Secure Data Aggregation Technique for Wireless Sensor Networks in the Presence of Collusion Attacks

Transcription

1 Purdue Universiy Purdue e-pubs Cyber Cener Publicaions Cyber Cener Secure Daa Aggregaion Technique for Wireless Sensor Neworks in he Presence of Collusion Aacks Mohsen Rezvani Universiy of New Souh Wales, Aleksandar Ignjaovic Universiy of New Souh Wales, Sanjay Jha Universiy of New Souh Wales, Elisa Berino Purdue Universiy, Follow his and addiional works a: hp://docs.lib.purdue.edu/ccpubs Par of he Engineering Commons, Life Sciences Commons, Medicine and Healh Sciences Commons, and he Physical Sciences and Mahemaics Commons Rezvani, Mohsen; Ignjaovic, Aleksandar; Jha, Sanjay; and Berino, Elisa, "Secure Daa Aggregaion Technique for Wireless Sensor Neworks in he Presence of Collusion Aacks" (2015). Cyber Cener Publicaions. Paper 640. hp://dx.doi.org/ /tdsc This documen has been made available hrough Purdue e-pubs, a service of he Purdue Universiy Libraries. Please conac epubs@purdue.edu for addiional informaion.

2 98 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 12, NO. 1, JANUARY/FEBRUARY 2015 Secure Daa Aggregaion Technique for Wireless Sensor Neworks in he Presence of Collusion Aacks Mohsen Rezvani, Suden Member, IEEE, Aleksandar Ignjaovic, Elisa Berino, Fellow, IEEE, and Sanjay Jha, Senior Member, IEEE Absrac Due o limied compuaional power and energy resources, aggregaion of daa from muliple sensor nodes done a he aggregaing node is usually accomplished by simple mehods such as averaging. However such aggregaion is known o be highly vulnerable o node compromising aacks. Since WSN are usually unaended and wihou amper resisan hardware, hey are highly suscepible o such aacks. Thus, asceraining rusworhiness of daa and repuaion of sensor nodes is crucial for WSN. As he performance of very low power processors dramaically improves, fuure aggregaor nodes will be capable of performing more sophisicaed daa aggregaion algorihms, hus making WSN less vulnerable. Ieraive filering algorihms hold grea promise for such a purpose. Such algorihms simulaneously aggregae daa from muliple sources and provide rus assessmen of hese sources, usually in a form of corresponding weigh facors assigned o daa provided by each source. In his paper we demonsrae ha several exising ieraive filering algorihms, while significanly more robus agains collusion aacks han he simple averaging mehods, are neverheless suscepive o a novel sophisicaed collusion aack we inroduce. To address his securiy issue, we propose an improvemen for ieraive filering echniques by providing an iniial approximaion for such algorihms which makes hem no only collusion robus, bu also more accurae and faser converging. Index Terms Wireless sensor neworks, robus daa aggregaion, collusion aacks Ç 1 INTRODUCTION DUE o a need for robusness of monioring and low cos of he nodes, wireless sensor neworks (WSNs) are usually redundan. Daa from muliple sensors is aggregaed a an aggregaor node which hen forwards o he base saion only he aggregae values. A presen, due o limiaions of he compuing power and energy resource of sensor nodes, daa is aggregaed by exremely simple algorihms such as averaging. However, such aggregaion is known o be very vulnerable o fauls, and more imporanly, malicious aacks [1]. This canno be remedied by crypographic mehods, because he aackers generally gain complee access o informaion sored in he compromised nodes. For ha reason daa aggregaion a he aggregaor node has o be accompanied by an assessmen of rusworhiness of daa from individual sensor nodes. Thus, beer, more sophisicaed algorihms are needed for daa aggregaion in he fuure WSN. Such an algorihm should have wo feaures. 1. In he presence of sochasic errors such algorihm should produce esimaes which are close o he M. Rezvani, A. Ignjaovic, and S. Jha are wih he School of Compuer Science and Engineering, Universiy of New Souh Wales, Sydney, NSW 2052, Ausralia. M. Rezvani acknowledges he suppor of CSIRO. {mrezvani, ignja, sanjay}@cse.unsw.edu.au, aleksi@nica.com. E. Berino is wih he Deparmen of Compuer Science, Purdue Universiy, 305 N. Universiy Sree, Wes Lafayee, IN berino@cs.purdue.edu. Manuscrip received 30 July 2013; revised 19 Dec. 2013; acceped 2 Apr Dae of publicaion 10 Apr. 2014; dae of curren version 16 Jan For informaion on obaining reprins of his aricle, please send o: reprins@ieee.org, and reference he Digial Objec Idenifier below. Digial Objec Idenifier no /TDSC opimal ones in informaion heoreic sense. Thus, for example, if he noise presen in each sensor is a Gaussian independenly disribued noise wih zero mean, hen he esimae produced by such an algorihm should have a variance close o he Cramer- Rao lower bound (CRLB) [2], i.e, i should be close o he variance of he Maximum Likelihood Esimaor (MLE). However, such esimaion should be achieved wihou supplying o he algorihm he variances of he sensors, unavailable in pracice. 2. The algorihm should also be robus in he presence of non-sochasic errors, such as fauls and malicious aacks, and, besides aggregaing daa, such algorihm should also provide an assessmen of he reliabiliy and rusworhiness of he daa received from each sensor node. Trus and repuaion sysems have a significan role in supporing operaion of a wide range of disribued sysems, from wireless sensor neworks and e-commerce infrasrucure o social neworks, by providing an assessmen of rusworhiness of paricipans in such disribued sysems. A rusworhiness assessmen a any given momen represens an aggregae of he behaviour of he paricipans up o ha momen and has o be robus in he presence of various ypes of fauls and malicious behaviour. There are a number of incenives for aackers o manipulae he rus and repuaion scores of paricipans in a disribued sysem, and such manipulaion can severely impair he performance of such a sysem [3]. The main arge of malicious aackers are aggregaion algorihms of rus and repuaion sysems [4] ß 2014 IEEE. Personal use is permied, bu republicaion/redisribuion requires IEEE permission. See hp:// for more informaion.

