Traffic Analysis Through Spatial and Temporal Correlation: Threat and Countermeasure

Abstract

The base station (BS) in a Wireless Sensor Network (WSN) plays the role of a data sink, a point of contact with the upper hierarchy, and an in-situ command and control unit. Such an essential role makes the BS a target for attacks in a hostile environment. Even if its presence is camouflaged, an adversary may locate the BS by applying traffic analysis. Basically, the adversary can intercept radio transmissions and correlate them using techniques like Evidence theory (ET). The ET attack model only uses spatial aspects of intercepted transmissions in order to deduce knowledge about data routes. In this paper, we propose an enhanced version of ET (EET) which utilizes temporal correlation of transmissions to draw further valuable insight about the network topology. Analyzing ET and extending its capability are very fundamental for the network in order to avoid the illusive sense of security by guarding against a weaker attack model than what could be potentially launched. Moreover, we develop a novel and effective countermeasure, called Assisted Deception (AD) that needs no involvement of BS and is resilient to both ET and EET. By implementing AD, nodes coordinate and inject timed deceptive packets to target temporal correlation of consecutive transmissions that EET relies on. The attack and countermeasure are validated through extensive simulation experiments.

Energy-Aware Cross-Layer Technique for Countering Traffic Analysis Attacks on Wireless Sensor Network

“…It should be mentioned that the countermeasures aim to improve the BS anonymity. Using the Success Rate of an adversary's finding of the BS as a metric [44], [25], our experiments show that such a rate is 60%, 48% and 20%, for the baseline, RW and DFP, respectively. Thus, the 12% and 40% reductions achieved by RW and DFP come at a high price in terms of network lifetime.…”

“…Therefore, privacy and security in WSN has received a lot of attention from the research community [9], [10], [11], [12], [13], [14], [22], [26], [27], [28], [29], [30], [31], [41], [42], [43]. Particularly, concealing the role and location of BS is deemed to be more crucial [9], [44].…”

“…The adversary would prioritize locating and isolating, or physically damaging the BS to inflict the most impact on the WSN operation. A global and passive eavesdropper is assumed in this paper [44]. The adversary relies on deployment of multiple antennas across the area of interest to intercept all transmissions by three antennas or more.…”

“…2 reflects a node level analysis, i.e., the adversary locates the individual sensor nodes and correlates their transmissions using ET. In [44] it was shown that such node-level analysis is not practical given the uncertainty about the source position, e.g., due to limited localization accuracy. Hence, a more suitable approach for the adversary would be grid-level analysis, where the area is divided into cells.…”

“…All payloads and headers are assumed to be encrypted. The adversary is assumed to use an 8 × 8 grid, i.e., 64 cells, to conduct ET base traffic analysis [44].…”