1. Intrusion Detection System for Wireless Sensor Networks ABSTRACT Wireless sensor networks (WSNs) consist a set of small sensor devices. These devices are deployed in an ad hoc fashion for sensing a physical phenomenon, and they are connected with each other through wireless communication channels. WSNs are ideal candidates for various applications such as target tracking in battlefield, patient monitoring in a hospital, environment monitoring as well as scientific exploration in dangerous environments. However, WSNs suffer from various attacks, such as jamming, flooding, hello flood attacks. In this project, we design an Intrusion Detection System (IDS) to detect various attacks on WSNs. We are implementing the proposed IDS using MoteIV sensor of Tmote Sky (MoteIV Corporation) and nesC computer language. BACKGROUND  Intrusion detection is the process of monitoring the events occurring in a computer system or network infrastructures and analyzing them for signs of intrusions.  Components of a Sensor  Applications of WSNs Students : Rahat Qureshi, Min K. Chang Advisor : Dr. Huirong Fu OBJECTIVE Design and implement a preliminary Intrusion Detection System for Wireless Sensor Networks METHODS/RESULTS For additional information please contact : Name : Rahat Qureshi, Min K. Chang, Advisor : Dr. Huirong Fu Institution : Oakland University, The Pennsylvania State University E-mail address : raquresh@oakland.edu, mkc5021@psu.eduraquresh@oakland.edumkc5021@psu.edu fu@oakland.edu SIBHI/UnCoRe 2007 METHODS/RESULTS Transport Layer An attacker forges messages carrying wrong sequence number to one or both endpoints Variables: # of Mis- Reassembles Decision: Whether Re-assemble is Correct and Whether mis- reassembles are exceeding the limit. Result: De-Synchronization Attack Detected. Application Layer An attacker captures one or more of these nodes and tries to send malicious messages through out the network. JTAG, Bootstrap Loader and External flash are some of the Node Capture attacks that can be performed on WSNs. Variables: Missing Node and source code changed or overwritten Microprocessor Decision: JTAG, Boot Strap or External Flash Attack Result: Node Capture Attack Detected Link Layer Happens during unusually late collision, such as a collision induced near the end of the frame. This could cause Exhaustion of battery resources in nearby nodes. Variables: Battery Sources are exhausting. Decision : Received many useless information from compromised nodes and exceeding the threshold? Result: If yes and battery exhausting then Exhaustion Attack detected. Physical Layer An adversary keeps sending useless radio signals making other nodes unable to communicate. Detection : we put radio frequency, counter, and timer as a variable and for threshold of RSSI value. Decision: Information is useless and nodes are unable to communicate? (Whether RSSI value > Threshold if yes and n>N) Result: Jamming Attack detected. Network & Routing Layer There are four types of attacks that an adversary can launch against localization. Variables: Beacon Nodes receive information and timing. Decision: Whether received information by the node about its address (which group it belongs to) is correct. Result: If address is not satisfied then it detects one of following attack : - Range-Change Attack - Multi-Impersonation Attack - Silence Attack - Impersonation Attack Figure 1. Detection of Jamming Attack Figure 2. Detection of Exhaustion AttackFigure 4. Detection of Node Capture Attack Figure 3. Detection of De-Synchronization Attack Figure 5. Detection of Localization Anomalies Attack CONCLUSIONS There are many different kinds of attacks in wireless sensor network. In this project, we study various attacks on WSNs, categorize these attacks into sub-systems, and design an intrusion detection system to detect various attacks on WSNs. In the future, we plan to implement and evaluate the proposed mechanisms.