then identified a number of new challenges in broadcast authentication for wireless sensor networks. Several practical tree-based broadcast authentication techniques were developed to support multiple senders, distribute parameters for μTESLA instances, and revoke the broadcast authentication capabilities of compromised senders in wireless sensor networks. Our analysis and experiment show that the tree-based techniques are efficient and practical and have better performance than previous approaches. Note that all the proposed schemes require loosely time synchronization, which may not be true in some applications. There are many mechanisms to disrupt the time synchronization method. Thus, it is particularly desirable to have alternative ways of authenticating broadcast messages without the assumption of time synchronization. [ABSTRACT FROM AUTHOR]

Intrusion alert correlation techniques correlate alerts into meaningful groups or attack scenarios for the ease to understand by human analysts. However, the performance of correlation is undermined by the imperfectness of intrusion detection techniques. Falsely correlated alerts can be misleading to analysis. This paper presents a practical technique to improve alert correlation by integrating alert correlation techniques with OS-level object dependency tracking. With the support of more detailed and precise information from OS-level event logs, higher accuracy in alert correlation can be achieved. The paper also discusses the application of such integration in improving the accuracy of hypotheses about possibly missed attacks while reducing the complexity of the hypothesizing process. A series of experiments are performed to evaluate the effectiveness of the methods, and the results demonstrate significant improvements on correlation results with the proposed techniques. [ABSTRACT FROM AUTHOR]