DEIM Forum 2019 A8-1

Fuzzy logic and ECA rules-based misbehaving-node detection forcluster-based heterogeneous IoT systems
Nesrine BERJAB† , Hieu Hanh LE† , Chia-Mu YU†† , Sy-Yen KUO††† , and Haruo YOKOTA†† Tokyo Institute of Technology, 2-12-1 Ookayama, Meguro-ku, Tokyo 152-8550, Japan†† National Chung Hsing University, 145 Xingda Road, South District, Taichung City 40227, Taiwan††† National Taiwan University, No. 1, Section 4, Roosevelt Road, Taipei 10617, Taiwan
E-mail: †{berjab,hanhlh}@de.cs.titech.ac.jp, ††chiamuyu@gmail.com, †††sykuo@ntu.edu.tw,††††yokota@cs.titech.ac.jp
Abstract The IoT devices have been the subject of much interest. Nevertheless, these devices are resource constrained and susceptible to false-data-injection attacks and failures, leading to unreliable and inaccurate sensor
readings. In this paper, we propose a hierarchical framework for detecting misbehaving nodes in WSNs. It uses
fuzzy logic in event-condition-action (ECA) rule-based WSNs to detect malicious nodes, while also considering
failed nodes. The spatiotemporal semantics of heterogeneous sensor readings are considered in the decision process
to distinguish malicious data from other anomalies. Our experiments using real-world dataset demonstrate that ourapproach can provide high detection accuracy with low false-alarm rates.
Key words Internet of things, wireless sensor network, security, misbehaving node detection, fuzzy logic, sensor
correlation, ECA rules

1.

Introduction

even to real-world damage. Indeed, sensor nodes are often
exposed to open or hostile environments. This makes it easy

The Internet of Things (IoT) can be described as a dy-

for attackers to compromise some of the sensor nodes andnamic and distributed networked system that uses wirelessmanipulate the integrity of the sensed data, e.g., by inject-connectivity and is composed of a wide range of uniquely

ing fake packets. As far as we know, the area of false-data-

identifiable embedded computer-like devices. One of the es-

injection attacks (FDIAs) detection for IoT is yet to receive

sential elements of the IoT paradigm is the wireless sensor

the attention it deserves. Most previous intrusion detection

network (WSN). WSNs are composed of smart-sensor nodes

methods proposed for IoT, particularly for WSNs, focus onlythat monitor their environmental conditions, report sensor

on specific types of network attack. Few approaches havedata, and perform appropriate actions in response to theincluded an eﬃcient, adaptive WSN intrusion-detection ap-

surrounding circumstances.

plication that considers methods for programming the sensor

However, these sensor nodes suﬀer from resource con-nodes.

straints such as processing power, memory, and energy sup-To answer these challenges and to guarantee reliable mon-ply. Moreover, because of the absence of appropriate high-itoring in WSNs, we propose a new hierarchical frameworklevel abstractions to simplify the programming of WSNs, ap-

based on fuzzy logic for detecting misbehaving nodes inplication development remains challenging. In the IoT do-

event-condition-action (ECA) rule-based WSNs. Our contri-

main, “If-This-Then-That” is an example of an abstraction.

bution is to provide an integrated solution for programming

It is a simple rule that triggers an action if a particular eventthe sensor nodes and distributedly detecting misbehaving

occurs. For example, “If the room temperature increases,

nodes in hierarchical heterogeneous WSNs. By controllingthen regulate the air conditioner to cool the room.” However,the sensor nodes according to a set of ECA rules, we canthe interaction between the two devices involved has a secu-

better express network behaviors and detect malicious nodes

rity issue. Decisions are taken by considering only the output

while considering failed nodes. Identification of failed nodesof the devices without observing whether their current oper-

is the first step in countering the threats against WSN reli-ational state is normal or on a state of misbehaving. Suchability. In this paper, we consider that when a node fails, it

incomplete specifications will lead to inaccurate and unreli-stops sensing the environment and sending report messages.

