無線感測網路中以統計學習模型為基礎之異常行為偵測

Abstract

在無線感測網路中，傳統偵測節點異常行為的方法往往需要額外的監控節點來進行監控的動作。這些方法也需要比較冗長的訓練時間來完成對節點建立正常行為模型的動作，根據所建立的行為模型，當有節點行為偏離該行為模型則被認為是異常的行為。這樣的偵測方式通常使用預設的臨界值來辨別異常的活動產生。然而，節點的行為可能會隨著時間的不同而進行改變，所以一個預先設定好的臨界值往往沒辦法精確的分辨網路異常的狀況。在本篇論文中，我們提出一個臨界值設定的方法，該方法藉由結合灰色預測模型及馬可夫模型來建立節點正常行為的模型。除此之外，若節點行為發生改變，該方法可以動態的改變臨界值來適應節點行為的改變。本方法可以容易的使用在無線感測網路中，而不需要額外的監控節點。根據實驗顯示，本方法可以精確而有效的找出無線感測網路中的異常行為。

Conventional anomaly detection schemes for WSNs require special detection nodes to monitor node behaviors. These schemes also need long training time to model sensor node behaviors and construct node profiles. When a node deviates from its node behavior profile, it is considered as anomaly. In this type of schemes, it is common to use a predetermined threshold to differentiate anomalous activities. However, node behavior may vary over time, and therefore a fixed threshold may not be able to accurately differentiate anomalies. In this paper, we propose a threshold estimation method which combines the Grey Prediction Model and Markov Residual Error Model to model normal node behaviors, and can dynamically adjust the threshold to adapt to the changing behavior of WSNs. Our approach can be easily used in a WSN without the need for special detection nodes. As the experimental results showed, our proposed method can detect anomalous WSN behaviors in a more accurate and effective way than conventional schemes.