3 REZVANI ET AL.: SECURE DATA AGGREGATION TECHNIQUE FOR WIRELESS SENSOR NETWORKS IN THE PRESENCE OF COLLUSION Trus and repuaion have been recenly suggesed as an effecive securiy mechanism for Wireless Sensor Neworks [5]. Alhough sensor neworks are being increasingly deployed in many applicaion domains, assessing rusworhiness of repored daa from disribued sensors has remained a challenging issue. Sensors deployed in hosile environmens may be subjec o node compromising aacks by adversaries who inend o injec false daa ino he sysem. In his conex, assessing he rusworhiness of he colleced daa becomes a challenging ask [6]. As he compuaional power of very low power processors dramaically increases, mosly driven by demands of mobile compuing, and as he cos of such echnology drops, WSNs will be able o afford hardware which can implemen more sophisicaed daa aggregaion and rus assessmen algorihms; an example is he recen emergence of muli-core and muli-processor sysems in sensor nodes [7]. Ieraive Filering (IF) algorihms are an aracive opion for WSNs because hey solve boh problems daa aggregaion and daa rusworhiness assessmen using a single ieraive procedure [8]. Such rusworhiness esimae of each sensor is based on he disance of he readings of such a sensor from he esimae of he correc values, obained in he previous round of ieraion by some form of aggregaion of he readings of all sensors. Such aggregaion is usually a weighed average; sensors whose readings significanly differ from such esimae are assigned less rusworhiness and consequenly in he aggregaion process in he presen round of ieraion heir readings are given a lower weigh. In recen years, here has been an increasing amoun of lieraure on IF algorihms for rus and repuaion sysems [8], [9], [10], [11], [12], [13], [14], [15]. The performance of IF algorihms in he presence of differen ypes of fauls and simple false daa injecion aacks has been sudied, for example in [16] where i was applied o compressive sensing daa in WSNs. In he pas lieraure i was found ha hese algorihms exhibi beer robusness compared o he simple averaging echniques; however, he pas research did no ake ino accoun more sophisicaed collusion aack scenarios. If he aackers have a high level of knowledge abou he aggregaion algorihm and is parameers, hey can conduc sophisicaed aacks on WSNs by exploiing false daa injecion hrough a number of compromised nodes. This paper presens a new sophisicaed collusion aack scenario agains a number of exising IF algorihms based on he falsedaainjecion.insuchanaackscenario,colluders aemp o skew he aggregae value by forcing such IF algorihms o converge o skewed values provided by one of he aackers. Alhough such proposed aack is applicable o a broad range of disribued sysems, i is paricularly dangerous once launched agains WSNs for wo reasons. Firs, rus and repuaion sysems play criical role in WSNs as a mehod of resolving a number of imporan problems, such as secure rouing, faul olerance, false daa deecion, compromised node deecion, secure daa aggregaion, cluser head elecion, oulier deecion, ec., [17]. Second, sensors which are deployed in hosile and unaended environmens are highly suscepible o node compromising aacks [18]. While offering beer proecion han he simple averaging, our simulaion resuls demonsrae ha indeed curren IF algorihms are vulnerable o such new aack sraegy. As we will see, such vulnerabiliy o sophisicaed collusion aacks comes from he fac ha hese IF algorihms sar he ieraion process by giving an equal rus value o all sensor nodes. In his paper, we propose a soluion for such vulnerabiliy by providing an iniial rus esimae which is based on a robus esimaion of errors of individual sensors. When he naure of errors is sochasic, such errors essenially represen an approximaion of he error parameers of sensor nodes in WSN such as bias and variance. However, such esimaes also prove o be robus in cases when he error is no sochasic bu due o coordinaed malicious aciviies. Such iniial esimaion makes IF algorihms robus agains described sophisicaed collusion aack, and, we believe, also more robus under significanly more general circumsances; for example, i is also effecive in he presence of a complee failure of some of he sensor nodes. This is in conras wih he radiional non ieraive saisical sample esimaion mehods which are no robus agains false daa injecion by a number of compromised nodes [18] and which can be severely skewed in he presence of a complee sensor failure. Since readings keep sreaming ino aggregaor nodes in WSNs, and since aacks can be very dynamic (such as orchesraed aacks [4]), in order o obain rusworhiness of nodes as well as o idenify compromised nodes we apply our framework on consecuive baches of consecuive readings. Sensors are deemed compromised only relaive o a paricular bach; his allows our framework o handle on-off ype of aacks (called orchesraed aacks in [4]). We validae he performance of our algorihm by simulaion on synheically generaed daa ses. Our simulaion resuls illusrae ha our robus aggregaion echnique is effecive in erms of robusness agains our novel sophisicaed aack scenario as well as efficien in erms of he compuaional cos. Our conribuions can be summarized as follows: 1 1. Idenificaion of a new sophisicaed collusion aack agains IF based repuaion sysems which reveals a severe vulnerabiliy of IF algorihms. 2. A novel mehod for esimaion of sensors errors which is effecive in a wide range of sensor fauls and no suscepible o he described aack. 3. Design of an efficien and robus aggregaion mehod inspired by he MLE, which uilises an esimae of he noise parameers obained using conribuion 2 above. 4. Enhanced IF schemes able o proec agains sophisicaed collusion aacks by providing an iniial esimae of rusworhiness of sensors using inpus from conribuions 2 and 3 above. 1. An exended version of his paper has been published as a echnical repor in [19].

4 100 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 12, NO. 1, JANUARY/FEBRUARY 2015 Fig. 1. Nework model for WSN. We provide a horough empirical evaluaion of effeciveness and efficiency of our proposed aggregaion mehod. The resuls show ha our mehod provides boh higher accuracy and beer collusion resisance han he exising mehods. The remainder of his paper is organized as follows. Secion 2 describes he problem saemen and he assumpions. Secion 3 presens our novel robus daa aggregaion framework. Secion 4 describes our experimenal resuls. Secion 5 presens he relaed work. Finally, he paper is concluded in Secion 6. 2 BACKGROUND,ASSUMPTIONS,THREAT MODEL AND PROBLEM STATEMENT In his secion, we presen our assumpions, discuss IF algorihms, describe a collusion aack scenario agains IF algorihms, and sae he problems ha we address in his paper. 2.1 Nework Model For he sensor nework opology, we consider he absrac model proposed by Wagner in [20]. Fig. 1 shows our assumpion for nework model in WSN. The sensor nodes are divided ino disjoin clusers, and each cluser has a cluser head which acs as an aggregaor. Daa are periodically colleced and aggregaed by he aggregaor. In his paper we assume ha he aggregaor iself is no compromised and concenrae on algorihms which make aggregaion secure when he individual sensor nodes migh be compromised and migh be sending false daa o he aggregaor. We assume ha each daa aggregaor has enough compuaional power o run an IF algorihm for daa aggregaion. 2.2 Ieraive Filering in Repuaion Sysems Kerchove and Van Dooren proposed in [8] an IF algorihm for compuing repuaion of objecs and raers in a raing sysem. We briefly describe he algorihm in he conex of daa aggregaion in WSN and explain he vulnerabiliy of he algorihm for a possible collusion aack. We noe ha our improvemen is applicable o oher IF algorihms as well. We consider a WSN wih n sensors S i, i ¼ 1;...;n.We assume ha he aggregaor works on one block of readings a a ime, each block comprising of readings a m consecuive insans. Therefore, a block of readings is represened by a marix X ¼fx 1 ; x 2 ;...; x n g where x i ¼½x 1 i x 2 i... xm i ŠT, ð1 i nþ represens he ih m-dimensional reading repored by sensor node S i.le r ¼½r 1 r 2... r m Š T denoe he aggregae values for insans ¼ 1;...;m, which auhors of [8] call a repuaion vecor, 2 compued ieraively and simulaneously wih a sequence of weighs w ¼½w 1 w 2... w n Š T reflecing he rusworhiness of sensors. We denoe by r ðlþ ; w ðlþ he approximaions of r; w obained a lh round of ieraion (l 0). The ieraive procedure sars wih giving equal credibiliy o all sensors, i.e., wih an iniial value w ð0þ ¼ 1. The value of he repuaion vecor r ðlþ1þ in round of ieraion l þ 1 is obained from he weighs of he sensors obained in he round of ieraion l as r ðlþ1þ ¼ X wðlþ P n i¼1 wðlþ i Consequenly, he iniial repuaion vecor is r ð1þ ¼ 1 n X 1, i.e., r ð1þ is jus he sequence of simple averages of he readings of all sensors a each paricular insan. The new weigh vecor w ðlþ1þ o be used in round of ieraion l þ 1 is hen compued as a funcion gðdþ of he normalized belief divergence d which is he disance beween he sensor readings and he repuaion vecor r ðlþ. Thus, d ¼½d 1 d 2... d n Š T, d i ¼ 1 m x i r ðlþ1þ 2 and wðlþ1þ 2 i ¼ gðd i Þ, ð1 i nþ. Funcion gðxþ is called he discriminan funcion and i provides an inverse relaionship of weighs o disances d. Our experimens show ha selecing a discriminan funcion has a significan role in sabiliy and robusness of IF algorihms. A number of alernaives for his funcion are sudied in [8]: reciprocal: gðdþ ¼d k ; exponenial: gðdþ ¼e d ; affine: gðdþ ¼1 k l d, where k l > 0 is chosen so ha gðmax i fd ðlþ i gþ ¼ 0. Algorihm 1 illusraes he ieraive compuaion of he repuaion vecor based on he above formulas. Table 1 shows a race example of his algorihm. The sensor readings in he firs hree rows of his able are from sensed emperaures in Inel Lab daa se [21] a hree differen ime insans. We execued he IF algorihm on he readings; he discriminan funcion in he algorihm was a reciprocal of he disance beween sensor readings and he curren compued repuaion. The lower par of he able illusraes he weigh vecor in each ieraion as well as he obained repuaion values for he hree differen ime insans (1, 2, 3) in he las hree columns. As can be seen, he algorihm converges afer six ieraions. 2.3 Adversary Model In his paper, we use a Byzanine aack model, where he adversary can compromise a se of sensor nodes and injec any false daa hrough he compromised nodes [22]. We 2. We find such erminology confusing, because repuaion should perain o he level of rusworhiness raher han he aggregae value, bu have decided o keep he erminology which is already in use. :

