Detection methods for wormhole attack in WSN

IJSRD - International Journal for Scientific Research & Development| Vol. 3, Issue 08, 2015 | ISSN (online): 2321-0613

Detection Methods for Wormhole Attack in WSN Dhaval N. Tandel1 Bhavin I. Shah2 1,2 Department of Computer Engineering 1,2 SVM Institute of Technology Bharuch 392-001, Gujarat, India Abstract— Wireless communication technique has become an important tool in any application that requires communication between one or more senders and multiple receivers. Security is becoming a major concern for this wireless communication. Wireless sensor networks consist of a large number of small sensor nodes that constantly monitors environmental conditions but due to the partial resources of the nodes and hostile & pervasive environments. so this kind of nature of wireless sensor networks make them very attractive to attacks at all network layers; however, the so-called “wormhole attack”.

In wormhole an attacker receives packets at one point in the network, “tunnels” them to another point in the network, and then replays them into the network from that point. In this paper, we will study wormhole attack and some of the methods for detecting of wormhole attack.

Key words: Wormhole Attack, WSN, Security, Localization, Authentication I. INTRODUCTION Wireless sensor network is low cost, easily and remotely developed network. In wireless sensor network there are thousands of sensor nodes collaborate with each other and transmit message and create successful communication.

WSN has infrastructure less architecture and WSN not require any pre existing architecture for communication.

Because this kind of characteristics WSN is used in many applications such as battlefield, surveillance, traffic monitoring, healthcare and environment monitoring etc.

Wireless sensor network hostile and open nature network so security is major concern in this network. WSN has many benefits but with some limitation such as limited computation resources, smaller memory capacity, limited battery life processing power & lack of tamper resistant packaging and open nature make WSN more Vulnerable against various types of external and internal attacks [1][2].

II. DIFFERENT ATTACKS ON WSN Here we introduce some attack that harm to group communication over wireless network and that categorize network layer wise [2].

Layer Attacks Denial of Service Physical Layer Tampering Jamming Data Link Layer Collision Traffic manipulation Sybil attack Sinkhole Network Layer Flooding Wormhole attack Resynchronization Transport Layer Packet injection attack Aggregation based attacks Application Layer Attacks on reliability

Table 1: Layer & Attacks Here we introduce some network layer attacks A. Sybil Attack: In Sybil attack one malicious node present itself with multiple spoofed identities with multiple MAC addresses and network address. That malicious node impersonates other nodes identity. Attacker or malicious node harm protocol layer with its fake identities attacker dropped or modify other selective packet [3].

B. Sinkhole Attack: Sinkhole attack is disrupts base station from obtaining the correct and complete routing data from the neighbor node.

In sinkhole attack attacker or malicious node tries to attract all or more traffic as possible as with advertising higher trust values and shortest distant values. Sinkhole attack triggering other type of attack like eavesdropping attack, selective forwarding attack, black hole attack, wormhole attack and also change the base station position [3].

C. Flooding Attack: Flooding attack is one kind of denial of service attack. In this attack malicious node send large number of packet or large number of request packet at the one point with the intention to stop services and disrupts communication and cause exhaustion of resources on victim point [3].

D. Wormhole Attack: In the wormhole attack one malicious node receive packets at one location in the network and tunnel them to another location where tunnel end here transferred packets pretend to destination node that they comes from neighbor source node but originally their source node is so far from the destination node [3].

E. Denial of Service Attack: In denial of service attack attacker main intension is exhaust the resource of victim node and makes service unavailable from its user. In this attack attacker send unnecessary extra packets to victim node and also sending thousands of request packets attacker confused the victim system and make service unavailable to its authorized user [5].

In this paper we introduce wormhole attack in detail and its prevention methods F. Wormhole Attack: Wormhole attack is one type of denial of service attack [4].

