A Technical Review of SID (Ship Intrusion Detection): With Wireless Sensor Networks by

H Luo, K Wu, Z Guo, L Gu, Z Yang (ICDCS June 20 24, 2011)

1. Paper Summary

The paper SID: Ship Intrusion Detection with Wireless Sensor Networks was presented at the 31st International Conference on Distributed Computing Systems on June 20 24, 2011.

The paper provides a novel Border Intrusion detection approach for harbor protection, border protection and security of commercial facilities located near the water. The paper presented provided the following information:

1. Introduction - which provides the novel detection approach to be used for intrusion detection at sea. The authors introduce the various threats (swimmers, divers, boats, ships) and the difficulty of detecting these threats using land based techniques (radars, satellites, magnetometers, thermal sensors, etc..) The propose a new approach using a wireless sensor network system with detectors stationed on buoys to measure ship generated waves. The authors used a three axis accelerometer sensors with an iMote2 detection network to capture and relay data. Using spatial and temporal correlations the the authors were able to exploit these characteristics in field trials to develop a detection algorithm. The algorithm is able to distinguish between ocean waves and ship generated waves. The authors also use correlation techniques across the sensor field to increase the reliability of detection and to minimize false positive alarms.

2. Preliminaries: The Ship Generated Wave - the authors provide a spatial analysis of

how ship waves are generated in patterns and can be analyzed. As the transverse ship waves decay their height can be calculated using the following formula:

The waves attenuate to background level as they move away from the sailing path, allowing them to calculate the ship wave:

Where V is speed of the ship where and = 35.27(1e12(Fd1)) and (Fd is the Froude number related to the traveling ship). The Froude number is defined as:

Where V is a characteristic velocity for the water wave and c a characteristic water wave propagation

velocity.

3. Distinguish Between Ship Generated Waves and Ocean Waves The authors

describe the equipment used to monitor waves:

Using an iMote 2 and buoy, and the wave measurements provided by the Accelerometer and the Fourier Transform of the Accelerometer measurements.

By focusing on the Z axis of the Accelerometer signal the authors were able to determine distinct signatures for ocean waves and ship waves. This distinction was accomplished by determining the spectrum of the ship waves using Wavelet analysis. In this analysis the wavelet transform breaks the ships accelerometer signal into a mother wavelet which can be scaled and shifted. The authors used the Morlet wavelet as the mother wavelet for the wave analysis application. Here c is the frequency of the mother wavelet.

The results of this analysis indicated that ship waves were mainly focused in the low frequency spectrum. It is this feature of ship waves that was used to implement the ship intrusion detection system.

4. The Architecture of the Intrusion Detection System - In this section the authors describe node level detection and cluster level classification used to validate and verify the detection of a ships signal. For each cluster deployed a local head node was assigned to manage the task of data fusion.

Some nodes are active to perform coarse detection while other nodes sleep until until some local event activates them to perform a more accurate detection. This assumes that the sensor density is high enough to support initial detection with a reduced number of sensors. Sink level detection is accomplished by processing data from the head nodes. The sinks determine which data crosses the detection threshold and should then be reported via satellite or other means. Long term surveillance power management services and other services are used for locating nodes, time synchronization, and routing infrastructure. Node Level detection ;each individual node periodically samples events (2-3 seconds) and processes the sampled data to extract features for detection if a ship is passing by. The nodes would sample for a set period and then filter frequencies greater than 1 Hz, to focus on ship signature low frequencies.

The total number of sampling points are averaged and a standard deviation is calculated. These values are adjusted over time to account fro changes in ocean waves creating a dynamic threshold value for comparison with the data collected. The total number of points which cross this threshold and their average energy within that time period are then calculated. Any anomaly frequency is determined when sensor is disturbed several times above threshold during the sampling period. Cluster Level Detection is used to validate and verify individual node detections. This avoids false positives by confirming that nearby nodes are also being disturbed and detecting ship movement .

Spatial and temporal correlations are calculated by validating the continuous disturbance of successive small areas. To do this the authors partitioned their network into cells and deployed time synchronization and localization algorithms to implement Cluster Level detection. A Correlation coefficient which measures the spatial and temporal correlations in a cluster is defined as follows:

if C is greater than a threshold the collected node data is considered to have a correlation. This correlation is reported to the cluster head and eventually to the sink.

The spatial and temporal data can also be used to calculate the ships velocity and direction through the cluster.