5 REZVANI ET AL.: SECURE DATA AGGREGATION TECHNIQUE FOR WIRELESS SENSOR NETWORKS IN THE PRESENCE OF COLLUSION TABLE 1 A Trace Example of Ieraive Filering Algorihm assume ha sensors are deployed in a hosile unaended environmen. Consequenly, some nodes can be physically compromised. We assume ha when a sensor node is compromised, all he informaion which is inside he node becomes accessible by he adversary. Thus, we canno rely on crypographic mehods for prevening he aacks, since he adversary may exrac crypographic keys from he compromised nodes. We assume ha hrough he compromised sensor nodes he adversary can send false daa o he aggregaor wih a purpose of disoring he aggregae values. We also assume ha all compromised nodes can be under conrol of a single adversary or a colluding group of adversaries, enabling hem o launch a sophisicaed aack. We also consider ha he adversary has enough knowledge abou he aggregaion algorihm and is parameers. Finally, we assume ha he base saion and aggregaor nodes canno be compromised in his adversary model; here is an exensive lieraure proposing how o deal wih he problem of compromised aggregaors; in his paper we limi our aenion o he lower layer problem of false daa being sen o he aggregaor by compromised individual sensor nodes, which has received much less aenion in he exising lieraure. Assume ha 10 sensors repor he values of emperaure which are aggregaed using he IF algorihm proposed in [8] wih he reciprocal discriminan funcion. We consider hree possible scenarios; see Fig. 2. In scenario 1, all sensors are reliable and he resul of he IF algorihm is close o he acual value. In scenario 2, an adversary compromises wo sensor nodes, and alers he readings of hese values such ha he simple average of all sensor readings is skewed owards a lower value. As hese wo sensor nodes repor a lower value, IF algorihm penalises hem and assigns o hem lower weighs, because heir values are far from he values of oher sensors. In oher words, he algorihm is robus agains false daa injecion in his scenario because he compromised nodes individually falsify he readings wihou any knowledge abou he aggregaion algorihm. Table 2 illusraes a race example of he aack scenario on Inel daa se; sensors 9 and 10 are compromised by an adversary. As one can see, he algorihm assigns very low weighs o hese wo sensor nodes and consequenly heir conribuions decrease. Thus, he IF algorihm is robus agains he simple oulier injecion by he compromised nodes. In scenario 3, an adversary employs hree compromised nodes in order o launch a collusion aack. I lisens o he repors of sensors in he nework and insrucs he wo compromised sensor nodes o repor values far from he rue value of he measured quaniy. I hen compues he skewed value of he simple average of all sensor readings and commands he hird compromised sensor o repor such skewed 2.4 Collusion Aack Scenario Mos of he IF algorihms employ simple assumpions abou he iniial values of weighs for sensors. In case of our adversary model, an aacker is able o mislead he aggregaion sysem hrough careful selecion of repored daa values. We use visualisaion echniques from [18] o presen our aack scenario. Fig. 2. Aack scenario agains IF algorihm.

6 102 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 12, NO. 1, JANUARY/FEBRUARY 2015 TABLE 2 A Trace Example of a Simple Aack Scenario average as is readings. In oher words, wo compromised nodes disor he simple average of readings, while he hird compromised node repors a value very close o such disored average hus making such reading appear o he IF algorihm as a highly reliable reading. As a resul, IF algorihms will converge o he values provided by he hird compromised node, because in he firs ieraion of he algorihm he hird compromised node will achieve he highes weigh, significanly dominaing he weighs of all oher sensors. This is reinforced in every subsequen ieraion; herefore, he algorihm quickly converges o a repuaion which is very close o he iniial skewed simple average, as shown in Fig. 2. Table 3 shows he same aack scenario on Inel Lab daa se; sensors 8, 9 and 10 are compromised by an adversary. As one can see, he algorihm converges quickly o he readings of sensor 10 which is essenially equal o he simple average value of he sensors. In he hird scenario, how much he aggregae value is skewed direcly depends on he number of compromised nodes which disor he sample average of readings. Moreover, in his scenario, he aacker needs o gain conrol over a leas wo sensor nodes; one which will repors readings which disor he sample average and anoher one which repors such disored average. In our experimens, we invesigae how he behaviour of he IF algorihm depends on he number of compromised nodes; see Secion 4.4. Clearly, he main source of he above vulnerabiliy comes from he fac ha he algorihm assigns an equal iniial weigh o all sensor nodes in he firs ieraion. Moreover, he reciprocal discriminan funcion has a pole a zero which makes he algorihm unsable in he presence of sensors exhibiing a very small belief divergence a any given round of ieraion. Therefore, under an aack of he kind described, he repuaion value of he firs ieraion is equal o he simple average of readings, and he second vecor of weighs is compued based on he disance of each sensor o he simple average provided by he firs ieraion. As mos of he IF algorihms in he lieraure make he same assumpion abou he iniial rusworhiness of sensors, we argue ha an adversary wih sufficien knowledge of such algorihms can launch an aack as we have described and deceive he aggregaor node. In he case in which he nodes use crypography o ensure he confidenialiy of readings hey send o he aggregaor, he adversary can sill esimae hese readings by sensing he measured quaniy using he malicious nodes. To address he shorcoming of exising IF mehods, we focus on esimaing an iniial rus vecor based on an esimae of error parameers of sensor nodes. Afer ha, we use he new rus vecor as he iniial sensor rusworhiness in order o consolidae he algorihms agains an aack scenario of he ype described. 3 ROBUST DATA AGGREGATION In his secion, we presen our robus daa aggregaion mehod. Table 4 conains a summary of noaions used in his paper. 3.1 Framework Overview In order o improve he performance of IF algorihms agains he aforemenioned aack scenario, we provide a robus iniial esimaion of he rusworhiness of sensor nodes o be used in he firs ieraion of he IF algorihm. Mos of he radiional saisical esimaion mehods for TABLE 3 A Trace Example of he Proposed Collusion Aack Scenario

