A central problem in sensor network security is that sensors are susceptible to physical capture attacks. Once a sensor is compromised, the adversary can easily launch clone attacks by replicating the compromised node, distributing the clones throughout the network, and starting a variety of insider attacks. Previous works against clone attacks suffer from either a high communication/storage overhead or a poor detection accuracy. In this paper, we propose a novel scheme for detecting clone attacks in sensor networks, which computes for each sensor a social fingerprint by extracting the neighborhood characteristics, and verifies the legitimacy of the originator for each message by checking the enclosed fingerprint. The fingerprint generation is based on the superimposed s-disjunct code, which incurs a very light communication and computation overhead. The fingerprint verification is conducted at both the base station and the neighboring sensors, which ensures a high detection probability. The security and performance analysis indicate that our algorithm can identify clone attacks with a high detection probability at the cost of a low computation/communication/storage overhead. To our best knowledge, our scheme is the first to provide realtime detection of clone attacks in an effective and efficient way.

A major challenge for learning Bayesian networks is the complexity in searching the huge space of models and parameters. The computational cost is higher when the model topology is more flexible. In this paper, we propose the notion of dominance which can lead to strong pruning of the search space and significant reduction of learning complexity, and apply this notion to the generalized latent class (GLC) models, a class of Bayesian networks for clustering categorical data. GLC models can address the local dependence problem in latent class analysis by assuming a very general graph structure. However, The flexible topology of GLC leads to large increase of the learning complexity. We first propose the concept of dominance and related theoretical results which is general for all Bayesian networks. Based on dominance, we propose an efficient learning algorithm for GLC. A core technique to prune dominated models is regularization, which can eliminate dominated models, leading to significant pruning of the search space. Significant improvements on the modeling quality and time complexity on real datasets are reported.

Key pre-distribution has been claimed to be the only viable approach for establishing shared keys between neighboring sensors after deployment for a typical sensor network. However, none of the proposed key pre-distribution schemes simultaneously achieves good performance in terms of scalability in network size, key-sharing probability between neighboring sensors, memory overhead for keying information storage, and resilience against node capture attacks. In this paper, we propose SBK, an in-situ self-configuring framework to bootstrap keys in large-scale sensor networks. SBK is fundamentally different compared to all key pre-distribution schemes. It requires no keying information pre-deployment. In SBK, sensors differentiate their roles as either service nodes or worker nodes after deployment. Service sensors construct key spaces, and distribute keying information in order for worker sensors to bootstrap pairwise keys. An improved scheme, iSBK, is also proposed to speed up the bootstrapping procedure. We conduct both theoretical analysis and simulation study to evaluate the performances of SBK and iSBK. To the best of our knowledge, SBK and iSBK are the only key establishment protocols that simultaneously achieve good performance in scalability, key-sharing probability, storage overhead, and resilience against node capture attacks.

Symmetric key agreement is significant to security provisioning in sensor networks with resource limitations. A number of pairwise key pre-distribution protocols have been proposed, but their scalability is often constrained by the conflict between the desired probability of sharing keys between neighboring nodes and the resilience against node capture attacks under a given budget for storing keying information within each sensor. In this paper, we propose LKE, a self-configuring in-situ key establishment scheme targeting large-scale sensor networks. LKE employs location information for a deterministic key space generation and keying information distribution. For uniformly distributed networks, LKE exhibits strong resilience against node capture attacks and achieves a high key-sharing probability (close to 1) at the expense of a small amount of memory overhead. An improvement over LKE, termed as iLKE, is also proposed. iLKE is topology-adaptive, and therefore works well for both uniform and non-uniform network models. We conduct both theoretic analysis and simulation study to evaluate the performances of LKE and iLKE.

Abstract — Though destructive to network functions, insider attackers are not detectable with only the classic cryptographybased techniques. Many mission-critic sensor network applications demand an effective, light, flexible algorithm for internal adversary identification with only localized information available. The insider attacker detection scheme proposed in this paper meets all the requirements by exploring the spatial correlation existent among the networking behaviors of sensors in close proximity. Our work is exploratory in that the proposed algorithm considers multiple attributes simultaneously in node behavior evaluation, with no requirement on a prior knowledge about normal/malicious sensor activities. Moreover, it is applicationfriendly, which employs original measurements from sensors and can be employed to monitor many aspects of sensor networking behaviors. Our algorithm is purely localized, fitting well to the large-scale sensor networks. Simulation results indicate that internal adversaries can be identifiedwithahighaccuracyand a low false alarm rate when as many as 25 % sensors are misbehaving. I.

