Implementing a Broadcast Storm Attack on a
Mission-Critical Wireless Sensor Network

Irina Krivtsova, Ilya Lebedev, Mikhail Sukhoparov, Nurzhan Bazhayev, Igor
Zikratov, Aleksandr Ometov, Sergey Andreev, Pavel Masek, Radek Fujdiak,
Jiri Hosek

► To cite this version:

Irina Krivtsova, Ilya Lebedev, Mikhail Sukhoparov, Nurzhan Bazhayev, Igor Zikratov, et al.. Implementing a Broadcast Storm Attack on a Mission-Critical Wireless Sensor Network. 14th International Conference on Wired/Wireless Internet Communication (WWIC), May 2016, Thessaloniki, Greece. pp.297-308, 10.1007/978-3-319-33936-8_23. hal-01434859

HAL Id: hal-01434859

https://inria.hal.science/hal-01434859

Submitted on 13 Jan 2017

**HAL** is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Implementing a Broadcast Storm Attack
on a Mission-Critical Wireless Sensor Network

Irina Krivtsova<fnref n="1" />, Ilya Lebedev<fnref n="1" />, Mikhail Sukhoparov<fnref n="1" />, Nurzhan Bazhayev<fnref n="1" />,
Igor Zikratov<fnref n="1" />, Aleksandr Ometov<fnref n="2" />, Sergey Andreev<fnref n="2" />,
Pavel Masek<fnref n="3" />, Radek Fujdiak<fnref n="3" />, and Jiri Hosek<fnref n="3" />

**Abstract.** In this work, we emphasize the practical importance of mission-critical wireless sensor networks (WSNs) for structural health monitoring of industrial constructions. Due to its isolated and ad hoc nature, this type of WSN deployments is susceptible to a variety of malicious attacks that may disrupt the underlying crucial systems. Along these lines, we review and implement one such attack, named a broadcast storm, where an attacker is attempting to flood the network by sending numerous broadcast packets. Accordingly, we assemble a live prototype of said scenario with real-world WSN equipment, as well as measure the key operational parameters of the WSN under attack, including packet transmission delays and the corresponding loss ratios. We further develop a simple supportive mathematical model based on widely-adopted methods of queuing theory. It allows for accurate performance assessment as well as for predicting the expected system performance, which has been verified with statistical methods.

**Keywords:** information security, ad hoc networks, multi-agent systems, vulnerability, device availability, prototyping.

# 1 Introduction and Background

The evolution of wireless sensor networks supports increasingly novel and sophisticated applications across various fields [1]. Modern wireless sensor networks (WSNs) find their use in various environments, starting with the marine [2] and vehicular [3] through the forestry [4], and towards the growing industrial Smart Cities [5], [6]. Generally, the main advantage and the limitation of the WSNs is in their ad hoc nature, which makes them easy to deploy but difficult to manage. Most of the practical WSN deployments are utilizing wireless relaying to the remote control center, which brings a variety of potential vulnerabilities to be exploited.

<footnote n="1">¹ Saint Petersburg National Research University of Information Technologies, Mechanics and Optics (ITMO University), St. Petersburg, Russia</footnote>

<footnote n="2">² Tampere University of Technology, Korkeakoulunkatu 10, FI-33720, Finland</footnote>

<footnote n="3">³ Brno University of Technology, Czech Republic, Brno, Technicka 3082/12
Email: aleksandr.ometov@tut.fi</footnote>
Arguably, the most demanding area of the WSN research may be shaped by urban environmental applications [7]. In this work, we focus on a representative urban WSN application for industrial sensing – structural health monitoring [8]. This consent allows to maintain the appropriate condition of engineering structures by deploying sensors in the essential parts of buildings and other constructions, i.e. bridges, tunnels, skyscrapers, etc. The main purpose of such a WSN is to notify the control center about any significant change of the monitored object due to earthquakes, disasters, explosions, or other accidents. A secondary function is to provide continuous health monitoring. As a characteristic example, we may consider the Golden Gate Bridge in San Francisco Bay (shown in Fig. 1), where a similar network was deployed 10 years ago [9].

