Security Threats in Wireless Sensor Networks: Implementation of Attacks & Defense Mechanisms

Over the last few years, technological advances in the design of processors, memory, and radio communications have propelled an active interest in the area of distributed sensor networking, in which a number of independent, self-sustainable nodes collaborate to perform a large sensing task. Networks of such devices, commonly referred to as Wireless Sensor Networks (WSNs), are edging closer to widespread feasibility and have enabled the design and proliferation of new intelligent sensor-based environments in a variety of application domains. Security and privacy are rapidly replacing performance as the first and foremost concern in many sensor networking scenarios. While security prevention is important, it cannot guarantee that attacks will not be launched and that, once launched, they will not be successful. Not all types of attacks are known, and new ones appear constantly. Therefore, detection of malicious intrusions forms an important part of an integrated approach to network security. In this work, we start by considering the problem of cooperative intrusion detection in WSNs where the nodes are equipped with local detector modules and have to identify the intruder in a distributed fashion. We develop a lightweight ID system, called LIDeA, which follows an intelligent agent-based architecture. In LIDeA, nodes overhear their neighboring nodes and collaborate with each other in order to successfully detect an intrusion. We show how such a system can be implemented, which components and interfaces are needed, and what is the resulting overhead imposed. We then expand this ID framework with algorithms that incorporate both classes of intrusion detection techniques, i.e., misuse detection and anomaly detection. We investigate in depth some of the most severe routing attacks against sensor networks, namely the sinkhole and wormhole attacks, and we emphasize on strategies that an attacker can follow to successfully launch them. Then we propose novel localized countermeasures that can make legitimate nodes become aware of the threat, while the attack is still taking place. Detailed theoretical analysis and simulation results confirm that the proposed algorithms can always thwart these kinds of attacks. Also, by providing an implementation on real sensor devices, we demonstrate their practicality and efficiency in terms of memory requirements and processing overhead. However, one of the reasons that the research of intrusion detection has not advanced significantly is that the concept of intrusion is not clear in these networks. Little work has been done to demonstrate how vulnerable, in terms of data confidentiality and network availability, sensor networks are. The best way to do that is to look into new threat models, how specific attacks can be realized in practice and study new methods from the attacker’s point of view. Motivated by this unexplored security aspect, we investigate a new set of memory related vulnerabilities for sensor embedded devices that, if exploited, can lead to the execution of software-based attacks. We demonstrate how to execute malware on wireless sensor nodes that are based on the Von Neumann architecture. Then we proceed to show how the malware can be crafted to become a self-replicating worm that broadcasts itself and infects the network in a hop-by-hop manner. This is the first instance of a “sensor worm” that provides a detailed analysis along with instructions in order to execute arbitrary malicious code. While such attacks are extremely dangerous, there has been very little research in this area. This new threat model sets the scene for the development of sophisticated attack tools (SenSys and SpySense) capable of launching various kinds of attacks for compromising the network’s functionality. They can be useful not only in revealing all the weaknesses that make sensor networks susceptible to various kinds of threats but also in studying the effects of such exploits on the network itself. The SenSys tool allows both passive monitoring of transactional data in sensor networks, such as message rate, mote frequency, message routing, etc., but also discharge of various attacks against them. On the other hand, Spy-Sense is a spyware tool that allows the injection of stealthy exploits in the nodes of the network. It is undetectable, hard to recognize and get rid of, and once activated, it runs discretely in the background without interfering or disrupting normal network operation. To the best of our knowledge, these are the first instances of attack tools that can be used by an adversary to crack the confidentiality and functionality of a sensor network. Our goal is to describe the “best” ways for launching already existing attacks and demonstrate new ones in practice. This in turn can lead to the development of more secure applications and better detection/prevention mechanisms in WSNs. English-Danish Short Summary This thesis considers detection of security threats in Wireless Sensor Networks. Part I is dedicated to security defense mechanisms, proposing an implementation of a decentralized Intrusion Detection System (IDS) that is based on an autonomic principle of cooperation between nodes. It also expands this IDS framework (i.e., LIDeA) with novel algorithms and rules that can make legitimate nodes become aware of threats like the sinkhole and wormhole attacks. Part II is focused on sophisticated malicious attacks against WSNs including the extensive study of new threat models from the attacker’s point of view, as well as their realization in practice. Malicious code injection attacks are discussed and two novel attack tools, namely Spy-Sense and SenSys, are demonstrated for penetrating a network’s security profile. Denne afhandling omhandler detektering af sikkerhedstrusler i tr̊adløse sensor netværk. Den første del er dedikeret til mekanismer til forsvar ad sikkerheden og foresl̊ar en implementering af et decentralt Intrusion Detection System (IDS), der er baseret p̊a et autonomt princip for samarbejde mellem sensornoder. Dette IDS framework udvides (dvs. LIDeA) med nye algoritmer og regler, der kan gøre legitime sensornoder opmærksomme p̊a trusler s̊asom sinkhole og wormhole angreb. Den anden del af afhandlingen er fokuseret p̊a ondsindede sofistikerede angreb mod tr̊adløse sensor netværk herunder et omfattende studie af nye trusselsmodeller, der kan benyttes af en indtrænger, s̊avel som deres realisering i praksis. Angreb med injektion af ondsindet kode diskuteres og to nye angrebsværktøjer, kaldet Spy-Sense og SenSys, demonstreres til at trænge igennem et netværks sikkerhedsprofil. This thesis is dedicated to my family who has given me the best possible guidance throughout my life.