Distributed Detection of Node Replication Attacks in Sensor Networks

TLDR

Low‑cost, off‑the‑shelf sensor‑network nodes are vulnerable to capture and replication, enabling attackers to insert replicas that can corrupt data or disconnect parts of the network, yet existing detection schemes rely on centralized or neighborhood voting mechanisms that miss distributed replications. The study aims to overcome the shortcomings of existing node‑replication detection by proposing two emergent‑property‑based algorithms. The algorithms use randomized multicast and line‑selected multicast to disseminate node location information and detect replicas via the birthday paradox and network topology. Both algorithms achieve globally aware, distributed detection, with line‑selected multicast showing particularly strong performance, and the results suggest emergent algorithms are promising for other networks vulnerable to node capture and replication.

Abstract

The low-cost, off-the-shelf hardware components in unshielded sensor-network nodes leave them vulnerable to compromise. With little effort, an adversary may capture nodes, analyze and replicate them, and surreptitiously insert these replicas at strategic locations within the network. Such attacks may have severe consequences; they may allow the adversary to corrupt network data or even disconnect significant parts of the network. Previous node replication detection schemes depend primarily on centralized mechanisms with single points of failure, or on neighborhood voting protocols that fail to detect distributed replications. To address these fundamental limitations, we propose two new algorithms based on emergent properties (Gligor (2004)), i.e., properties that arise only through the collective action of multiple nodes. Randomized multicast distributes node location information to randomly-selected witnesses, exploiting the birthday paradox to detect replicated nodes, while line-selected multicast uses the topology of the network to detect replication. Both algorithms provide globally-aware, distributed node-replica detection, and line-selected multicast displays particularly strong performance characteristics. We show that emergent algorithms represent a promising new approach to sensor network security; moreover, our results naturally extend to other classes of networks in which nodes can be captured, replicated and re-inserted by an adversary.