Clearly, a bridge of any kind is an object of national importance and therefore the serving WSN should be protected from the malicious attackers. However, due to the lack of relevant standardization activities, different manufacturing companies are utilizing a variety of dissimilar security solutions across their deployments, thus making them easier to attack. The use of wireless ad hoc sensor networks for critical applications poses novel information security challenges [10], [11], such as: channel sniffing [12]; packet spoofing [13]; physical access to the device [14]; non-standardized communications protocols [15], and many others. We face the fact that development, deployment, and management of such a network is limiting the chance to use conventional information security solutions [16–18].

<figure><img src="image_2.png" /><figcaption>**Fig. 1.** Example ad hoc WSN deployment for structural health monitoring</figcaption></figure>
In this work, we focus on one of the most threatening attacks on mission-
critical WSNs – the broadcast storm [19]. Broadcasting in any ad hoc network
is an elementary operation required for the core system functionality. However,
intentional broadcasting by flooding may introduce uncontrollable redundancy,
contention, and collisions that would lead to a so-called broadcast storm problem.

The rest of this work is organized as follows. Section 2 introduces the pro-
posed system model for considering a broadcast attack in the network of interest.
Further, in Section 3 we prototype the corresponding ad hoc WSN deployment
and attack it by following said approach. In Section 4, we propose a simple an-
alytical model validating our proposed framework. Finally, the conclusions are
drawn in the last section.

## 2 Considered WSN system model

In this work, we consider a system hosting a number of autonomous wireless
nodes equipped with a set of measuring modules (sensors), and thus the chal-
lenges of efficient data transmission and processing are brought into focus [20].
On the other hand, ad hoc WSNs of this type are susceptible to possible attacks
by implosion, blind flooding and, finally, broadcast storm [21–23].

Focusing primarily on the most challenging broadcast storm concept, the
multicast control messages in a mission-critical WSN may become the main
vehicles of this attack. Therefore, a high number of such packets is affecting the
QoS for each transmitting node, which results in shorter battery life and lower
reliability. The main configuration flaws that may enable such an attack are
listed in what follows:

1. No limitations on the packet time-to-live parameter;

2. A possibility to transmit a broadcast packet from any unknown address in the network;

3. A device that could continuously generate packets.

Our research indicates that the easiest and cheapest way for an attacker to
affect the operation of the ad hoc network in question is to generate harmful
messages, when already residing *inside* the network. This may cause not only a
partial denial-of-service effect for one particular node, but also provoke a fault
of the entire wireless network [24]. Another factor affecting the system operation
with substantial impact is a lack of continuous management and support, i.e. the
network is assumed to be a standalone instance without continuous monitoring
exercised. Some of the devices may become disabled due to natural factors, and
may not be replaced immediately. However, there should always remain a crucial
number of the operational devices available to deliver an alarm message. Sum-
marizing all of the above, in this paper we focus on the problem of probabilistic
device availability estimation in cases of a broadcast storm attack.

The most common implementation of said attack may be described as a
significant increase in the intensity of broadcast requests in the target WSN or
flooding by the attacker device, as it is presented in Figure 2. As each transceiver
node has to rebroadcast the messages, it leads to the difficulties in serving them
over the reliable time. Basically, this scenario would appear when the incoming
buffer of the device is full and/or the wireless channel is congested [25], and thus
the denial-of-service attack is successful [26].

<figure><img src="image_3.png" /><figcaption>Fig. 2. Implementing the broadcast storm attack in an ad hoc WSN</figcaption></figure>

In our target scenario, we employ the widely used WSN technology, IEEE 802.15.4 (ZigBee) [27] under the broadcast storm conditions. The WSN nodes equipped with such a radio module are typically small autonomous devices with limited computational power [28]. They are operating under a predefined configuration and utilize constant set of vendor-specific signaling messages.

3 Prototyping a Broadcast Storm Attack

In order to verify the feasibility of our above discussion, we have conducted a set
of experimental tests utilizing ZigBee-equipped Telegesis ETRX357 devices [29].
The prototype structure is given in Figure 2 and the actual deployment example
is presented in Figure 3. Here, the traffic is transmitted from the device A to the
device B via the relying node. USB-dongle C is utilized as the attacker device,
generating broadcast messages.