able sensor readings that may lead to incorrect decisions andTherefore, based on a preliminary analysis of potential fail-ure in sensor nodes, the values for newly collected sensed

or failed nodes. Therefore, the false-alarm rate is high be-data are further analyzed to increase the attack detection

cause malicious or abnormal readings are also considered asrate and reduce the false positive rate. To achieve this, weevents. In [5], the authors propose distributed anomaly de-use a fuzzy logic module [1] to treat the ambiguity in thetection by assuming an environment monitored by homoge-

decision-making process. It arrives at a conclusion basednous sensors. A monitored area should involve not only a set

on spatiotemporal (ST) and multivariate attribute (MVA)of homogenous sensors but also some heterogeneous sensors.

sensor correlations to distinguish malicious sensor data from

By capturing the MVA sensor correlations, we can confirm

other anomalies. This proposed fuzzy logic-based detection

whether the attributes collectively imply an anomaly.

is our first contribution in this paper. It can better detect

Moreover, the detection architectue plays an important

FDIAs attacks because the rule base contains a better set ofrole the the accuracy of the analysis. In [5], the authors

rules.

adopt a traditional, centralized approach to detection. It

Because of the various limitations of synthetic datasets, inneeds to collect a significant volume of sensed data. The

this paper, we use a specialized real-world dataset for WSNs

larger volume of the collected data generated by centralizedthat was collected to evaluate the detection eﬃciency of ourdetection, results in lack of scalability and usually introduces

approach under realistic conditions. The evaluation involves

a delay between the moment the data is collected and whenreal WSN data rather than simulated data, and this is ourthe data intrusion system can have access to them. In [4],second contribution in the paper. Following our experimentsa rule-based distributed fuzzy inference system for WSNs iswith the proposed framework, we stress the significance ofproposed that uses the spatial correlation (ST) from the ob-

considering fuzzy logic and the sensor correlations to achieve

served sensor readings, to identify the occurrence of events.

a higher detection accuracy, which has been neglected in pre-Their experimental results showed that using a fuzzy logic-

vious studies. Our experiments demonstrate that our ap-

based distributed detection improves the accuracy of theproach can provide high detection accuracy with low false-

event detection. However, each node was required to ex-

alarm rates. We also show that our approach performs wellchange and process a significant amount of data from neigh-when compared to two well-known classification algorithms.

boring nodes. Therefore, communication and computation

The remainder of this paper is organized as follows. We

overheads are introduced, which will decrease the usage time

provide an overview of existing approaches in Section 2. Sec-of the sensor nodes’ batteries.

tion 3 describes some preliminary ideas before introducing

Nevertheless, none of these approaches considered methods

our approach. Our proposed scheme is presented in Section

for developing adaptive WSN applications. However, a few

4. Our experiments and results are presented in Section 5,

proposals for eﬃcient WSN applications consider methods

together with a performance evaluation. Finally, Section 6

for programming the sensor nodes. In [7], the author intro-

concludes the paper and describes possible future work.

duces increased flexibility in programming WSNs, but theThis paper is a revised version of a paper entitled Hierar-

proposed solution involves significant overheads. In [8], anchical Abnormal-node Detection using Fuzzy Logic for ECAECA rule-based model is used to describe business rules forrule-based Wireless Sensor Networks by the same authors.

sensor nodes, which are designed to express service-oriented

The earlier version was presented at the IEEE 23rd Pacificbusiness logic in a compact form.

Rim International Symposium on Dependable Computing(PRDC) [2].

Concretely, we propose a new integrated approach forprogramming the sensor nodes and distributedly detecting
the misbehaving-nodes in hierarchical heterogeneous WSNs.

2.

Related Work

Failures and network detections for IoT systems have been
explored a lot over decades. However, as far as we know,
the area of FDIAs for WSN is yet to receive much attention. Moreover, they usually rely on using precise values to

The detection process is controlled by ECA rules, and thespatiotemporal semantics correlations of heterogeneous sensor readings are considered in the decision analysis.

3.

Preliminaries

specify anomalies thresholds and ignore consideration of the

In this section, we describe the characteristics of our pro-dependencies that exist between sensor data. Indeed most

posed framework and discuss some assumptions about theof the exisitng works uses either ST correlations, and few

monitoring environments considered in this paper.

have considered the MVA correlations. In [3,4], the authors

3.1.