7 REZVANI ET AL.: SECURE DATA AGGREGATION TECHNIQUE FOR WIRELESS SENSOR NETWORKS IN THE PRESENCE OF COLLUSION TABLE 4 Noaion Used in This Paper Fig. 3. Our robus daa aggregaion framework. variance involve use of he sample mean. For his reason, proposing a robus variance esimaion mehod in he case of skewed sample mean is an essenial par of our mehodology. In he remainder of his paper, we assume ha he sochasic componens of sensor errors are independen random variables wih a Gaussian disribuion; however, our experimens show ha our mehod works quie well for oher ypes of errors wihou any modificaion. Moreover, if error disribuion of sensors is eiher known or esimaed, our algorihms can be adaped o oher disribuions o achieve an opimal performance. Fig. 3 illusraes he sages of our robus aggregaion framework and heir inerconnecions. As we have menioned, our aggregaion mehod operaes on baches of consecuive readings of sensors, proceeding in several sages. In he firs sage we provide an iniial esimae of wo noise parameers for sensor nodes, bias and variance; deails of he compuaions for esimaing bias and variance of sensors are presened in Secions 3.2 and 3.3, respecively. Based on such an esimaion of he bias and variance of each sensor, he bias esimae is subraced from sensors readings and in he nex phase of he proposed framework, we provide an iniial esimae of he repuaion vecor calculaed using he MLE. The deailed compuaion operaions of such esimaion are described in Secion 3.4. In he hird sage of he proposed framework, he iniial repuaion vecor provided in he second sage is used o esimae he rusworhiness of each sensor based on he disance of sensor readings o such iniial repuaion vecor. This idea will be described in Secion Esimaing Bias We assume ha all sensors in WSN can have some error; such error e s of a sensor s is modelled by he Gaussian disribuion random variable wih a sensor bias b s and sensor variance s s, e s Nðb s; s 2 s Þ.Ler denoes he rue value of he signal a ime. Eachsensorreadingx s can be wrien as x s ¼ r þ e s : (1) The main idea is ha, since we have no access o he rue value r we canno obain he value of he error e s ; however, we can obain he values of he differences of such errors. Thus, if we define dði; jþ ¼ 1 P m m ðx i x jþ, we ge dði; jþ ¼ 1 X m x m i x 1 X j m ¼ e i m 1 X m e j m ; where e i is a random variable wih Gaussian disribuion e i Nðb i; s 2 i Þ. Le e i ¼ 1 P m m e i be he sample mean of his random variable. As he sample mean is an unbiased esimaor of he expeced value of a random variable, we have dði; jþ ¼e i e j b i b j : Le d ¼fdði; jþ :1 i; j ng; his marix is an esimaor for muual difference of sensor bias. In order o obain he sensor bias from his marix, we solve he following minimizaion problem. minimize b subjec o X n X i 1 i¼1 j¼1 X n i¼1 b i b 2 j dði; jþ 1 b i ¼ 0: To jusify our consrain, i is clear ha if he mean of he bias of all sensors is no zero, hen here would be no way o accoun for i on he basis of sensor readings. On he oher hand, bias of sensors, under normal circumsances, comes from imperfecions in manufacure and calibraion of sensors as well as from he fac ha hey migh be deployed in places wih differen environmenal circumsances where he sensed scalar migh in fac have a slighly differen value. Since by he very naure we are ineresed in obaining a mos reliable esimae of an average value of he variable sensed, i is reasonable o assume ha he mean bias of all sensors is zero (wihou fauls or malicious aacks). We chose he above objecive raher han P n i¼1 P i 1 j¼1 ðb i b j dði; jþþ 2 o improve he performanceincasewhenbiasescanbeofverydifferen magniudes. We inroduce a Lagrangian muliplier and look a exremal values of he following funcion: Fð ~ bþ¼ Xn X i 1 i¼1 j¼1 2 b i b j dði; jþ 1 þ Xn b i : i¼1 By seing he gradien of Fð ~ bþ o zero we obain a sysem of linear equaions whose soluion is our approximaion of he he bias values. If we le dðj; iþ i<j; dði; jþ ¼ dðj; iþ i j; hen hese equaions can be wrien in he following compac form: (2)

8 104 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 12, NO. 1, JANUARY/FEBRUARY 2015 P ni¼1 8 2 b i6¼k dði;kþ 2 i P n 2 i¼1 b i6¼k dði;kþ 2 k ¼ 2 P n 1 < i¼1 i6¼k dði;kþ ; : P for all k ¼ 1;...;n n i¼1 b i ¼ 0: Noe ha he obained value of b i is acually an approximaion of he sample mean of he error of sensor i, which, in urn is an unbiased esimaor of he bias of such a sensor. 3.3 Esimaing Variance In his secion, we propose a similar mehod o esimae variance of he sensor noise using he esimaed bias from previous secion. Given he bias vecor b ¼½b 1 ;b 2 ;...;b n Š and sensor readings fx s g, we can define marices f^x s g and b ¼fbði; jþg as follows: bði; jþ ¼ 1 X m ^x m 1 i ^x 2 j ¼ 1 m 1 (3) ^x s ¼ x s b s; (4) X m x i x 2: j bi b j By (1) we have x i x j ¼ðr þ e i Þ ðr þ e j Þ¼e i e j ; hus, we obain bði; jþ ¼ 1 X m e 2 1 X m m 1 i b i þ e 2 m 1 j b j 2 X m e m 1 i b i e j b j : We assume ha he sensors noise is generaed by independen random variables; 3 as we have menioned, our approximaions of he bias b i are acually approximaions of he sample mean; hus 1 X m e m 1 i b i e j b j Covðei ;e j Þ¼0 and similarly bði; jþ ¼ 1 X m e 2 1 X m m 1 i b i þ e 2 m 1 j b j s 2 i þ s2 j : The above formula shows ha we can esimae he variance of sensors noise by compuing he marix b. We also compue he sum of variances of all sensors using he following Lemma. Lemma 3.1 (Toal Variance). Le x be he mean of readings in ime, hen, using (4) and our assumpion ha P n i¼1 b i ¼ 0, we have x ¼ 1 n X n j¼1 x j ¼ 1 n 3. We analyze our esimaion mehod wih synheic correlaed daa and he experimenal resuls show ha he our mehod produces excellen resuls even for correlaed noise. X n j¼1 ^x j ; and he saisic SðÞ ¼ n X n X m ^x mðn 1Þ i x 2 i¼1 is an unbiased esimaor of he sum of he variances of all sensors, P n i¼1 v i. We presened he proof of he lemma in [19]. To obain an esimaion of variances of sensors from he marix b ¼fbði; jþg we solve he following minimizaion problem: minimize v X n subjec o Xn X i 1 i¼1 j¼1 i¼1 v i ¼ v i þ v 2 j bði; jþ 1 (5) n X n X m ^x 2: i x mðn 1Þ i¼1 Noe ha he consrain of he minimisaion problem comes from Lemma 3.1. We again inroduce a Lagrangian muliplier and by solving he minimizaion problem, we obain linear Equaions (6): 8 P ni¼1 1 v i6¼k bði;kþ 2 i þ P n 1 i¼1 v i6¼k bði;kþ 2 k þ 2 ¼ P n 1 >< i¼1 bði;kþ ; for all k ¼ 1;...;n (6) >: P n i¼1 v i ¼ n mðn 1Þ P n i¼1 P m 2: ^x i x 3.4 MLE wih Known Variance In he previous secions, we proposed a novel approach for esimaing he bias and variance of noise for sensors based on heir readings. The variance and he bias of a sensor noise can be inerpreed as he disance measures of he sensor readings o he rue value of he signal. In fac, he disance measures obained as our esimaes of he bias and variances of sensors also make sense for non-sochasic errors. Given marix fx s g where x s r þnðb s ; s 2 sþ and esimaed bias and variance vecors b and s, weproposeo recover r using (an approximae form of) he MLE applied o he values obained by subracing he bias esimaes from sensors readings. As i is well known, in his case he MLE has he smalles possible variance as i aains he CRLB. From a heurisic poin of view, we removed he sysemaic componen of he error by subracing a quaniy which in he case of a sochasic error corresponds o an esimae of bias; his allows us o esimae he variabiliy around such a sysemaic componen of he error, which, in case of sochasic errors, corresponds o variance. We can now obain an esimaion which corresponds o MLE formula for he case of zero mean normally disribued errors, bu wih esimaed raher han rue variances. Therefore, we assume ha he expeced value r of he measuremens is he rue value of he quaniy measured, and is he only parameer in he likelihood funcion. Thus, in he expression for he likelihood funcion for normally disribued unbiased case, L n ðr Þ¼ Yn i¼1 s i 1 pffiffiffiffiffi e 1 2 2p ðx i r Þ 2 s 2 i