The main goal of our installation is to obtain the probabilistic packet loss
values. We assume a high-density industrial WSN deployment, where each node
may receive data not only from its immediate neighbor, but also from the at-
tacker device, thus escalating the effects of the broadcast storm. Node B as the
destination device analyzes the amount of received meaningful data as well as
the share of unclassified (attacker's) packets. The key setup parameters and the
corresponding notation are given in Table 1.

Further, we analyze the impact produced by the attacker on the packet trans-
mission delay, and the respective results are presented in Figures 4(a) and 4(b).
For our test scenario, we utilize two Telegesis command types (i) AT+N and
(ii) AT+SN:00 [30]. The first command has as its main purpose to request the
node's surrounding network information. The second command AT+SN is gen-
erally used to force a particular device to scan the network and "00" causes each
<figure><img src="image_4.png" /><figcaption>Fig. 3. Photo of the practical test deployment</figcaption></figure>

<table><caption>Table 1. Main setup parameters</caption><thead><tr><td>Parameter</td><td>Description</td><td>Practical value</td></tr></thead><tbody><tr><td>λ<sub>p</sub></td><td>Packet arrival rate</td><td>120 packets per second</td></tr><tr><td>λ<sub>sh</sub></td><td>Attacker's packet arrival rate</td><td>1–15 packets per second</td></tr><tr><td>μ</td><td>Packet service rate</td><td>180 packets per second</td></tr><tr><td>n</td><td>Buffer size</td><td>10 packets</td></tr><tr><td>k</td><td>Number of relaying nodes</td><td>1,2,3</td></tr><tr><td>n</td><td>Packet size</td><td>15 kb</td></tr><tr><td>T</td><td>System throughput</td><td>250 kbps</td></tr></tbody></table>

attacked node to search across the entire network for neighbors. As we learn from the test results, by increasing the packet arrival rate one might cause a dramatic surge in the delay of up to 2 times by only introducing 14 additional broadcast messages in our network. Importantly, this extra packet delay has a direct impact on the energy consumption values due to increased packet retransmission cost after a collision in the wireless channel.

We emphasize the fact that prototyping of a large-scale real-world WSN is difficult to implement in the laboratory environment due to the space limitations and thus we decided to support our test deployment with a simple analytical model that can validate and predict the ad hoc WSN behavior under broadcast storm conditions.
<figure><img src="image_5.png" /><figcaption>Fig. 4. Data transmission delay based on the attack's packet arrival rate (prototype)</figcaption></figure>

4 Supportive Analytical Modeling of our Prototype

By employing simple methods of the queuing theory in our model [31], we first
assume that the packet loss probability is not affected by the attacker. We fur-
ther consider that the packet generation intensity on the end-device is given
as a Poisson process and that the packet service interval is distributed expo-
nentially [32]. We verify this hypothesis at the end of this work. Hence, in the
single-relay WSN case the packet loss probability may be calculated as
$$P_l = \rho^n \frac{1 - \rho}{1 - \rho^{n+1}}, \quad \rho = \frac{\lambda}{\mu}, \qquad (1)$$

where $\lambda$ is the packet arrival rate, $\mu$ is the packet service rate, and $n$ is a node's buffer size.

Further, for the multi-relay case we modify Equation (1) accordingly

$$P_l^k = 1 - \left( \rho^n \frac{1 - \rho}{1 - \rho^{n+1}} \right)^k, \qquad (2)$$

where $k$ is the number of relaying hops.

The majority of the analytical frameworks available today do not take into account the attacker [33–36] that can initiate an attack by generating the broadcast messages with higher arrival rate.

Every broadcast packet is served by each attacked WSN node and then forwarded to the following hop. Clearly, that number of nodes under attack could be significantly increased if the attacker would modify the radio equipment by utilizing transmission at higher power.

Further, using Equations (1) and (2), we evaluate the packet loss probability for a network affected by the broadcast storm attack as follows

$$\left\{ \begin{array}{l} P_l^{k=1} = 1 - \left( 1 - \left( \frac{\lambda_p + \lambda_{sh}}{\mu} \right)^n \frac{1 - \left( \frac{\lambda_p + \lambda_{sh}}{\mu} \right)}{1 - \left( \frac{\lambda_p + \lambda_{sh}}{\mu} \right)^{n+1}} \right), k = 1 \\ P_l^{k \ge 2} = P_l^{k=1} \prod_{k=2}^{m} \left( 1 - \left( \frac{\mu + k\lambda_{sh}}{\mu} \right)^n \frac{1 - \left( \frac{\mu + k\lambda_{sh}}{\mu} \right)}{1 - \left( \frac{\mu + k\lambda_{sh}}{\mu} \right)^{n+1}} \right), k \ge 2 \end{array} \right. \qquad (3)$$

where $\lambda_{sh}$ is the attacker packet arrival rate.

