Intrusion Detection in Wireless Sensor Networks

Christophe.VanGinneken@student.kuleuven.be

Classic Network IDS

activate tcp any any -> 192.168.1.21 22 \! (content:"/bin/sh"; activates:1; \ ! msg:"Possible SSH buffer overflow"; )!dynamic tcp any any -> 192.168.1.21 22 \! (activated_by:1; count:100;)

Wireless Sensor Network IDS

software attestation

reputationoutliers

machine learning

cooperative

anomalies

patterns

reputation

reputation anomaly

routing table updates

collision rate

RTS arrival rate

average waiting time

reputation anomaly pattern

reputation anomaly pattern

actual application

reputation anomaly pattern

Step1: Extract a framework with an API

reputation anomaly pattern

Step2: Reduce algorithmic “inefficiencies”.

loopsvariables reuse of memory

no type-checking repetitive

checking

Goal 1:!Investigate possibility to define such a framework.

Goal 2:!Implement it and quantify gain or minimal cost.