Which was effective on network layer this attack commonly launched by one or a pairs of collaborating nodes [4]. In a wormhole attack, an attacker receives packets at one point in the network, '''tunnels'' them to another point in the network via an out-of-band connection and replays them at another location in the network [22]. This attack confused and disrupted routing mechanism when routing control mechanism tunneled [2]. The tunnel created between two

All rights reserved by www.ijsrd.com

799

Detection Methods for Wormhole Attack in WSN (IJSRD/Vol. 3/Issue 08/2015/208)

colluding attacker nodes these attacker nodes called wormhole [2].

A. Wormhole using Out-of-Band Channel In this type of wormhole attack a malicious node has high transmission capability in and that malicious node attract packets to follow path passing from it [2].

B. Wormhole using Packet Relay In this type of wormhole attack high bandwidth channel placed between end point of wormhole attack link [4].

Fig. 1: Wormhole Attack [2] In above figure X and Y are two tunnel ends.

Attacker forward packets through this XY tunnel and A and B nodes believe that they are neighbors by forwarding routing messages [2].

III. WORMHOLE ATTACK MODEL Wormhole attack is one kind of denial of service attack that effects ignore cryptographic technique implemented on network and also not require any MAC protocol information so that attack is very difficult to detect [4].

Wormhole attack is classified in three model depends on attacker natures, packet forwarding behavior and their tendency to hide and show identities [2].

C. Wormhole using Protocol Distortions In this type of wormhole attack a malicious node try to attract network traffic through routing protocol distortion [2].

D. Wormhole using Packet Encapsulation In this type of attack data packet between malicious node are encapsulated so it prevent nodes on way from incrementing hop count. And the packet is converted its original form by second point of wormhole [2].

E. Wormhole using Packet Relay In this type of wormhole malicious node replay packets between two far nodes and these way fake neighbors are created [4].

Now we discussed about wormhole detection approach.

V. WORMHOLE DETECTION METHOD

Fig. 2: Representation of Open, Half-Open and Closed Wormhole [2] In wormhole attack in figure S and D are source and destination and M1, M2 are malicious nodes. A and B are intermediate node. Wormhole attack is classified in three types of model [2].

A. Open Wormhole In open wormhole attack source (S) and destination (D) and two malicious nodes (M1, M2) are visible but intermediate nodes A and B are kept hidden in open wormhole [2].

B. Half Open Wormhole In half open wormhole model only one malicious node M1 is visible other malicious node M2 is hidden and source send packet to destination from S-M1-D routing path. In half open wormhole attacker can’t modify the packet [2].

C. Close Wormhole In close wormhole model all malicious node and intermediate node are kept hidden so source and destination feel themselves just one hope away from each other [2].

IV. TYPES OF WORMHOLE ATTACK Here we classify wormhole attack based on the lunching techniques and number of nodes involved in establishing wormhole attack. Here we introduce several wormhole types.

A. Localization based method Junfeng Wu et al. [9] proposed label based DV-Hop localization method to tackle security problem of DV-Hop based localization method. Proposed method is classified in three phase first beacon node labeling in which the beacon nodes are differentiated and labeled according to their geographic relationship under a wormhole attack and second is sensor node labeling in which sensor node further differentiate and further labeled by result of neighboring node and third is DV-Hop-based secure localization in which all illegal connection are eliminated among the labeled neighbor nodes which are affected by wormhole attack. This proposed scheme proper work when network has no packet loss, and the transmission ranges of all nodes are identical in future we extent this secure scheme to tolerate packet loss and nodes have different transmission range.

Yanchao Niu et al. [8] define robust localization method which is called ConSetLoc for solution of error detection and reduce large errors in ranging measurements due to wormhole attack in existing scheme range free localization approach. In robust localization method with the hop-distance relationship which was evaluated from approximate recursive expression when sensor nodes randomly developed in circular region and also, author utilize convex constrains in geometry to partition consistent anchors set and propose a filtering strategy for sensors' candidate location in the ConSetLoc algorithm. This algorithm provides good localization in large number of sensor nods when wormhole attack exists in network.

