Clustered Adaptive Rate Limiting: Defeating Denial-of-Sleep Attacks in Wireless Sensor Networks

The potential for wide-spread use of wireless sensor networks (WSN) in military monitoring, homeland security, and other areas continues to expand. There are, however, security concerns that must be addressed before this potential is realized. One threat to WSNs is the denial-of-sleep attack, a particular type of denial-of-service attack that rapidly drains sensor node batteries by keeping radios active when they should be sleeping to conserve energy. Simple denial-of-sleep attacks involving unauthenticated or replayed packets are difficult to distinguish from bursty data and can force network devices to incorrectly remain in receive mode. This research introduces Clustered Adaptive Rate Limiting, or CARL, a rate limiting approach based on current host-based intrusion detection techniques that is designed to defeat denial-of-sleep attacks. We use simulation to examine tradeoffs and to demonstrate the potential benefits of the CARL mechanism. Providing support for adaptive rate-limiting at the MAC layer, especially in networks that might encounter bursty data, is essential if WSN are to achieve their full potential for mission-critical applications.