Mobile Intelligence

26.9 CONCLUSIONS

In this chapter, we have modeled a distributed denial of service attack in wireless sensor networks and postulated a derivation of such attacks from other existing attacks in such networks. The attack is modeled as a set of threshold subpatterns from several regions of the network that need to be collated to reconstruct a holistic view of network traffic flow. A centralized approach toward the detection of such attacks based on self-organising maps is proposed. The SOM neural network is trained with patterns of network traffic, consisting of both attack and normal. Subsequently, the SOM application, running on the base station, clusters network traffic flow observations received from individual attack detector nodes of the network. The SOM-based approach is promising for detecting such attacks in environments, wherein constant network traffic is expected by individual target nodes. However, this approach does not hold in sensor networks, wherein, the activity of target nodes is expected to reduce with the passage of time, that is, diminishing energy resources.