In order to quantitatively characterize the proposed prototype, we first study the impact of the system parameters on the packet losses. To this end, Figure 5(a) shows the influence of the attacker's packet generation rate on the WSN packet loss at a fixed WSN node data generation rate. Clearly, by increasing the number of affected relaying nodes system saturation is achieved faster. This is due to the broadcast message distribution, which has repetitive nature.

In our second scenario presented in Figure 5(b), we fix the attacker's packet generation rate and vary that of the WSN node. As we observe in the plots, the ad hoc network is providing a certain level of QoS even in the situation when the node's packet generation rate is higher than the service rate.

Our third scenario depicted in Figure 6 corresponds to a situation, when both node's and attacker's packet generation rates are fixed and only the service rate is varied. Accordingly, for each number of relaying nodes we can find the corresponding lowest service rate to guarantee the minimal reachable packet loss for a particular attacker's packet generation rate.
<figure><img src="image_6.png" /></figure>

<figure><img src="image_7.png" /><figcaption>Fig. 5. Impact of packet generation rate on packet loss rate</figcaption></figure>

Furthermore, our simple analytical model is able to probabilistically predict the likely ad hoc WSN conditions taking into account the effects of the broadcast storm attack that alters the underlying packet generation rate.

Finally, we compare the analytical and prototype packet loss performance based on the key system parameters given in Table 1. By focusing on the obtained prototype-driven results and those delivered by our analytical prediction, as summarized in Figure 7, it can be concluded that the analytical and the experimental values agree within acceptable bounds.
<figure><img src="image_8.png" /><figcaption>**Fig. 6.** Impact of packet service rate on the system packet loss rate under broadcast storm attack $\lambda_p = \lambda_{sh}$</figcaption></figure>

<figure><img src="image_9.png" /><figcaption>**Fig. 7.** Analytical results agreeing with our experimental setup</figcaption></figure>
To confirm the obtained results, we have additionally verified our prototype-
based and analytical data using Pearson's chi-squared test [37] with α = 0.05
by executing the set of 100 independent trials. Therefore, it could be concluded
that the resulting difference between the compared distributions of the packet
loss values in a realistic WSN under the broadcast storm conditions is statisti-
cally insignificant. Thereby, our initial assumption on the Poisson packet arrival
distribution and the exponential service time distribution are practical.

5 Conclusions

This paper developed a model and a respective practical prototype of a broad-
cast storm attack, which may disrupt the desired reliable operation of a mission-
critical WSN deployment. To this end, we collected the packet loss probabil-
ities together with the packet transmission delays produced with our testbed,
and compared some of those against the corresponding values provided with
our simple queuing theoretic model. The obtained results not only evidence the
feasibility of this convenient custom-made approximation for predicting the op-
erational parameters of a real-world WSN under attack, but also help identify
conditions that become threatening for the intended operation of the industrial
monitoring system under consideration.

References

1. S. S. Iyengar and R. R. Brooks, *Distributed Sensor Networks: Sensor Networking and Applications*. CRC press, 2012.

2. J. Hendee, L. Gramer, S. Heron, M. Jankulak, N. Amornthammarong, M. Shoe-
maker, T. Burgess, J. Fajans, S. Bainbridge, and W. Skirving, "Wireless architec-
tures for coral reef environmental monitoring," in *Proc. of 12th International Coral
Reef Symposium*, Cairns, Australia, 2012.

3. A. Vinel, V. Vishnevsky, and Y. Koucheryavy, “A simple analytical model for the periodic broadcasting in vehicular ad-hoc networks,” in *Proc. of GLOBECOM Workshops*, pp. 1–5, IEEE, 2008.