System model

use spatial correlation to detect events within WSNs, with-

An environmental monitoring application in a WSN is de-out considering the possibility of the presence of malicious

fined as an application that monitors the real world and is-sues a report whenever an event of interest occurs. The appli-

3.2.

Permanent Failures and FDIAs model

cation for environment monitoring considered here has sev-

Our objective is to detect misbehaving sensor nodes. In

eral heterogeneous sensor nodes deployed wirelessly within

this paper, we mainly focus on detecting permanent failures.

the monitored areas.

A permanent failures is when there is a hardware defect, andThis paper addresses the network-

the sensor node completely shuts down. We also cover the
problem of malicious attack detection. Precisely, the issue of
FDIAs detection. FDIAs is a significant threat and crucial
for the case of systems where the actuator takes decisions
based on the collected sensor data [10]. Furthermore, it is
Figure 1: Hierarchical distributed WSN based on two-level

known for its diﬃculty to be detected by the conventional

clustering

IDS. If the attacker can recognize the standard conditionsof the monitored environment or some system parameters,

scalability issue by adopting a hierarchical, distributed WSN

he can easily inject false data into the regular sensor read-

topology based on two-level clustering. Figure 1 depicts theings without being detected by the IDS. In this paper, wetopology of this hierarchical network. To implement suchconsider two types of realistic attack goal such as randoma thorough monitoring system, n sensor nodes (S1 , S2 ,. . . ,FDIAs, in which the attacker aims to compromise the sensor

Sn ) called cluster members (CMs), are grouped into a ho-readings data randomly, and specefic FDIAs, in which the

mogenous group according to their type. Each homogeneous

attacker injects a specific value within the pre-defined range.

group is controlled by a cluster aggregator (CA), who is re-3.3.

sponsible for all communications between the CM nodes andOur research is based on the following assumptions.

the upper level of the hierarchy. These homogenous groups
are separated into clusters, each covering a diﬀerent area.

Assumptions

1) Every sensed environment is characterized by its own
environmental conditions.

Each cluster should include one cluster head (CH), who is2) All clusters must be composed of both homogeneous andresponsible for all communications between the CA nodes

heterogeneous sensor nodes, to maintain high event-detection

and the base station (BS). All the sensor nodes have two

accuracy.

primary functionalities: i.e., environmental monitoring and3) N-modular redundancy is used to achieve a dependable

data aggregation. Each CM monitors the environment, col-and fault-tolerant WSN. The considered WSN must satisfy

lects newly sensed data and reported to the higher level.

a good distribution of the clusters, where at least three sen-

Each CA and CH aggregates the received reports from thesor nodes for each type must be deployed within one cluster

lower level (CM and CH, respectively) and then send a com-

(i.e., triple modular redundancy (TMR) is a particular casebined report to a higher-level node (CH or BS, respectively).

of N-modular redundancy).

By adopting this topology, the network scalability for largescale WSNs can be achieved.

Although several complex

4) The attacker knows the physical conditions of the monitored environment.

and innovative clustering techniques have been proposed for5) While some sensor nodes may be compromised, we as-

WSNs, we consider a very simple clustering technique for en-

sume that most of the sensor nodes will remain trustworthy.

vironmental monitoring in WSNs. The clustering formation

Moreover, we assume that any sensor node might become

is based on a defined distance threshold between the sensor

compromised and behave maliciously, except for the BS, CHs

nodes.

and CAs.

In our WSN, the sensor nodes are controlled according toa set of ECA rules. ECA rules are widely used for controlling4.

an environment and act to control the system configuration.