B. Authentication based Faraz Idris Khan et al. [7] proposed Merkle tree based authentication to prevent wormhole attack In Merkle tree the security information is generated using a hash and stored

All rights reserved by www.ijsrd.com

800

Detection Methods for Wormhole Attack in WSN (IJSRD/Vol. 3/Issue 08/2015/208)

using a tree structure. The tree structure is mapped to Directed Acyclic Graph (DAG) based structure of Routing protocol for Low power and Lossy Networks (RPL).

Priyanka Singh Dabi et al. [6] define efficient authenticity based method for mitigation wormhole attack in these method properties like hop counts and response delay based authentication approach used. In this method proposed algorithm divided in five steps first every node calculate average hope count of new route entry and continuously update routing table then check which hope count lesser then normal average hope count because less hope count route has more chance to under wormhole attack so they calculate probability of the current route. for authentication signature based mechanism works as every node which forwards the RREP creates a signature of the packet data at the end of the packet so now when node receive RREP message ten check probability of attack and then apply signature. In future work we detect, isolate and prevent disruption wormhole attack by using other indicators to reduce the packet drop more effectively.

C. Timestamp based S.Sharmila et al. [13] proposed transmission time based detection method. This time based detection method detect wormhole link by calculating the time interval calculated between the route request and route reply of the successive nodes. In this method no use of any hardware for detection of wormhole attacks. This scheme is simulates in network simulator 2 and check the performance on the bases of its detection rate, energy consumption ,memory overhead etc. characteristics and compare it with Zaw Tun and Aung Htein Maw’s[15] existing wormhole detection method. That proposed scheme able to detect both hidden and exposed wormhole attack.

Ahmed Louazaniet al.[14] proprosed a formal model using Time Petri Net to formally evaluate a proposed solution for detecting wormhole attack in CL-MAC, a crosslayer MAC protocol developed at MAC layer for energy efficient and low latency in WSN. CL-MAC protocol is based on the RTT approach. In WSN using the round trip time (RTT) technique is presented. The detection is based on message’s RTT between successive nodes and their neighbor numbers. This proposed mechanism follows three phases: firstly, construct neighbor list for each node, secondly find the route between sources to destination node and finally finds the wormhole link location to make any necessary action. The time Petri nets (TPN) and is attractable by both their ability to model easily temporal constraints of the solution and the existence of a Time Net Analyzer (TiNA) software tool for properties verification.

installed in all sensor nodes and its runs all application independently and it is capable detection of intrusion locally and collect data itself from neighboring node agents and also when malicious node found IDS broadcast the alarm message in the network through this each node makes final decision based on the detection report of other nodes and it was help in avoiding drastic flooding over network. From LIDeA approach we not only able to know attack node but we also identify the source of attack. In future define specific detection rules for wormhole attack and demonstrate the validity of the proposed framework that may lead to autonomic behavior of the network itself.

Qin Li et al. [11] proposed energy efficient method.

In this method metric-based routing protocols are applied on WSN which was independent to data aggregation. In this method author also define parameter like potential which represent intensity of attraction of nodes and second gradient which describe the increase rate of potential one hope. This parameter enable for detection of suspect parent with overmuch high gradient. That method obliged neighborhood multi-cast, is proposed to help nodes exchange information under insecure environment and further find out a local potential maximum. Simulation of proposed scheme using gradient to detect malicious wormhole is effective. And the performance analysis also shows that the method is efficient in communication and computing resources.

TIAN Bin et al. [12] Proposed a novel approach for detect wormhole attack through the statically analysis. In this method first detect the fake neighbor which was created by wormhole attack using neighbor discovery information.

Then detection for hidden wormhole attack in WSN author define simple K-means clustering based method by using neighbor information without any special guard nodes or location information.

VI. CONCLUSION Wireless sensor network is collection of many collaborated sensor nodes. Due to its hostile and open nature WSN is more vulnerable from many types of attacks (black hole, wormhole attack, sinkhole attack etc.) so security is most important issue in WSN. Wireless sensor network is used in much sensitive and important application like military, health etc. so security is more important in wireless sensor network.

In this paper we introduce many types of attack. In many types of attack wormhole attack is more dangerous attack for network because it is very hard to detect. We discussed about a wormhole attack & its models and types.

