Search

Due to limited computational power and energy resources, aggregation of data from multiple sensor nodes done at the aggregating node is usually accomplished by simple methods such as averaging. However such aggregation is known to be highly vulnerable to node compromising attacks. Since WSN are usually unattended and without tamper resistant hardware, they are highly susceptible to such attacks. Thus, ascertaining trustworthiness of data and reputation of sensor nodes is crucial for WSN. As the performance of very low power processors dramatically improves, future aggregator nodes will be capable of performing more sophisticated data aggregation algorithms, thus making WSN less vulnerable. Iterative filtering algorithms hold great promise for such a purpose. Such algorithms simultaneously aggregate data from multiple sources and provide trust assessment of these sources, usually in a form of corresponding weight factors assigned to data provided by each source. In this paper we demonstrate that several existing iterative filtering algorithms, while significantly more robust against collusion attacks than the simple averaging methods, are nevertheless susceptive to a novel sophisticated collusion attack we introduce. To address this security issue, we propose an improvement for iterative filtering techniques by providing an initial approximation for such algorithms which makes them not only collusion robust, but also more accurate and faster converging.

Trust and reputation systems are widely employed in distributed systems, such as sensor networks, to assess the trustworthiness of sources and provide a robust data aggregation. However, some sophisticated attacks, such as node compromise attacks, still can distort computed trust scores, lead to low quality or deceptive services, and undermine users’ confidence. Although fault detection and tolerance problems have been widely studied in trust-based data aggregation systems, taking into account collusion attacks is still a challenging problem.In this dissertation we design and develop data aggregation schemes which leverage a novel trust computation method, robust in the presence of faults and malicious attacks. To this end, we focus on iterative filtering algorithms due to the fact that these algorithms simultaneously aggregate data from multiple sources and provide trust assessment of these sources. We first demonstrate that several iterative algorithms while significantly more robust against node compromise attacks than the simple averaging methods, are nevertheless susceptible to our novel collusion attack. To address this security issue, we propose an improvement for these algorithms which makes them not only collusion robust, but also more accurate and faster converging. We also propose a novel, local, collaborative trust framework, called CrPr, based on an introduced concept of credibility propagation. Furthermore, we augment the proposed trust framework with a novel node compromise detection and revocation method which leverages the error behaviour of the nodes to classify them into benign and compromised nodes. Moreover, given that the original CrPr algorithm may not be efficient for streaming data, we propose an extension to the algorithm, called Str-CrPr which can compute the results in real time.Finally, we propose a novel network security risk assessment which leverages two concepts: (1) an interdependency relationship among the risk scores of network fl

Detection of high risk network flows and high risk hosts is becoming ever more important and more challenging. In order to selectively apply deep packet inspection (DPI) one has to isolate in real time high risk network activities within a huge number of monitored network flows. To help address this problem, we propose an iterative methodology for a simultaneous assessment of risk scores for both hosts and network flows. The proposed approach measures the risk scores of hosts and flows in an interdependent manner; thus, the risk score of a flow influences the risk score of its source and destination hosts, and also the risk score of a host is evaluated by taking into account the risk scores of flows initiated by or terminated at the host. Our experimental results show that such an approach not only effective in detecting high risk hosts and flows but, when deployed in high throughput networks, is also more efficient than PageRank based algorithms.