9 REZVANI ET AL.: SECURE DATA AGGREGATION TECHNIQUE FOR WIRELESS SENSOR NETWORKS IN THE PRESENCE OF COLLUSION we replace s 2 i by he obained variance v i from Equaion (6). Moreover, by differeniaing he above formula wih respec o r and seing he derivaive equal o zero we ge r ¼ Xn i¼1 1 v i Pn j¼1 1 x i v j for all ¼ 1;...;m: (7) Equaion (7) provide an esimae of he rue value of he quaniy measured in a form of a weighed average of sensor readings, wih he sensor readings given a weigh inversely proporional o he esimaion of heir error variance provided by our mehod: r ¼ Xn s¼1 w s x s : (8) Noe ha his mehod esimaes he repuaion vecor wihou any ieraion. Thus, he compuaional complexiy of he esimaion is considerably less han he exising IF algorihms. 3.5 Enhanced Ieraive Filering According o he proposed aack scenario, he aacker explois he vulnerabiliy of he IF algorihms which originaes from a wrong assumpion abou he iniial rusworhiness of sensors. Our conribuion o address his shorcomings is o employ he resuls of he proposed robus daa aggregaion echnique as he iniial repuaion for hese algorihms. Moreover, he iniial weighs for all sensor nodes can be compued based on he disance of sensors readings o such an iniial repuaion. Our experimenal resuls illusrae ha his idea no only consolidaes he IF algorihms agains he proposed aack scenario, bu using his iniial repuaion improves he efficiency of he IF algorihms by reducing he number of ieraions needed o approach a saionary poin wihin he prescribed olerance; see Secion SIMULATION RESULTS In his secion, we repor on a deailed numerical simulaion sudy ha examines robusness and efficiency of our daa aggregaion mehod. 4 The objecive of our experimens is o evaluae he robusness and efficiency of our approach for esimaing he rue values of signal based on he sensor readings in he presence of fauls and collusion aacks. For each experimen, we evaluae he accuracy based on Roo Mean Squared error (RMS error) meric and efficiency based on he number of ieraions needed for convergence of IF algorihms. 4.1 Experimenal Seings All he experimens have been conduced on an HP PC wih 3.30 GHz Inel Core i processor wih 8 GB RAM running a 64-bi Windows 7 Enerprise. The program code has 4. Unforunaely, we are unable o prove mahemaically ha our sysem is secure; however we demonsraed higher robusness compared o he sae of he ar by horough empirical evaluaion. We are working on obaining a rigorous proof bu his appears o be a challenging problem. been wrien in MATLAB R2012b. Alhough here are a number of real world daa ses for evaluaing repuaion sysems and daa aggregaion in sensor neworks such as Inel daa se [21], none of hem provides a clear ground ruh. Thus, we conduc our experimens by generaing synheic daa ses. The experimens are based on simulaions performed wih boh correlaed and uncorrelaed sensor errors. If no menioned oherwise, we generae synheic daa ses according o he following parameers: Each simulaion experimen was repeaed 200 imes and hen resuls were averaged. Number of sensor nodes is n ¼ 20. Number of readings for each sensor is m ¼ 400. For saisical parameers of he errors (noise) used o corrup he rue readings, we consider several ranges of values for bias, variance and covariance of noise for each experimen. The level of significance in K-S es is a ¼ 0:05. In all experimens, we compare our robus aggregaion mehod agains hree oher IF echniques proposed for repuaion sysems. For all parameers of oher algorihms used in he experimens, we se he same values as used in he original papers where hey were inroduced. The firs IF mehod considered compues he rusworhiness of sensor nodes based on he disance of heir readingsohecurrensaeofheesimaedrepuaion [8]. We described he deails of his approach in Secion 2.2. We invesigae wo discriminan funcions in our experimens gðdþ ¼d 1 and gðdþ ¼1 k l d,andcallhese mehods dkvd-reciprocal and dkvd-affine, respecively. The second IF mehod we consider is a correlaion based ranking algorihm proposed by Zhou e al. in [9]. In his algorihm, rusworhiness of each sensor is obained based on he correlaion coefficien beween he sensors readings and he curren esimae of he rue value of he signal. In oher words, his mehod gives credi o sensor nodes whose readings correlae well wih he esimaed rue value of he signal. Based on his idea, he auhors proposed an ieraive algorihm for esimaing he rue value of he signal by applying a weighed averaging echnique. They argued ha correlaion coefficien is a good way o quanify he similariy beween wo vecors. Thus, hey employed Pearson correlaion coefficien beween sensor readings and he curren sae of esimae signal in order o compue he sensor weigh. We call his mehod Zhou. The hird algorihm considered has been proposed by Laurei e al. in [10] and is an IF algorihm based on a weighed averaging echnique similar o he algorihm described in Secion 2.2. The only difference beween hese wo algorihms is in he discriminan funcion. The auhors in [10] exploied discriminan funcion gðdþ ¼d 0:5. We call his mehod Laurei. We apply dkvd-reciprocal, dkvd-affine, Zhou, Laurei and our robus aggregaion approach o synheically generaed daa. Alhough we can simply apply our robus framework o all exising IF approaches, in his paper we invesigae he improvemen which addiion of our iniial rusworhiness assessmen mehod produces on he robusness of dkvd-reciprocal and dkvd-affine mehods (We call

10 106 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 12, NO. 1, JANUARY/FEBRUARY 2015 TABLE 5 Summary of Differen IF Algorihms hem RobusAggregae-Reciprocal and RobusAggregae-Affine, respecively.). Table 5 shows a summary of discriminan funcions for all of he above four differen IF mehods. We firs conduc experimens by injecing only Gaussian noise ino sensor readings. In he second par of he experimens, we invesigae he behaviour of hese approaches by emulaing a simple, non-colluding aack scenario presened in he second case of Fig. 2. We hen evaluae hese approaches in he case of our sophisicaed aack scenario. 4.2 Accuracy and Efficiency wihou an Aack In he firs bach of experimens we assume ha here are no sensors wih malicious behaviour. Thus, he errors are fully sochasic; we consider Gaussian sensors errors. In order o evaluae he performance of our algorihm in comparison wih he exising algorihms, we produce he following four differen synheic daa ses. 1. Unbiased error. We considered various disribuions of he variance across he se of sensors and obained similar resuls. We have chosen o presen he case wih he error of a sensor s a ime is given by e s Nð0;s s2 Þ, considering differen values for he baseline sensor variance s 2. Fig. 4a shows he resuls of he MLE wih our noise parameer esimaion (seps 1 and 2 in Fig. 3) and he informaion heoreic limi for he minimal variance provided by he CRLB, achieved, for example, using he MLE wih he acual, exac variances of sensors, which are NOT available o our algorihm. As one can see in his figure, our proposed approach nearly exacly achieves he minimal possible variance coming from he informaion heoreic lower bound. Furhermore, Fig. 4b illusraes he performance of our approach for he iniial rusworhiness assessmen of sensors wih differen discriminan funcions as well as oher IF algorihms. I shows ha in his experimen, he performance of our approach wih boh discriminan funcions is very similar o he original IF algorihm. 2. Bias error. In his scenario, we injec bias error o sensor readings, generaed by Gaussian disribuion wih differen variances. Therefore, he error of sensor s in ime is generaed by e s NðNð0; s 2 b Þ;s s2 Þ wih he variance of he bias s 2 b ¼ 4 and increasing values for variances, where Fig. 4. Accuracy for No Aack scenarios. he variance of sensor s is equal o s s 2.Thus, he sensors bias is produced by a zero mean Gaussian disribuion random variable. Fig. 4c shows he RMS error for all algorihms in his scenario. As can be seen in his figure, since all of he IF algorihms, along wih our approach, generae an error close o heir errors in he unbiased scenario, we can conclude ha he mehods are sable agains bias bu fully sochasic noise. 3. Correlaed noise. The heurisics behind our iniial variance esimaion assumed ha he errors of sensors are uncorrelaed. Thus, we esed how he performance of our mehod degrades if he noise becomes correlaed and how i compares o he exising mehods under he same circumsances. So in his scenario, we assume ha he errors of sensors are no longer uncorrelaed. Possible covariance funcions can be of differen ypes, such as Spherical, Power Exponenial, Raional Quadraic, and Maern; see [23]. Alhough our proposed mehod can be applied o all covariance funcions, we presen here he resuls for he case of he Power Exponenial funcion rði; jþ ¼ e ji jj n. Moreover, he variance of a sensor s is again se o s 2 s ¼ s s2. From he corresponding covariance marix S ¼fS ij ¼ rði; jþs i s j : i; j ¼ 1...ng, he noise values of sensors are generaed from mulivariae Normal disribuion Noise NðBias; SÞ. In his scenario, we ake ino accoun differen values of s for generaing he noise values of sensors in order o analyse he accuracy of he daa aggregaion under various levels of noise. Fig. 4d shows he RMS error of he algorihms for his scenario. As can be seen in his figure, our approach wih reciprocal discriminan funcion improves dkvd-reciprocal algorihm for all differen values of variance, alhough our mehod wih affine funcion generaes very similar RMS error o he original dkvd-affine algorihm.