Then define some detection approaches and survey of wormhole attack existing detection techniques and its advantages and limitations.

D. Neighbor information based Thanassis Giannetsos et al. [10] proposed lightweight intrusion detection system which called LIDeA for wireless A. Summary of various wormhole detection techniques sensor network. This Intrusion detection system agent Method used Author Year Advantages Limitation Memory cost and computation Junfeng Wu et 2010 all node transmission range identical cost is high Communication cost al.[9] also high.

Localization method Valid Locators Identification, SelfUnsecure when nodes have Honglong Chen et 2010 localization, Wormhole Attack different transmission range and al.[23] Detection multiple wormhole attack

All rights reserved by www.ijsrd.com

801

Detection Methods for Wormhole Attack in WSN (IJSRD/Vol. 3/Issue 08/2015/208)

Time based

Yanchao Niu et al.[8] Mariano GarcíaOtero et al.[16] Ahmed Louazani et al.[14] Soo-Young Shin et al.[18] Pushpendra Niranjan et al.[17] Jakob Eriksson et al.[19]

Authentication based

Neighbor information based

Faraz Idris Khan et al.[7] Priyanka Singh Dabi et al.[6] Capkun et al [20]

[2]

[3]

[4]

[5]

[6]

[7]

2012 2013 2012 2012

Good accuracy , stronger connectivity and better filtering ability, No need any hardware and predefine parameter energy efficient and low latency lowest total packet dropped, does not require additional hardware Get complete list of malicious nodes.

smallest localization error Shadowing effect a impact on performance and path losses hostile nature of the environment, Security problems encountered cannot be applied to real-time mobile ad hoc networks run for specified time

2006

not require any special hardware and clock synchronization, Compatible with most authentication methods

packets were buffered, overhead occurred

2013

authentication in a huge sized network

high jitter packets received from the transmitting source

2015

suited for robust network environment.

Packet drop.

2003

Qin Li et al.[11]

2008

Sejun Song et al.[21]

2012

Distance is estimated in transmissionrange not needed additional equipments such as GPS or directional antenna. not need global information and any special hardware devices, very low false positive rates

special hardware is needed. malicious nodes will be found out after the routing is over This approach (SWAN) works in only uniform network.

The smallest threshold value for black listing a node 2008 influence the performance of the isolating phase.

Table 2: Summary of various wormhole detection techniques [8] Yanchao Niu, Deyun Gao, Shuai Gao and Ping Chen; REFERENCES “A Robust Localization in Wireless Sensor Networks against Wormhole Attack” JOURNAL OF Guowei Wu, Xiaojie Chen1, Lin Yao, Youngjun Lee, NETWORKS, VOL. 7, NO. 1, JANUARY 2012. and Kangbin Yim, “An Efficient Wormhole Attack [9] Junfeng Wu, Honglong Chen, Wei Lou, Zhibo Wang, Detection Method in Wireless Sensor Networks” and Zhi Wang; “Label-Based DV-Hop Localization Computer Science and Information Systems AgainstWormhole Attacks in Wireless Sensor 11(3):1127–1141 2011.

Networks” Fifth IEEE International Conference on Priya Maidamwar and Nekita Chavhan; “A SURVEY Networking, Architecture, and Storage 2010.

ON SECURITY ISSUES TO DETECT WORMHOLE [10] Thanassis Giannetsos, Tassos Dimitriou, Neeli R. ATTACK IN WIRELESS SENSORNETWORK” Prasad; “State of the Art on Defenses against Wormhole International Journal on AdHoc Networking Systems Attacks in Wireless Sensor Networks” IEEE 2009.

(IJANS) Vol. 2, No. 4, October 2012.

[11] Qin Li, Qingkai Zeng; “Efficiently Detecting K.Venkatraman, J.Vijay Daniel, G.Murugaboopathi; Wormhole Attacks in Sensor Networks by Information “Various Attacks in Wireless Sensor Network: Survey” Potential” IEEE 2008.

