Intrusion detection of sinkhole attacks in large-scale wireless sensor networks

In wireless sensor networks, an adversary may deploy malicious nodes into the network and launch various attacks. These nodes are collectively called compromised nodes. In this paper, we first analyze the unique features of wireless sensor networks and discuss the challenges for compromised nodes detection. Then we propose a novel algorithm for detecting sinkhole attacks for large-scale wireless sensor networks. We formulate the detection problem as a change-point detection problem. Specifically, we monitor the CPU usage of each sensor node and analyze the consistency of the CPU usage. Thus, the proposed algorithm is able to differentiate between the malicious and the legitimate nodes. Extensive simulations have been conducted to verify the effectiveness of the algorithm.