PUE attack detection in CWSNs using anomaly detection techniques

One of the fastest growing sectors in recent years has undoubtedly been that of wireless sensor networks (WSNs). WSNs consist of spatially distributed autonomous sensors that monitor a wide range of ambient conditions and cooperate to share data across the network. WSNs are increasingly being introduced into our daily lives. Potential fields of applications can be found, ranging from the military to home control commercially or industrially, to name a few. The emergence of new wireless technologies such as Zigbee and IEEE 802.15.4 has enabled the development of interoperable commercial products, which is important for ensuring scalability and low cost. Most WSN solutions operate on unlicensed frequency bands. In general, they use industrial, scientific, and medical (ISM) bands, like the worldwide available 2.4-GHz band. This band is also used by a large number of popular wireless applications, for example, those working over Wi-Fi or Bluetooth. Thus, the unlicensed spectrum bands are becoming overcrowded. As a result, coexistence issues on unlicensed bands have been the subject of extensive research, and in particular, it has been shown that IEEE 802.11 networks can significantly degrade the performance of Zigbee/802.15.4 networks when operating on overlapping frequency bands [1].

The increasing demand for wireless communication presents a challenge to have an efficient spectrum use. To address this challenge, cognitive radio (CR), which enables opportunistic access to the spectrum, has emerged as the key technology. A CR is an intelligent wireless communication system, aware of its surrounding environment, and it adapts its internal parameters to achieve reliable and efficient communications. These new networks have many applications, such as the cognitive use of the TV white space spectrum or making secure calls in emergency situations. In order to create these new applications, CR differentiates between two kinds of users: primary users (PUs), those who are licensed users, and secondary users (SUs), those who try to use the same bands when they detect a spectral hole. Adding cognition to the existing WSN infrastructure brings about a lot of benefits. However, not only will it provide access to new spectrum bands but it will also provide better propagation characteristics. By adaptively changing system parameters like modulation schemes, transmit power, carrier frequency, and constellation size, a wide variety of data rates can be achieved. This will certainly improve the power consumption, network life, and reliability of a WSN.

The nature of large, dynamic, adaptive, cognitive wireless sensor networks presents significant security scheme design challenges. A cognitive wireless sensor network has many constraints and many different features as compared to traditional WSNs. While security challenges have been widely tackled with regard to traditional networks, it is a novel area in cognitive wireless sensor networks. The wireless medium is inherently less secure than the wired one because its broadcast nature makes eavesdropping easier. Any transmission can be easily intercepted, altered, or replayed by an adversary. The wireless medium allows an attacker to easily intercept valid packets and inject malicious ones. Cognitive features enable dynamic reconfiguration to avoid these attacks. However, malicious nodes can use dynamic reconfiguration to create new attacks such as primary user emulation (PUE). PUE is an attack where a malicious node emulates the behavior of an incumbent node with the purpose of using the radio spectrum for its own interest or denying the access to other nodes.

To avoid these attacks, several approaches have been developed, most of them based on location. However, other cognitive features such as collaboration and learning have not been sufficiently exploited. We need to take into account that most WSNs have been developed in order to carry out a specific application. As a result, nodes usually have their own behavior pattern. This characteristic gives the network an opportunity to create a node profile for each sensor. These profiles can be created and optimized, thanks to cognitive features such as spectrum awareness, learning, and collaboration. In this paper, simulations show how collaboration is essential for improving detection. Moreover, collaboration is the parameter that contributes most efficiently. The node profiles are used to detect anomalies in behavior, an example of which are PUE attacks.

The organization of this paper is as follows: In Section 2, works done on security for dealing with PUE attacks are reviewed. In Section 3, a brief introduction to the main topics related to behavior learning and security is provided. Then, in Section 4, the assumptions taken into account for the simulations are specified. Section 5 explains the general architecture of the system, while Sections 6 and 7 provide its evaluation. Finally, the conclusions are drawn in Section 8.

According to Section 1, it is very clear that CWSNs face the dangerous problem of security. Several attacks could be adapted from WSNs to the new paradigm of cognitive networks. Over the past 10 years, some approaches related to security on cognitive radio networks have appeared. They describe specific attacks against these networks, but few countermeasures have been proposed.

Most studies on security are focused on PUE detection. Given the origin of cognitive radio networks, the efficient use of TV spectrum in the USA, early studies used location in order to detect malicious attacks. In this case, PUs are TV towers with a precise behavior and location.

In [2], Chen and Park present the first method for detecting a PUE attack based on location. The idea of this method is to differentiate the attacker from a licensed user by comparing the transmission origin with the previously known PU position. The same authors use a mechanism based on location in [3]. Moreover, they include some new parameters, such as signal power or RF fingerprints, to decide the nature of the signal.