4. Y. E. Aslan, I. Korpeoglu, and Ö. Ulusoy, “A framework for use of wireless sensor networks in forest fire detection and monitoring,” *Computers, Environment and Urban Systems*, vol. 36, no. 6, pp. 614–625, 2012.

5. M. Dohler, I. Vilajosana, X. Vilajosana, and J. LLosa, “Smart cities: An action plan,” in *Proc. of Barcelona Smart Cities Congress*, 2011.

6. S. Andreev, P. Gonchukov, N. Himayat, Y. Koucheryavy, and A. Turlikov, “Energy efficient communications for future broadband cellular networks,” *Computer Communications*, vol. 35, no. 14, pp. 1662–1671, 2012.

7. B. Rashid and M. H. Rehmani, “Applications of wireless sensor networks for urban areas: A survey,” *Journal of Network and Computer Applications*, 2015.

8. S. Kim, S. Pakzad, D. Culler, J. Demmel, G. Fenves, S. Glaser, and M. Turon, “Health monitoring of civil infrastructures using wireless sensor networks,” in *Proc. of 6th international symposium on Information processing in sensor networks (IPSN)*, pp. 254–263, IEEE, 2007.
9. S. N. Pakzad, S. Kim, G. L. Fenves, S. D. Glaser, D. E. Culler, and J. W. Demmel, "Multi-purpose wireless accelerometers for civil infrastructure monitoring," in *Proc. of 5th International Workshop on Structural Health Monitoring (IWSHM)*, 2005.

10. P. Kumar, M. Ylianttila, A. Gurtov, S.-G. Lee, and H.-J. Lee, "An efficient and adaptive mutual authentication framework for heterogeneous wireless sensor network-based applications," *Sensors*, vol. 14, no. 2, pp. 2732-2755, 2014.

11. P. Sridhar, S. Sheikh-Bahaei, S. Xia, and M. Jamshidi, "Multi-agent simulation using discrete event and soft-computing methodologies," in *Proc. of International Conference on Systems, Man and Cybernetics*, vol. 2, pp. 1711–1716, IEEE, 2003.

12. J. Wright, "Killerbee: practical ZigBee exploitation framework," in *Proc. of 11th ToorCon Conference, San Diego*, 2009.

13. Y. Chen, W. Xu, W. Trappe, and Y. Zhang, "Detecting and localizing wireless spoofing attacks," in *Securing Emerging Wireless Systems*, pp. 1–18, Springer, 2009.

14. N. Patwari, A. O. Hero III, M. Perkins, N. S. Correal, and R. J. O’dea, “Relative location estimation in wireless sensor networks,” *IEEE Transactions on Signal Processing*, vol. 51, no. 8, pp. 2137–2148, 2003.

15. J. Hosek, P. Masek, D. Kovac, M. Ries, and F. Kropfl, “Universal smart energy communication platform,” in *Proc. of International Conference on Intelligent Green Building and Smart Grid (IGBSG)*, pp. 1–4, IEEE, 2014.

16. M. Conti and S. Giordano, "Mobile ad hoc networking: milestones, challenges, and new research directions," *IEEE Communications Magazine*, vol. 52, no. 1, pp. 85–96, 2014.

17. J. Page, A. Zaslavsky, and M. Indrawan, "Countering security vulnerabilities using a shared security buddy model schema in mobile agent communities," in *Proc. of the First International Workshop on Safety and Security in Multi-Agent Systems (SASEMAS 2004)*, pp. 85–101, 2004.

18. I. A. Zikratov, I. S. Lebedev, and A. V. Gurtov, "Trust and reputation mechanisms for multi-agent robotic systems," in *Internet of Things, Smart Spaces, and Next Generation Networks and Systems*, pp. 106–120, Springer, 2014.

19. Y.-C. Tseng, S.-Y. Ni, and E.-Y. Shih, "Adaptive approaches to relieving broadcast storms in a wireless multihop mobile ad hoc network," *IEEE Transactions on Computers*, vol. 52, no. 5, pp. 545–557, 2003.

20. A. M. Wyglinski, X. Huang, T. Padir, L. Lai, T. R. Eisenbarth, and K. Venkata-subramanian, "Security of autonomous systems employing embedded computing and sensors," *Micro, IEEE*, vol. 33, no. 1, pp. 80–86, 2013.