11 REZVANI ET AL.: SECURE DATA AGGREGATION TECHNIQUE FOR WIRELESS SENSOR NETWORKS IN THE PRESENCE OF COLLUSION Moreover, he scale of RMS error is in general larger han in scenarios wih uncorrelaed noise, as one would expec. This can be explained by our assumpion ha he sensors noise is generaed by independen random variables; see Secion 3.3. The resuls of our simulaions also show ha he use of our iniial variance esimaion in he second phase of our proposed framework as he iniial repuaion of IF algorihms decreases he number of ieraions for he algorihms. We evaluae he number of ieraions for he IF algorihm proposed in [8] by providing he iniial repuaion from he resuls of he our approach for boh unbiased and biased sensors errors. The resuls of his experimen show ha he proposed iniial repuaion for he IF algorihm improves he efficiency of he algorihm in erms of he number of ieraions unil he procedure has converged. In oher words, by providing his iniial repuaion, he number of ieraions for IF algorihm decreases approximaely 9 percen for reciprocal and around 8 percen for affine discriminan funcions in boh biased and unbiased circumsances. This can be explained by he fac ha he new iniial repuaion is close o he rue value of signal and he IF algorihm needs fewer ieraions o reach is saionary poin. In he nex par of our experimens, we employ his idea for consolidaing he IF algorihm agains he proposed aack scenario. 4.3 Accuracy wih Simple Aack Scenario Lim e al. in [18] inroduced an aack scenario agains radiional saisical aggregaion approaches. We described he scenario in Secion 2.4 and he second round of Fig. 2 as a simple aack scenario using a number of compromised node for skewing he simple average of sensors readings. In his secion, we invesigae he behavior of IF algorihms agains he simple aack scenario. Noe ha he objecive of his aack scenario is o skew he sample mean of sensors readings hrough reporing oulier readings by he compromised nodes. In order o evaluae he accuracy of he IF algorihms agains he simple aack scenario, we assume ha he aacker compromises cðc <n) sensor nodes and repors oulier readings by hese nodes. We generae synheically daa ses for his aack scenario by aking ino accoun differen values of variance for sensors errors as well as employing various number of compromised nodes. Moreover, we generae biased readings for all sensor nodes wih bias provided by a random variable wih a disribuion Nð0; s 2 b Þ wih he variance of bias chosen o be s2 b ¼ 4. Fig. 5 shows he accuracy of he IF algorihms and our approach in he presence of such simple aack scenario. I can be seen ha he esimaes provided by he hree approaches, dkvd-affine, Zhou and Laurei are significanly skewed by his aack scenario and heir accuracy significanly decreases by increasing he number of compromised nodes. On he oher hand, dkvd-reciprocal provides a reasonable accuracy for all parameer values of his simple aack scenario (see Fig. 5a). The robusness of his discriminan funcion can be explained by he fac ha he funcion sharply diminishes he conribuions of oulier readings hrough assigning very low values of weighs o hem. In Fig. 5. Accuracy wih a simple aack scenario. our sophisicaed collusion aack scenario, we exploi his propery in order o compromise sysems employing such discriminan funcion. The resuls of his experimen clearly show ha our iniial rusworhiness has no negaive effecs on he performance of he IF algorihm wih boh discriminan funcions in he case of he simple aack scenario. In nex secion, we show ha how his iniial values improve he IF algorihm in he case of proposed collusion aack scenario, while boh dkvd-affine and dkvd-reciprocal algorihms are compromised agains such an aack scenario. 4.4 Accuracy wih a Collusion Aack In order o illusrae he robusness of he proposed daa aggregaion mehod in he presence of sophisicaed aacks, we synheically generae several daa ses by injecing he proposed collusion aacks. Therefore, we assume ha he adversary employs c (c < n) compromised sensor nodes o launch he sophisicaed aack scenario proposed in Secion 2.4. The aacker uses he firs c 1 compromised nodes o generae oulier readings in order o skew he simple average of all sensor readings. The adversary hen falsifies he las sensor readings by injecing he values very close o such skewed average. This collusion aack scenario makes he IF algorihm o converge o a wrong saionary poin. In order o invesigae he accuracy of he IF algorihms wih his collusion aack scenario, we synheically generae several daa ses wih differen values for sensors variances as well as various number of compromised nodes (c).

12 108 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 12, NO. 1, JANUARY/FEBRUARY 2015 ha our approach wih reciprocal discriminan funcion is robus agains he collusion aack scenario. The reason is ha our approach no only provides he highes accuracy for his discriminan funcions, i acually approximaely reaches he accuracy of No Aack scenarios. As we described, he main shorcoming of he IF algorihms in he proposed aack scenario is ha hey quickly converge o he sample mean in he presence of he aack scenario. In order o invesigae he shorcoming, we conduced an experimen by increasing he sensor variances as well as he number of colluders. In his experimen, we quanified he number of ieraions for he IF algorihm wih reciprocal discriminan funcion (dkvd-reciprocal and RobusAggregae-Reciprocal algorihms). The resuls obained from his experimen show ha he original version of he IF algorihm quickly converges (afer around five ieraions) o he skewed values provided by one of he aackers, while saring wih an iniial repuaion provided by our approach, he algorihms require around 29 ieraions, and, insead of converging o he skewed values provided by one of he aackers, i provides a reasonable accuracy. The resuls of his experimen validae ha our sophisicaed aack scenario is caused by he discovered vulnerabiliy in he IF algorihms which sharply diminishes he conribuions of benign sensor nodes when one of he sensor nodes repors a value very close o he simple average. Fig. 6. Accuracy wih our collusion aack. Fig. 6 shows he accuracy of he IF algorihms and our approach in he presence of he collusion aack scenario. I can be seen ha he IF algorihms wih reciprocal discriminan funcion are highly vulnerable o such aack scenario (see Figs. 6a and 6d), while he affine discriminan funcion generaes more robus resuls in his case (see Fig. 6b). However, he accuracy of he affine discriminan funcion is sill much worse han he previous experimen wihou he collusion aack. This experimen shows ha he collusion aack scenario can circumven all he IF algorihms we ried. Moreover, he accuracy of he algorihms dramaically decreases by increasing he number of compromised nodes paricipaed in he aack scenario. As explained before, he algorihms converge o he readings of one of he compromised nodes, namely, o he readings of he node which repors values very close o he skewed mean. This demonsraes ha an aacker wih enough knowledge abou he aggregaion algorihm employed can launch a sophisicaed collusion aack scenario which defeas IF aggregaion sysems. Figs. 6e and 6f show he accuracy of our approach by aking ino accoun he IF algorihm in [8] wih reciprocal and affine discriminan funcions, respecively. As one can see, our proposed approach is superior o all oher algorihms in erms of he accuracy for reciprocal discriminan funcions, while he approach has a very small improvemen on affine funcion. Moreover, comparing he accuracy of our approach in his experimen wih he resuls from no aack and simple aack experimens in Figs. 4 and 5, we can argue 5 RELATED WORK Robus daa aggregaion is a serious concern in WSNs and here are a number of papers invesigaing malicious daa injecion by aking ino accoun he various adversary models. There are hree bodies of work relaed o our research: IF algorihms, rus and repuaion sysems for WSNs, and secure daa aggregaion wih compromised node deecion in WSNs. There are a number of published sudies inroducing IF algorihms for solving daa aggregaion problem [8], [9], [10], [11], [12], [13], [14], [15]. We reviewed hree of hem in our comparaive experimens in Secion 4. Li e al. in [12] proposed six differen algorihms, which are all ieraive and are similar. The only difference among he algorihms is heir choice of norm and aggregaion funcion. Ayday e al. proposed a sligh differen ieraive algorihm in [13]. Their main differences from he oher algorihms are: 1) he raings have a ime-discoun facor, so in ime, heir imporance will fade ou; and 2) he algorihm mainains a blacklis of users who are especially bad raers. Liao e al. in [14] proposed an ieraive algorihm which beyond simply using he raing marix, also uses he social nework of users. The main objecive of Chen e al. in [15] is o inroduce a Biassmoohed ensor model, which is a Bayesian model of raher high complexiy. Alhough he exising IF algorihms consider simple cheaing behaviour by adversaries, none of hem ake ino accoun sophisicaed malicious scenarios such as collusion aacks. Our work is also closely relaed o he rus and repuaion sysems in WSNs. Ganeriwal e al. in [24] proposed a general repuaion framework for sensor neworks in which each node develops a repuaion esimaion for oher nodes by observing is neighbors which make a rus communiy

