A Resource-Efficient System for Detection and Verification of Anomalies Using Mobile Agents in Wireless Sensor Networks

Abstract

Sensor readings are vulnerable to in situ and in transit anomalies. A well designed anomaly detection system should be able to identify the source of anomalies through in situ verification of suspicious behavior of sensor nodes. One approach for in situ verification is physical diagnosis of sensor nodes, which is a cumbersome and time-consuming task in medium-to-large-scale networks. Therefore, we propose a novel method for in situ verification of malicious sensor nodes using mobile agents. We employ Coordinated Resource Management mechanism-based observations to detect first-order anomalies and perform in situ verification. Since mobile agents cannot be frequently transmitted over the resource constrained Wireless Sensor Networks (WSN) due to the expensive nature of the communication operation as compared to the processing operation, we propose a method which exploits the historical information of anomalous behavior of the sensor node to optimize mobile agent transmission. The performance of the proposed system is investigated via simulations, experiments on MICAz mote, and comparative study. The results and analysis demonstrate the effectiveness and efficiency of the proposed system, in comparison with other existing schemes.

Mobile agent-based cross-layer anomaly detection in smart home sensor networks using fuzzy logic

“…Otherwise, the anomalous status of the node is reported to the corresponding 2 V type node. For further details of the in situ verification process, readers are referred to the previous studies [6], [7].…”

“…The sensor nodes and their transmitted data are, however, susceptible to in situ and in transit anomalies. A software mobile agent-based anomaly detection scheme in such situations not only detects anomalies in a smart home sensor network, but also offers an automated service to verify the source of anomalies, before notifying a user about the anomalies [6], [7]. The in situ verification of a sensor node, which is believed to be a malicious node after receiving an anomalous observation, is carried out by the mobile agent by comparing the values of the received data with the stored values on the node.…”

“…The proposed method decrements the trust value of a node if an observation from that node falls within the tolerance region, and the user will only be notified when the trust level falls below a predefined threshold. The mobile agent is transmitted for the in situ verification of the sensor node to verify the source of anomalies [6], [7], only if an observation falls in the anomalous region or the trust value reaches the lower bound. The soft boundaries between the tolerance and anomalous regions and the fuzzy logic-based rule-base are designed to detect cross-layer anomalies and to effectively transmit mobile agents.…”

Specification and Validation of Enhanced Mobile Agent-Enabled Anomaly Detection and Verification in Resource Constrained Networks

“…Over the years, the research community has employed mobile agents for different purposes such as interbase station control communication and randomly sampling the data over the network in the anomaly detection applications for Wireless Sensor Networks (WSNs) [7]- [9]. Previous works investigated the role of the mobile agents in performing the task of the in situ verification of the nodes in order to identify the source of the anomalies [10], [11]. The previous studies, however, have not analyzed the temporal behavior of the mobile agent-enabled anomaly detection schemes, which is an important factor for their effective postdeployment functionality [7]- [11].…”

“…Previous works investigated the role of the mobile agents in performing the task of the in situ verification of the nodes in order to identify the source of the anomalies [10], [11]. The previous studies, however, have not analyzed the temporal behavior of the mobile agent-enabled anomaly detection schemes, which is an important factor for their effective postdeployment functionality [7]- [11].…”