21. J. Lipman, H. Liu, and I. Stojmenovic, "Broadcast in ad hoc networks," in *Guide to wireless ad hoc networks*, pp. 121–150, Springer, 2009.

22. Y.-C. Hu, A. Perrig, and D. B. Johnson, "Rushing attacks and defense in wireless ad hoc network routing protocols," in *Proc. of the 2nd ACM workshop on Wireless security*, pp. 30–40, ACM, 2003.

23. Y.-C. Tseng, S.-Y. Ni, Y.-S. Chen, and J.-P. Sheu, "The broadcast storm problem in a mobile ad hoc network," *Wireless networks*, vol. 8, no. 2-3, pp. 153–167, 2002.

24. D. G. Korzun, I. Nikolaevskiy, and A. Gurtov, "Service intelligence support for medical sensor networks in personalized mobile health systems," in *Internet of Things, Smart Spaces, and Next Generation Networks and Systems*, pp. 116–127, Springer, 2015.

25. C. Kelly IV, V. Ekanayake, and R. Manohar, "SNAP: A sensor-network asynchronous processor," in *Proc. of 9th International Symposium on Asynchronous Circuits and Systems*, pp. 24–33, IEEE, 2003.
26. M. K. Denko, "Detection and prevention of denial of service (dos) attacks in mobile ad hoc networks using reputation-based incentive scheme," *Journal of Systemics, Cybernetics and Informatics*, vol. 3, no. 4, pp. 1-9, 2005.

27. S. Xu, Y. Man, H. He, L. Zhao, Y. Zheng, and T. Wang, "A security personnel information collection system based on ZigBee wireless ad-hoc network," in *Proc. of International Conference on Computer and Communications (ICCC)*, pp. 410-414, IEEE, 2015.

28. S. Andreev, Y. Koucheryavy, N. Himayat, P. Gonchukov, and A. Turlikov, "Active-mode power optimization in OFDMA-based wireless networks," in *Proc. of GLOBECOM Workshops*, pp. 799-803, IEEE, 2010.

29. Telegesis, "The ETRX357-DVK development kit is an ideal starting point for development and evaluation of the ETRX357 2.4GHz ZigBee modules." http://www.telegesis.com/products/etrx3-based-products/etrx3-zigbee-development-kit/, February 2016.

30. Telegesis, "ETRX2 and ETRX3 Series ZigBee Modules AT-Command Dictionary." http://www.telegesis.com/download/document-centre/etrx3_technical_manuals/TG-ETRXn-R308-Commands.pdf, December 2014.

31. N. Bisnik and A. A. Abouzeid, "Queuing network models for delay analysis of multihop wireless ad hoc networks," *Ad Hoc Networks*, vol. 7, no. 1, pp. 79-97, 2009.

32. S. Andreev, O. Galinina, and Y. Koucheryavy, "Energy-efficient client relay scheme for machine-to-machine communication," in *Proc. of Global Telecommunications Conference (GLOBECOM 2011)*, pp. 1-5, IEEE, 2011.

33. J. Zhao, R. Govindan, and D. Estrin, "Computing aggregates for monitoring wireless sensor networks," in *Proc. of the First International Workshop on Sensor Network Protocols and Applications*, pp. 139-148, IEEE, 2003.

34. Y. Ni, X. Ye, and J. Ko, "Monitoring-based fatigue reliability assessment of steel bridges: analytical model and application," *Journal of Structural Engineering*, vol. 136, no. 12, pp. 1563-1573, 2010.

35. D. Moltchanov, Y. Koucheryavy, and J. Harju, "Simple, accurate and computationally efficient wireless channel modeling algorithm," in *Wired/Wireless Internet Communications*, pp. 234-245, Springer, 2005.

36. Z. Li, T. H. Chan, and J. M. Ko, "Fatigue analysis and life prediction of bridges with structural health monitoring data—part i: methodology and strategy," *International Journal of Fatigue*, vol. 23, no. 1, pp. 45-53, 2001.

37. K. Pearson, "X. on the criterion that a given system of deviations from the probable in the case of a correlated system of variables is such that it can be reasonably supposed to have arisen from random sampling," *The London, Edinburgh, and Dublin Philosophical Magazine and Journal of Science*, vol. 50, no. 302, pp. 157-175, 1900.