Detecting anomaly node behavior in wireless sensor networks

Wireless sensor networks are usually deployed in a way "once deployed, never changed". The actions of sensor nodes are either pre-scheduled inside chips or triggered to respond outside events in the predefined way. This relatively predictable working flow make it easy to build accurate node profiles and detect any violation of normal profiles. In this paper, traffic patterns observed are used to model node behavior in wireless sensor networks. Firstly, selected traffic related features are used to translate observed packets into different events. Following this, unique patterns based on the arriving order of different packet events are extracted to form the normal profile for each sensor node during the profile learning stage. Finally, real time anomaly detection can be achieved based on the profile matching.