13 REZVANI ET AL.: SECURE DATA AGGREGATION TECHNIQUE FOR WIRELESS SENSOR NETWORKS IN THE PRESENCE OF COLLUSION for sensor nodes in he nework. Xiao e al. in [25] proposed a rus based framework which employs correlaion o deec fauly readings. Moreover, hey inroduced a ranking framework o associae a level of rusworhiness wih each sensor node based on he number of neighboring sensor nodes are supporing he sensor. Li e al. in [26] proposed PRESTO, a model-driven predicive daa managemen archiecure for hierarchical sensor neworks. PRESTO is a wo ier framework for sensor daa managemen in sensor neworks. The main idea of his framework is o consider a number of proxy nodes for managing sensed daa from sensor nodes. Lim e al. in [6] proposed an inerdependency relaionship beween nework nodes and daa iems for assessing heir rus scores based on a cyclical framework. The main conribuion of Sun e al. in [27] is o propose a combinaion of rus mechanism, daa aggregaion, and faul olerance o enhance daa rusworhiness in Wireless Mulimedia Sensor Neworks (WMSNs) which considers boh discree and coninuous daa sreams. Tang e al. in [28] proposed a rus framework for sensor neworks in cyber physical sysems such as a bale-nework in which he sensor nodes are employed o deec approaching enemies and send alarms o a command cener. Alhough faul deecion problems have been addressed by applying rus and repuaion sysems in he above research, none of hem ake ino accoun sophisicaed collusion aacks scenarios in adversarial environmens. Repuaion and rus conceps can be used o overcome he compromised node deecion and secure daa aggregaion problems in WSNs. Ho e al. in [29] proposed a framework o deec compromised nodes in WSN and hen apply a sofware aesaion for he deeced nodes. They repored ha he revocaion of deeced compromised nodes can no be performed due o a high risk of false posiive in he proposed scheme. The main idea of false aggregaor deecion in he scheme proposed in [30] is o employ a number of monioring nodes which are running aggregaion operaions and providing a MAC value of heir aggregaion resuls as a par of MAC in he value compued by he cluser aggregaor. High compuaion and ransmission cos required for MAC-based inegriy checking in his scheme makes i unsuiable for deploymen in WSN. Lim e al. in [18] proposed a game-heoreical defense sraegy o proec sensor nodes and o guaranee a high level of rusworhiness for sensed daa. Moreover, here is a large volume of published sudies in he area of secure iny aggregaion in WSNs [31], [32], [33]. These sudies focus on deecing false aggregaion operaions by an adversary, ha is, on daa aggregaor nodes obaining daa from source nodes and producing wrong aggregaed values. Consequenly, hey address neiher he problem of false daa being provided by he daa sources nor he problem of collusion. However, when an adversary injecs false daa by a collusion aack scenario, i can affecs he resuls of he hones aggregaors and hus he base saion will receive skewed aggregae value. In his case, he compromised nodes will aes heir false daa and consequenly he base saion assumes ha all repors are from hones sensor nodes. Alhough he aforemenioned research ake ino accoun false daa injecion for a number of simple aack scenarios, o he bes of our knowledge, no exising work addresses his issue in he case of a collusion aack by compromised nodes in a manner which employs high level knowledge abou daa aggregaion algorihm used. 6 CONCLUSIONS In his paper, we inroduced a novel collusion aack scenario agains a number of exising IF algorihms. Moreover, we proposed an improvemen for he IF algorihms by providing an iniial approximaion of he rusworhiness of sensor nodes which makes he algorihms no only collusion robus, bu also more accurae and faser converging. In fuure work, We will invesigae wheher our approach can proec agains compromised aggregaors.wealsoplanoimplemenourapproachinadeployed sensor nework. REFERENCES [1] S. Ozdemir and Y. Xiao, Secure daa aggregaion in wireless sensor neworks: A comprehensive overview, Compu. New., vol. 53, no. 12, pp , Aug [2] L. Wasserman, All of Saisics : A Concise Course in Saisical Inference. New York, NY, USA: Springer,. [3] A. Jøsang and J. Golbeck, Challenges for robus rus and repuaion sysems, in Proc. 5h In. Workshop Securiy Trus Manage., Sain Malo, France, 2009, pp [4] K. Hoffman, D. Zage, and C. Nia-Roaru, A survey of aack and defense echniques for repuaion sysems, ACM Compu. Surveys, vol. 42, no. 1, pp. 1:1 1:31, Dec [5] R. Roman, C. Fernandez-Gago, J. Lopez, and H. H. Chen, Trus and repuaion sysems for wireless sensor neworks, in Securiy and Privacy in Mobile and Wireless Neworking, S. Grizalis, T. Karygiannis, and C. Skianis, eds.,leiceser, U.K.: Troubador Publishing Ld, 2009 pp ,. [6] H.-S. Lim, Y.-S. Moon, and E. Berino, Provenance-based rusworhiness assessmen in sensor neworks, in Proc. 7h In. Workshop Daa Manage. Sensor New., 2010, pp [7] H.-L. Shi, K. M. Hou, H. ying Zhou, and X. Liu, Energy efficien and faul oleran mulicore wireless sensor nework: E 2 MWSN, in Proc. 7h In. Conf. Wireless Commun., New. Mobile Compu., 2011, pp [8] C. de Kerchove and P. Van Dooren, Ieraive filering in repuaion sysems, SIAM J. Marix Anal. Appl., vol. 31, no. 4, pp , Mar [9] Y. Zhou, T. Lei, and T. Zhou, A robus ranking algorihm o spamming, Europhys. Le., vol. 94, p , [10] P. Laurei, L. More, Y.-C. Zhang, and Y.-K. Yu, Informaion filering via ieraive refinemen, Europhys. Le., vol. 75, pp , Sep [11] Y.-K. Yu, Y.-C. Zhang, P. Laurei, and L. More, Decoding informaion from noisy, redundan, and inenionally disored sources, Physica A: Sais. Mech. Appl., vol. 371, pp , Nov [12] R.-H. Li, J. X. Yu, X. Huang, and H. Cheng, Robus repuaionbased ranking on biparie raing neworks, in Proc. SIAM In. Conf. Daa Mining, 2012, pp [13] E. Ayday, H. Lee, and F. Fekri, An ieraive algorihm for rus and repuaion managemen, Proc. IEEE In. Conf. Symp. Inf. Theory, vol. 3, 2009, pp [14] H. Liao, G. Cimini, and M. Medo, Measuring qualiy, repuaion and rus in online communiies, in Proc. 20h In. Conf. Found. Inell. Sys., Aug. 2012, pp [15] B.-C. Chen, J. Guo, B. Tseng, and J. Yang, User repuaion in a commen raing environmen, in Proc. 17h ACM SIGKDD In. Conf. Knowl. Discovery Daa Mining, 2011, pp [16] C. T. Chou, A. Ignaovic, and W. Hu, Efficien compuaion of robus average of compressive sensing daa in wireless sensor neworks in he presence of sensor fauls, IEEE Trans. Parallel Disrib. Sys., vol. 24, no. 8, pp , Aug [17] Y. Yu, K. Li, W. Zhou, and P. Li, Trus mechanisms in wireless sensor neworks: Aack analysis and counermeasures, J. New. Compu. Appl., vol. 35, no. 3, pp , 2012.