International Journal of Soft Computing and [12] TIAN Bin, LI Qi, YANG Yi-xian, LI Dong and XIN Engineering (IJSCE) ISSN: 2231-2307, Volume-3, Yang; “A ranging based scheme for detecting the Issue-1, March 2013. wormhole attack in wireless sensor networks” The Dhara Buch and Devesh Jinwala; “PREVENTION OF Journal of China Universities of Posts and WORMHOLE ATTACK IN WIRELESS SENSOR Telecommunications 19(Suppl. 1): 6–10 June 2012.

NETWORK” International Journal of Network Security [13] S.Sharmila and G.Umamaheswari; “Transmission Time & Its Applications (IJNSA), Vol.3, No.5, Sep 2011. based Detection of Wormhole Attack in Wireless Kalpana Sharma and M K Ghose; “Wireless Sensor Sensor Networks” Special Issue of International Journal Networks: An Overview on its Security Threats” IJCA of Computer Applications (0975 – 8887) on Special Issue on “Mobile Ad-hoc Networks” MANETs, Information Processing and Remote Computing – 2010.

IPRC, August 2012.

Priyanka Singh Dabi, Khushboo Tunwal and Pankaj [14] Ahmed Louazani, Larbi Sekhri and Bouabdellah Sharma; “An Efficient Authenticity based Technique Kechar; “A Time Petri Net model for Wormhole Attack for Mitigating Wormhole Attack in WSN” International Detection in Wireless Sensor Networks” IEEE 2013.

Journal of Latest Trends in Engineering and [15] Zaw Tun and Aung Htein Maw,”Wormhole attack Technology (IJLTET) Vol. 5 Issue 3 May 2015. detection in Wireless sensor networks”, World Faraz Idris Khan, Taeshik Shon , Taekkyeun Lee, Academy of Science, Engineering and Technology, Kihyung Kim; “Wormhole Attack prevention vol.46, pp 545-550, 2008. mechanism for RPL based LLN network” IEEE 2013.

Wassim Znaidi et al.[22]

[1]

2012

false alarms decreases, not requiring clock synchronization

All rights reserved by www.ijsrd.com

802

Detection Methods for Wormhole Attack in WSN (IJSRD/Vol. 3/Issue 08/2015/208)

[16] Mariano García-Otero and Adrián PoblaciónHernández, “Detection of Wormhole Attacks in Wireless Sensor Networks Using Range-Free Localization”;IEEE 2012.

[17] Pushpendra Niranjan, Prashant Srivastava, Raj kumar Soni, Ram Pratap; “ Detection of WormholeAttack using Hop-count and Time delay Analysis”; International Journal of Scientific and Research Publications, Volume 2, Issue 4, April 2012.

[18] Soo-Young Shin, Eddy Hartono Halim; “Wormhole Attacks Detection in MANETs using Routes Redundancy and Time-based Hop Calculation”; IEEE 2012.

[19] Jakob Eriksson, Srikanth V. Krishnamurthy, Michalis Faloutsos; “TrueLink: A Practical Countermeasure to the Wormhole Attack in Wireless Networks”; IEEE 2006.

[20] Capkun S., Buttyan L. and Hubaux J. (2003), “SECTOR: Secure Tracking of Node Encounters in Multi-hop Wireless Networks”, In ACM Workshop on Security of Ad Hoc and Sensor Networks (ACM SASN), October 2003.

[21] Sejun Song, Haijie Wu and Baek-Young Choi; “Statistical Wormhole Detection for Mobile Sensor Networks” IEEE 2012.

[22] Wassim Znaidi, Marine Minier and Jean-Philippe Babau; “Detecting Wormhole Attacks in Wireless Networks Using Local Neighborhood Information”; IEEE 2008.

[23] Honglong Chen, Wei Lou, Xice Sun, and ZhiWang; “A Secure Localization Approach againstWormhole Attacks Using Distance Consistency”; EURASIP Journal onWireless Communications and NetworkingVolume 2010, Article ID 627039 2010.

All rights reserved by www.ijsrd.com

803