Evaluating the Feasibility of Traffic-Based Intrusion Detection in an 802.15.4 Sensor Cluster

We investigate the feasibility of a simple, traffic volume-based intrusion detection for an IEEE 802.15.4 compliant sensor cluster operating in beacon-enabled, slotted CSMA-CA mode. We have used simple exponential averaging to filter out some of the inherent variability in individual device arrival rate, and introduced a small hysteresis in the decision process in order to avoid false alarms due to dithering. Initial results demonstrate that the intrusion detection implemented in this manner may indeed operate quickly and efficiently.