14 110 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 12, NO. 1, JANUARY/FEBRUARY 2015 [18] H.-S. Lim, G. Ghinia, E. Berino, and M. Kanarcioglu, A gameheoreic approach for high-assurance of daa rusworhiness in sensor neworks, in Proc. IEEE 28h In. Conf. Daa Eng., Apr. 2012, pp [19] M. Rezvani, A. Ignjaovic, E. Berino, and S. Jha, Secure daa aggregaion echnique for wireless sensor neworks in he presence of collusion aacks, School Compu. Sci. and Eng., Univ. New Souh Wales, Kensingon, NSW, Ausralia, Tech. Rep. UNSW-CSE-TR , Jul [20] D. Wagner, Resilien aggregaion in sensor neworks, in Proc. 2nd ACM Workshop Securiy Ad Hoc Sens. New., 2004, pp [21] (2004). The Inel lab daa Daa se [Online]. Available: hp:// berkeley.inel-research.ne/labdaa/ [22] B. Awerbuch, R. Curmola, D. Holmer, C. Nia-roaru, and H. Rubens, Miigaing byzanine aacks in ad hoc wireless neworks, Dep. Compu. Sci., Johns Hopkins Univ., Balimore, MD, USA, Tech. Rep., [23] M. C. Vuran and I. F. Akyildiz, Spaial correlaion-based collaboraive medium access conrol in wireless sensor neworks, IEEE/ ACM Trans. New., vol. 14, no. 2, pp , Apr [24] S. Ganeriwal, L. K. Balzano, and M. B. Srivasava, Repuaionbased framework for high inegriy sensor neworks, ACM Trans. Sens. New., vol. 4, no. 3, pp. 15:1 15:37, Jun [25] X.-Y. Xiao, W.-C. Peng, C.-C. Hung, and W.-C. Lee, Using SensorRanks for in-nework deecion of fauly readings in wireless sensor neworks, in Proc. 6h ACM In. Workshop Daa Eng. Wireless Mobile Access, 2007, pp [26] M. Li, D. Ganesan, and P. Shenoy, PRESTO: Feedback-driven daa managemen in sensor neworks, in Proc. 3rd Conf. New. Sys. Des. Implemenaion, vol.3, 2006, pp [27] Y. Sun, H. Luo, and S. K. Das, A rus-based framework for fauloleran daa aggregaion in wireless mulimedia sensor neworks, IEEE Trans. Dependable Secure Compu., vol. 9, no. 6, pp , Nov [28] L.-A. Tang, X. Yu, S. Kim, J. Han, C.-C. Hung, and W.-C. Peng, Tru-Alarm: Trusworhiness analysis of sensor neworks in cyber-physical sysems, in Proc. IEEE In. Conf. Daa Mining, 2010, pp [29] J.-W. Ho, M. Wrigh, and S. Das, ZoneTrus: Fas zone-based node compromise deecion and revocaion in wireless sensor neworks using sequenial hypohesis esing, IEEE Trans. Dependable Secure Compu., vol. 9, no. 4, pp , Jul./Aug [30] S. Ozdemir and H. Çam, Inegraion of false daa deecion wih daa aggregaion and confidenial ransmission in wireless sensor neworks, IEEE/ACM Trans. New., vol. 18, no. 3, pp , Jun [31] H. Chan, A. Perrig, and D. Song, Secure hierarchical in-nework aggregaion in sensor neworks, in Proc. 13h ACM Conf. Compu. Commun. Securiy, 2006, pp [32] Y. Yang, X. Wang, S. Zhu, and G. Cao, SDAP: A secure hop-byhop daa aggregaion proocol for sensor neworks, in Proc. 7h ACM In. Symp. Mobile Ad Hoc New. Compu., 2006, pp [33] S. Roy, M. Coni, S. Seia, and S. Jajodia, Secure daa aggregaion in wireless sensor neworks, IEEE Trans. Inf. Forensics Securiy, vol. 7, no. 3, pp , Jun Mohsen Rezvani received he bachelor s and maser s degrees boh in compuer engineering from he Amirkabir Universiy of Technology and he Sharif Universiy of Technology, respecively. He is currenly working oward he PhD degree in he School of Compuer Science and Engineering a he Universiy of New Souh Wales, Sydney, Ausralia. His research ineress include rus and repuaion sysems in WSNs. He is a suden member of he IEEE and he IEEE Communicaions Sociey. Aleksandar Ignjaovic received he bachelor s and maser s degrees boh in mahemaics from he Universiy of Belgrade, former Yugoslavia, and he PhD degree in mahemaical logic from he Universiy of California a Berkeley. Afer graduaion, he was an assisan professor a he Carnegie Mellon Universiy, where he augh for 5 years a he Deparmen of Philosophy and subsequenly had a sarup in he Silicon Valley. He joined he School of Compuer Science and Engineering a he Universiy of New Souh Wales (UNSW) in 2002, where he eaches algorihms. His research ineress include sampling heory and signal processing, applicaions of mahemaical logic o compuaional complexiy heory, algorihms for embedded sysems design, and mos recenly rus-based daa aggregaion algorihms. Elisa Berino is a professor of compuer science a Purdue Universiy, and serves as he research direcor of he Cener for Educaion and Research in Informaion Assurance and Securiy (CERIAS) and inerim direcor of Cyber Cener (Discovery Park). Previously, she was a faculy member and deparmen head a he Deparmen of Compuer Science and Communicaion of he Universiy of Milan. Her main research ineress include securiy, privacy, digial ideniy managemen sysems, daabase sysems, disribued sysems, and mulimedia sysems. She is currenly he chair of he ACM SIGSAC and a member of he ediorial board of he following inernaional journals: he IEEE Securiy and Privacy, IEEE Transacions on Service Compuing, and he ACM Transacions on Web. She was he edior-in-chief of he VLDB Journal and he ediorial board member of ACM Transacions on Informaion and Sysem Securiy and IEEE Transacions on Dependable and Secure Compuing. She coauhored he book Ideniy Managemen Conceps, Technologies, and Sysems. She received he 2002 IEEE Compuer Sociey Technical Achievemen Award for ousanding conribuions o daabase sysems and daabase securiy and advanced daa managemen sysems, and he 2005 IEEE Compuer Sociey Tsuomu Kanai Award for pioneering and innovaive research conribuions o secure disribued sysems. She is a fellow of he IEEE. Sanjay Jha received he PhD degree from he Universiy of Technology, Sydney, Ausralia. He is a professor and head of he Nework Group a he School of Compuer Science and Engineering a he Universiy of New Souh Wales. He is an associae edior of he IEEE Transacions on Mobile Compuing. He was a member-a-large, Technical Commiee on Compuer Communicaions (TCCC), IEEE Compuer Sociey for a number of years. He has served on program commiees of several conferences. He was he cochair and general chair of he Emnes-1 and Emnes-II workshops, respecively. He was also he general chair of he ACM Sensys 2007 symposium. His research aciviies include a wide range of opics in neworking including wireless sensor neworks, ad hoc/communiy wireless neworks, resilience/qualiy of service (QoS) in IP neworks, and acive/ programmable neworks. He has published more han 100 aricles in high-qualiy journals and conferences. He is he principal auhor of he book Engineering Inerne QoS and a coedior of he book Wireless Sensor Neworks: A Sysems Perspecive. He is a senior member of he IEEE and he IEEE Compuer Sociey. " For more informaion on his or any oher compuing opic, please visi our Digial Library a