The proposed approach needs to consider changes in the

ECA rules comprise a set, whereby each rule in the set reacts

environmental conditions, perform appropriate actions toto a detected event by evaluating a condition and executing

identify malicious and failed nodes, and report such nodes toan action whenever the event happens and the condition is

the BS. In this paper, we propose a new framework for de-verified [9]. In our system, the set of ECA rules describe

tecting malicious nodes in a heterogeneous WSN while con-the behavior of the sensor nodes and perform the requiredsidering the failed nodes. The proposed approach adopts

actions only when the relevant events happen and their con-a hierarchical detection framework based on fuzzy logic forditions are verified. The ECA rules are independent of other

ECA rule-based WSN. By defining a set of ECA rules, we canrules in the system (fuzzy rules). The structure of each ruledescribe the behavior of the sensor nodes and identify misbe-

is ON Event IF Condition THEN Action.

Proposal

having nodes. Figure 2 shows an example of the ECA rulesof detection: i.e., local detection, group detection, andused for our WSN. If the sensed data value is outside a pre-cluster detection. As illustrated in Figure 3, each CM mon-defined range, this node is reported as an misbehaving node.

itors the environment and collects newly sensed data. The

Alternatively, if there is no data reported from a sensor node,

CM then analyzes this data by executing the fuzzy-basedthen this node is reported to the BS as having failed. How-

local-detection process. This local decision about malicious-

ever, it is infeasible for the sensor node to decide that any

ness will be reported to the CA. After the CA receives all

abnormal data detected originates from attacks using only

the reports from its CMs (homogenous sensor nodes), the CA

simple rules and the raw sensor node data. Therefore, based

executes the fuzzy-based group-detection process, to createon the preliminary failure analysis, the value of sensed dataa more accurate decision. By considering the CMs’ local de-should be further analyzed to increase the malicious-nodecisions in its group, the CA generates the group decision anddetection rate and reduce the false-positive rate. To achieve

reports it to the CH. After the CH receives all the reports

this, we add fuzzy logic to the detection module to treat thefrom its CAs (heterogeneous sensor nodes), the CH executes

ambiguities in the decision-making process. By considering

the fuzzy-based cluster-detection process. This process’ final

the MVA and ST sensor correlations, the fuzzy rule base will

decision will be reported to the BS. The three fuzzy detection

contain a better set of rules to derive a conclusion about

modules are described in detail in the following subsections.

whether a sensor node is malicious.

Figure 2: ECA rule-based WSN description example

An overview of our proposed approach is depicted in Figure 3, which shows the various sensor-node modules and theflow chart for processing misbehaving nodes according to the

Figure 3: Hierarchical detection modules according to therole of each sensor noderole of the CH and CA sensor nodes. Each CM monitors theenvironment and collects newly sensed data. Each CA andCH aggregates the received reports from the lower level (CMand CH, respectively) and then sends a combined report toa higher-level node (CH or BS, respectively).
Each sensor node has a misbehaving-node detection module. This module has two submodules. The first is a failuredetection module that checks whether there are permanent
failed nodes. Sensor nodes may be prone to many types of
hardware failure induced by a power surge, weak batteries,
loss of signal, or corruption of the external memory. As aresult, the sensor nodes will be unable either to sense dataor report sensed data to higher-level sensor nodes. If a nodestops sending reports, the higher-level node concludes thatthe sensor node has incurred a permanent failure and reacts
by reporting it to the BS. The BS then may issues instructions about reorganizing the grouping or clustering arrangements.

Local detection by the CMs

Each CM senses environmental events and executes the
local detection process to check whether the newly collected
data is subject to attack.
4.1.1.

Temporal average similarity

The local detection module considers temporal semantic
correlations to derive a crisp local decision. Every CM maintains a short-term history of the collected sensed data. Thisaggregation of data is used to construct a sliding time window containing the most-recent sensed data in the sensornode stream. In the literature of stream processing, sliding
time windows are a familiar concept [11]. In this paper, we
use the sliding time window to profile the behavior of the sensor node readings over time. The sensed data will be timecorrelated and the variation range will usually be small inthe short term. The sensed data contains an k-second timestamp, which indicates the time at which the sensor node

The second misbehaving-node detection submodule isa fuzzy-based detection module that checks for malicious nodes.

4.1.

