Collaborative detection of traffic anomalies using first order Markov chains

The application of wireless sensor networks in safety-relevant scenarios often fails for reasons of security concerns. While some attacks may be prevented using cryptographic means, e.g., message authentication or encryption, preventing others, such as Denial of Service (DoS) with current technology is difficult. This paper proposes to detect DoS-related traffic anomalies using first order Markov chains. The approach allows to impose a strict limit on the number of states, thus avoiding state space explosion. It is shown that good detection results can be achieved - with more than 85% of the nodes achieving 3% false positive errors or less, in the worst case. Maximum false error rates can be drastically reduced using a simple collaboration scheme.