This paper targets the identification of outlying sensors (that is, outlying reading sensors) and the detection of the reach of events in sensor networks. Typical applications include the detection of the transportation front line of some vegetation or animalcule's growth over a certain geographical region. We propose and analyze two novel algorithms for outlying sensor identification and event boundary detection. These algorithms are purely localized and, thus, scale well to large sensor networks. Their computational overhead is low, since only simple numerical operations are involved. Simulation results indicate that these algorithms can clearly detect the event boundary and can identify outlying sensors with a high accuracy and a low false alarm rate when as many as 20 percent sensors report outlying readings. Our work is exploratory in that the proposed algorithms can accept any kind of scalar values as inputs-a dramatic improvement over existing work, which takes only 0/1 decision predicates. Therefore, our algorithms are generic. They can be applied as long as "events" can be modeled by numerical numbers. Though designed for sensor networks, our algorithms can be applied to the outlier detection and regional data analysis in spatial data mining.

Wireless sensor networks (WSNs) are characterized by resource constraints and large scalability. Many applications of WSNs require secure communication, a crucial component especially in hostile environments. However, the low computational capability and small storage budget within sensors render many popular public-key-based cryptographic systems impractical. Symmetric key cryptography, on the other hand, is attractive due to its efficiency. Nevertheless, establishing a shared key for communicating parties is a challenging problem. In this paper, we propose and analyze an in situ PAirwise Key bootstrapping scheme (iPAK) for large-scale WSNs. Our theoretical analysis and simulation study demonstrate that iPAK can achieve a high key-sharing probability between neighboring sensors and a strong resilience against node-capture attacks at the cost of low storage overhead.

Due to its efficiency, symmetric key cryptography is very attractive in sensor networks. A number of key pre-distribution schemes have been proposed, but the scalability is often constrained by the unavailability of topology information before deployment and the limited storage budget within sensors. Recently, three in-situ key establishment schemes, SBK [13], LKE [14] and iPAK [15], have been proposed, which require no preloaded keying information but let sensors compute shared keys with their neighbors after deployment. We evaluate the three schemes through extensive simulation study and observe that they all have high scalability in network size. All of them can reach high connectivity in the key-sharing graph with low storage overhead. We also observe that SBK can fully satisfy the security requirements of large-scale sensor networks by simultaneously achieving good performance in terms of scalability, connectivity, storage overhead and resilience, while SBK outperforms LKE, LKE outperforms iPAK with respect to topology adaptability.

Due to its efficiency, symmetric key cryptography is very attractive in sensor networks. A number of pairwise key pre-distribution protocols have been proposed, but the scalability is often constrained by the conflict between the desired probability of sharing keys between two nodes and the resilience against node capture attack under a given storage capacity for key-related information within each sensor. In this paper, we propose LKE, a self-configuring scheme for location-aware key establishment that targets resource-constrained sensor networks. In LKE, location information is employed for a deterministic key space generation and keying information distribution. LKE exhibits "perfect" security in against node capture attack and achieves high connectivity (close to 1) in the induced key-sharing graph at the expense of a small amount of memory in worker sensors. LKE is a pure in-situ key establishment scheme, which scales well to very large sensor networks.

Symmetric key agreement is significant to security provisioning in sensor networks with resource limitations. A number of pairwise key pre-distribution protocols have been proposed, but the performance is often constrained by the unavailability of topology information before deployment and the limited storage budget within sensors. This paper proposes SBK, a self-configured scheme for bootstrapping keys in large-scale sensor networks. SBK is topology-adaptive, which requires no preloaded keying information but lets sensors compute shared keys with their neighbors after deployment. By removing the randomness inherent to key predistribution schemes, SBK achieves high connectivity (can be 100%) with small storage overhead. An improved scheme, iSBK, is also proposed to speed up the bootstrapping procedure. To the best of our knowledge, SBK and iSBK are the only pure in-situ key establishment protocols that simultaneously achieve good performance in scalability, connectivity, storage overhead, and resilience