5. Performance Evaluation of node detection and cluster detection were performed using live data. Using M as a scaling factor for threshold detection,

As the anomaly frequency af increases for lower threshold measurements (indicative of individual node detection, the successful detection ratio tops at ~ 0.5. As the threshold increases along with the number of nodes detecting movement (indicative of cluster detection) the false alarms decreases significantly and as af increases so does the successful detection ration. This behavior is also confirmed by increases in the correlation coefficient C as a ship intrusion is detected.

Using controlled tests the authors were also able to confirm their accuracy of ship speed estimation +/- 20 % of actual ship speed.

6. Related Work, Conclusions, and Future Work - The authors conclude related work has been done in this area, but mostly for terrestrial wireless sensor networks and focused on movement of people, animals, or vehicles. There has been much less work done in waterside intrusion detection. The work that has been has focused on the use video systems and passive underwater acoustic sensors. The authors approach provides a novel approach for ship intrusion which exploits cooperative signal processing to exploit spatial and temporal correlations for detection. In the future they will focus adaptive threshold designs to deal with different types of weather and are looking at correlating node data with underwater acoustic sensors.

2. Technical Review

2.1. General Comments

The paper is generally well written, the authors are from Universities in China, so any grammatical mistakes can be attributed less than ideal technical writing support. The authors provide a good overview of the problem and their approach for SID is novel and provides useful information for detection and assessment in the water.

2.2. Areas for Further Investigation

iMote2 The authors discuss the iMote2 as their primary sensing and communications device but provide very little data on how the device is configured for use. In particular some discussion on how the three-axis accelerometer was integrated with sensor board might shed some interesting information on how the sensor is configured for this particular use. Also integration of the sensor with the buoy and how the buoys were prepared for use would have provided some useful context for how the overall sensor field was configured for use. Also since several nodes are required to confirm higher threshold signals, knowing the lower limit of how many sensors could still reliably detect and predict ship direction would be useful to know. Communications The authors did provide much detail on how communications was instantiated for detection system, other than the fact this is multi-hop system and the head node must be able to communicate with the nodes in its cluster. The radio setup, type, or frequency, were not discussed. While for an experiment this may not be necessary, some insight into how communications was established and monitored would provide a reader with a sense of the options available if the SID system were deployed commercially. Network Topology The authors appeared to have deployed a combined cluster star topology, with individual nodes in a cluster reporting to a head node which collects data for re-transmittal to a sink. The head node calculates af along with temporal and spatial correlations for affected nodes in the cluster if a ship is detected. Its not clear how many sensor nodes are deployed and how many head nodes are required to support their system. Power The power requirements for the system are nominally discussed. It appears that the iMote2 uses three AA batteries. Power management is discussed but not explained in any detail. Since SID depends heavily on cluster detection of ships moving in the area, this would probably affect the number of nodes which could be sleeping, especially if the time to wake them up is on the order of the ship moving through the area.

Security Since deployment of SID would be in a commercial environment, some discussion of network security, line monitoring, and ghosting and spoofing, would have been welcomed. Even in the preliminary stages of development, its useful to think ahead about how the system can be protected. From an operational point of view, some thoughts on Reliability, Availability, and Maintainability as measures of system Robustness would useful topics for updates as the system matures. Sensing Algorithm Here the authors did an outstanding job. They provided a significant amount of information on the development of their sensing algorithm and how they incorporated it into the sensing system. This type of waterside detection is fairly new and their approach appears to be both novel and affordable. Performance While performance measures for such a new system may be premature, there are ideas from the discipline of Physical Protection which could be applied to this system. Probability of Effectiveness (PE) = PI * PN Probability of Interruption (PI) - the likelihood of stopping the progress of an adversary Probability of Neutralization (PN) - the likelihood of rendering ineffective or stopping the actions of an adversary Probability of Assessed Detection (PAD) = PA * PD Probability of Assessment (PA) - the likelihood of assessing an adversary within the zone covered by an intrusion detection sensor Probability of Detection (PD) = PS * Pc - the likelihood of detecting an adversary within the zone covered by an intrusion detection sensor Probability of Communication (PC) - probability that an intrusion detection network will communicate an unauthorized action Probability of Sensing (PS) - probability that an intrusion detection sensor will sense an unauthorized action

= , and in most cases using WSN for detection, PE PI .

Works Cited

Authors last name, first name. Title of Book. City: Publisher, Year.

Authors last name, first name. Title of Article. Title of Publication Date Published: Pages.

Authors last name, first name. Title of Online Article. Title of Online Publication Version (Year

Published): Pages. Date Accessed .

Title of Article. Title of Media. CD-ROM. City: Publisher, Year.