Detection of Known and Unknown Intrusive Sensor Behavior in Critical Applications
Detection of Known and Unknown Intrusive Sensor Behavior in Critical Applications
复制标题
DOI：
10.1109/lsens.2017.2752719
复制
发表时间：
2017-09
影响因子：
2.8
通讯作者：
Safa Otoum;B. Kantarci;H. Mouftah
中科院分区：
文献类型：
--
作者：
Safa Otoum;B. Kantarci;H. Mouftah
本文提出了一种混合体系结构，以识别入侵行为之间的网络传感器，监测关键系统，如环境，医疗和智能电网。通过传感器进行监测对于诸如癫痫发作、污染、电力质量评估和Transformer监测的关键应用是期望的。无线传感器由于其低成本、灵活性和通信效率等优点而被广泛应用于关键应用中。然而，当传感器被联网以监控诸如智能电网的关键基础设施时，它们成为不同类型的攻击者的目标，诸如经由通信介质的入侵者。为了以安全的方式保持感测，需要鲁棒的架构来识别网络中传感器的侵入行为。在这篇文章中，我们提出了一个混合体系结构来检测入侵行为的传感器未知和已知的入侵者。前者需要异常检测，而后者需要签名检测。所提出的架构由两个子系统，合作检测未知和已知的攻击，通过占空比增强的基于密度的空间聚类的应用程序与噪声和随机森林的方法。通过对真实的入侵数据的各种测试，我们表明，所提出的架构具有很强的潜力，以检测已知和未知的入侵行为的传感器节点的结果显示99.73检测率与98.95的整体准确性。
This article presents a hybrid architecture to identify intrusive behavior among networked sensors that monitor critical systems such as environment, medical, and smart grid. Monitoring through sensors is desired for critical applications such as epilepsy seizures, pollution, power quality assessment, and transformer monitoring. Wireless sensors are being widely used in critical applications due to their advantages including low-cost, flexibility, and communication efficiency. However, when sensors are networked to monitor a critical infrastructure such as the smart grid, they become the target of different types of attackers such as intruders via the communication medium. In order to maintain sensing in a secure manner, robust architectures are needed to identify intrusive behavior of sensors in a network. In this article, we present a hybrid architecture to detect intrusive behavior of sensors for both unknown and known intruders. The former requires anomaly detection, whereas the latter requires signature detection. The proposed architecture consists of two subsystems that co-operate to detect unknown and known attacks through duty-cycling of enhanced density-based spatial clustering of applications with noise and random forest methods. Through various tests on real intrusion data, we show that the proposed architecture has a strong potential to detect both known and unknown intrusive behavior of sensor nodes as the results show 99.73 detection rate with 98.95 overall accuracy.