In [4], the authors assume that the attacker is close to the victim, and the real PU is much farther from the SUs than the attacker. Moreover, the position of each node, including the attacker, is fixed. Given this assumption, SUs can learn about the characteristics of the spectrum according to the received power. The authors in [5] follow a similar approach. Despite not using any location information, they assume a static scenario with the PU much farther away from other possible malicious nodes than the SUs.

More location-based countermeasures can be found in [6] and [7]. In the first work, secondary users calculate the estimated position of the PUE attacker and then propagate this knowledge to reach a coordinate decision. The second work is focused on the algorithm used to detect the position of the PUE attacker.

All these countermeasures are based only on location. This characteristic cannot be used in some CWSN scenarios where both SUs and PUs can be mobile. Therefore, it is very clear that another approach should be adopted.

A few different solutions, not based on location, have been presented. In [8], the authors use the phase noise of a local oscillator as a fingerprint to differentiate the incumbent signals from the attacking ones.

Finally, in [9], the authors present a differential game approach to mitigate the PUE attack. Based on the assumption that the PUE attacker has less energy than the PUs, they look for the optimal sensing strategy for SUs. The Nash equilibrium solution is obtained.

Despite the fact that these two last approaches are valid for mobile PUE attackers in CWSN, the algorithms implemented require relatively high computational resources, which is an impossible requirement for some WSNs.

In this paper, a solution based on the use of node behavior is presented. Two effective and also simple algorithms have been implemented: cumulative sum and data clustering.

As geolocation countermeasures do, defenses based on behavior try to model the PUs. The model is used to look for the differences between PUs and attackers. For example, in [6], authors use some radio parameters to decide if the transmitter is an incumbent transmitter or an attacker. These parameters are transmitted power and location. For a typical TV scenario on CR, the PU model can be very precise. However, as with geolocation countermeasures, the previous studies do not work with CWSNs. Unfortunately, a model for PUs on CWSNs does not exist yet. PUs are usually more unpredictable than in previous scenarios. Moreover, the PU’s behavior can be very different depending on the application. However, if we focus on limited scenarios, for example, ambient intelligence in a home or a building, the PU is specifically defined. Parameters like power transmission, spectrum time occupancy, and transmission frequency could be modeled.

Learned behaviors of these parameters allow the system to create some profiles that are then compared with periodically acquired measures. It is easy to understand that when a PUE attack happens, an anomaly in the learned parameters can be detected. The intrinsic goals of an attacker make it impossible to have a complete likeness between a PU and a PUE attacker. For example, if the goal of a PUE attack is to use a whole frequency band, it needs to transmit more frequently, with more power and different types of packets than those of a normal PU.

In [10], the authors use packet traffic to model sensor behavior. Packet train size and packet train length, inter-packet times, and payload size are used to characterize the packet traffic. They apply these profiles to detect anomalies, such as sinkhole attacks.

In [11], another approach is used to monitor the node’s behavior. In this work, a group of capable nodes form the attack detection system (ADS). These nodes analyze the packets transmitted among their neighbors. The reason for limiting the ADS to only a few nodes is that a continuously monitoring node consumes much more energy than a normal one. Along the same lines, in [12], some monitor nodes sniff the communications in order to detect anomalies. They base their decisions on some principles of WSNs such as message symmetry or node similarity.

Finally, in [13], the nodes create neighbor profiles according to the sequence of received packets. The attack is detected using the distance between sequences. The distance is calculated by the number of differences between them.

In conclusion, the previous works use traffic monitoring to create a behavior model of the network. In this work, we can use other parameters such as power transmission or time between packets to detect behavior anomalies in CWSNs. To the best of our knowledge, this is the first time that the anomaly detection approach is applied for PUE attacks on CWSNs. Other cognitive features such as spectrum sensing and learning make it possible to implement the algorithms. The advantage of these parameters is that they can be applied to more flexible networks or independently of the application. Another advantage over the previous works is the use of collaboration between nodes. The final decision in the detection of anomalies is collaborative. The more nodes collaborating on the decisions, the better are the PUE detection results.

In our model, a CWSN consists of a set S=s 1,s 2,…,s n of n cognitive wireless sensor nodes with different roles. Each node has a certain transmission range. Their location and their radio parameters are unknown. However, we assume that the nodes have a stationary behavior that allows learning based on spectrum sensing.

We assume a different behavior for the SUs and PUs in CWSNs because of the nature of these networks. For example, CWSNs usually operate on ISM bands, where anyone can transmit without a license. Because of this feature, the definition of PUs and SUs should be different. For this CWSN definition, the differences between PUs and SUs are based on the priority of their functionality. For example, a fire sensor would have more priority than a temperature sensor. While PUs take preference because they are responsible for critical sensors and information, SUs only send the information when the channel is free. In a common CWSN, the number of nodes can usually vary between 5 and 200. For our study, we assume that networks with more than 200 nodes are not common.

