ICAD: Indirect correlation based anomaly detection in dynamic WSNs

Anomaly detection is an essential functionality of Wireless Sensor Networks (WSNs) due to their complex behaviors and the wireless dynamics. In dynamic WSNs, many characteristics such as network topology, locations of sensor nodes, change frequently over time. We observe that indirect correlations among multiple attributes of a sensor node can be utilized to capture and model the historical behaviors. Prior studies overlooked indirect correlations while in this study we exploit it for detecting anomaly efficiently and accurately. Therefore, we propose ICAD, an indirect correlation based anomaly detection approach. By applying the Markov chain, the state transition probability matrix is calculated and it is subsequently used to detect anomalies. Compared to prior approaches, ICAD can detect different types of anomalies simultaneously. Furthermore, ICAD is implemented based on TinyOS and evaluated in a test-bed with 17 TelosB motes. Evaluation results show that ICAD has high detection accuracy with acceptable overhead.