In our scenario, spectrum sensing is carried out by multiple wireless modules contained in all the network nodes. More specifically, these interfaces work on the ISM bands (2.4 GHz, 868 MHz, and 433 MHz). All of them can extract information from the environment: received signal power, noise power, or time between packets. The information is processed, stored, and shared according to the implemented algorithm. We further assume the existence of a virtual control channel (VCC) for sharing this information, with no extra overhead over regular cognitive communications.

As we explain in Section 3, we assume that regardless of the kind of PUE attack, the malicious node has to change its behavior. If the attacker is a selfish PUE, the malicious node has to change its power transmission or transmission rate in order to acquire more spectrum time. In this case, the SUs receive new information that changes the perception of the spectrum usage. In the other case, if the attacker is a malicious PUE, the attacker node has to change the behavior in order to affect the transmission of the SUs. An example of this situation is a home security sensor network where a malicious PU is captured and used to attack the network. If it tries to perturb the correct behavior of the network, it should change the radio parameters to interfere with PUs and SUs. If the attacker continues to have the same behavior since the creation of the network and if it uses exactly the same radio parameters, attack detection becomes almost impossible using either behavior learning or any other method. Moreover, in this situation, the network behavior is not affected, so the attack has no effect.

The system architecture presented uses collaboration in order to achieve the anomaly detection goal. Its main characteristics are distributed learning and collaboration on final decisions.

Figures 7 and 8 represent the results for multiple scenarios with a variable learning time. As we can see, the CUSUM algorithm obtains bad results for any simulated learning time between 10 and 60 s. As the previous section showed, the CUSUM algorithm obtains good results from 100 s onward. Meanwhile, the data clustering approach starts to obtain good results from 30 s onward. This indicates that the data clustering approach is best suited for dynamic networks in which the learning time can be a critical feature.

Detection time is another important characteristic. This is the interval between the beginning of the attack and the warning emission. Here, the simplicity of the CUSUM algorithm makes it faster. The time needed to detect the anomaly is between 0.5 and 1 s. However, the data clustering algorithm takes from 3 to 5 s. The results presented here do not include the delay for the collaboration. However, this delay can be ignored if we take into account two factors: the ideal implementation of the VCC channel and the redundancy of the WSNs. In these simulations, more than 50 nodes are presented in a small area of 30 m×30 m. This indicates that each sensor detects almost the same packets and, for instance, they transmit the same alarms at a similar time. However, collaboration continues being necessary in order to eliminate misleading data.

In order to prove the smooth operation of the system on larger networks, we have simulated a new scenario with 200 nodes. Figure 9 shows the results for the CUSUM algorithm. If the percentage of collaborating nodes is the same, the system still differentiates the PUE attack in almost every simulation, but the results become slightly worse. This is because more nodes in the same scenario space can produce more anomalies such as collisions, interference, higher noise level, or retransmissions.

The main difference in the data clustering scenario is the independence of the results from the number of collaborating nodes (Figure 10). The false positives rate is under 2% for most setups.

The comparison between CUSUM and data clustering in terms of resources is very clear. In this case, the CUSUM approach needs less memory and computational resources. It saves just one table with only five parameters that represent the transmissions of each node. However, the data clustering algorithm needs the same table and an additional one with the cluster information. Each row in the table represents a cluster with its centroid, its radius, and the number of nodes inside it. The learning and detecting stages also need more computational resources in order to implement the algorithm. For these reasons, the CUSUM algorithm is recommended for power saving applications or extremely simple nodes.

Finally, as a general conclusion, the CUSUM algorithm performance considerably depends on the simulated scenario and the parameters applied to it, such as learning time and number of attackers. However, the clustering approach maintains a good stable performance in most scenarios. Therefore, if the limitations or requirements in terms of resources are not critical, the data clustering algorithm is recommended.

In this article, a new approach for detecting PUE attacks on CWSNs has been described based on anomaly detection and cognitive features such as sensing, learning, and collaboration. A cognitive simulator has been used to develop the scenarios that prove that collaboration is essential for a good anomaly detection. The results have been presented in the figures shown in Section 6.

Different layers of the cognitive architecture implement the tasks needed to achieve the final objective: PUE attack detection. Cognitive nodes sense the spectrum and create neighbor profiles in order to model their behavior. The information stored on the repository module is used to warn other nodes about anomalous data. The optimizer module is responsible for filtering the information and collaborating with other nodes.

If the collaborative nodes are over 20% of the total, the PUE attack detection has satisfactory results, with 99% of attacks being detected and a false positive rate near 0%, independently of the number of nodes in the scenario.

Two algorithms have been implemented in the CWSN. CUSUM is the simplest one, using less resources. However, data clustering is more suitable for dynamic or complex scenarios. Both have demonstrated to be valid in order to detect the PUE attack anomalies.