The detection process involves three stages

reported the reading. The sensor node time-series samples
are grouped into (l +1)-second frames to compose the sliding
time-window model, where l ∈ {0, p}. As time passes, thewindow slides in one-frame increments over the sensor nodetime series. Each frame groups the raw sensor node-data

Table 1: Rule base for temperature sensor nodes
Rule ID

samples according to a certain number of epochs ek , where1k ∈ {1, o} . After setting the sliding time window, we apply
a summarization function to extract the relevant informa-

Temperature TAS CT Malicious
VL

S

Mo

H

2

VL

B

A

H

3

MH

B

A

L

tion about sensor-node temporal similarity. For example, we

4

MH

S

N

H

consider a sliding window composed of three frames. Each

5

LM

S

N

M

the current epoch. f1 is the frame for the o previous epochs.

6
..
.

LM
..
.

S
..
.

A
..
.

H
..
.

Let l + 1 be the size of the sliding time window and k be

32

MH

B

M

L

frame is composed of three epochs. f0 is the frame containing

the number of epochs within each frame. For each frame f− lwithin the window, we calculate the temporal similarity be-monitored by sensor nodes for temperature, humidity, light,

tween the frame f− l and the current frame f0 . The temporaland smoke density. For each type of sensor node, the local

similarity is given by equation (1).

detection module takes three linguistic variables as its input.

q(f−l , f0 ) =
(1 +

√∑
o

1

k=1 Si (ek )f− l − Si (ek )f0 )

(1)
2

))

The sensed-value input will be one of temperature, humidity,
light, or smoke. In the fuzzification process, the three crisp
values are converted into degrees of membership by applying

The average similarity between the current frame data andthe corresponding MF. The MF for the temperature variable

the data in the window is then calculated. As indicated in

has four semantic values: i.e., very low VL, low-to-medium

equation (2), the average similarity is calculated by adding a

LM, medium-to-high MH, and very high VH. The MFs forweighted summation to the calculation. The closer the frame

the humidity, light, and smoke variables have three seman-is to the current time frame, the more it is correlated. More-tic values: i.e., low L, medium M, and high H. The MF for

over, the smaller the average similarity, the more the frame

average temporal similarity TAS has 2 semantic values: i.e.,at the current time deviates from the historical sensor node

small S and big B. Finally, the MF for the current time CTdata.

has 4 semantic values: i.e., night N, morning Mo, afternoon∑p
Q(f0 ) =l+1
1
where the weight: wl =(eo )f0 − (eo )f−l

4.1.2.

A, and evening E. The confidence about malicious detection

l=1 wl q(f−l , f0 )(2)

Fuzzification and Defuzzification

is defined as the output. The MF for the fuzzy output variable is defined in terms of three levels: i.e., low L, medium
M, or high H.
After being fuzzified, the fuzzy inputs are then fed into theAfter the CM finishes the calculation of the average tem-fuzzy inference process. The fuzzy rule base manages the in-poral similarity, it conducts the fuzzy local-detection pro-ference to yield a fuzzy output. A fuzzy rule base comprises

cess. Together with the temporal average-similarity value

a set of rules designed to decide the probability of the node

obtained, both the current raw sensed value Si (t) and its ac-

being compromised. By considering the ST and MVA sensor

tual time of collection are fuzzified through predefined mem-correlations, we use heuristics to build the rule base for ourbership functions (MFs). The monitored environment canmalicious-detection experiments. However, if more-complex

diﬀer for each time-of-day segment. As a result, the input–

attacks are to be detected, domain experts or machine learn-

output response will also diﬀer depending on the time of day.

ing techniques could be used to define the rule base.

For example, the light intensity and temperature during the

The form of these rules is “IF premise, THEN consequent,”

day tend to be higher than at night. Figure 4 illustrates

where the premise is the fuzzy input variables connected bydetails of the design of the adopted scheme for local detec-

logical functions and the consequent is the fuzzy output vari-tion of FDIAs. In our system, we consider an environment

able. An example might be “IF temperature is H AND TAS
is S AND CT is N, THEN Malicious is H.” The full rule basefor the four types of sensor node involves 104 rules. The rulebase of temperature sensor nodes in WSNs is shown in Table
I. This rule base contains only the rules involving linguistic
variables based on the sensed values from temperature sensor nodes. The rule base for the other sensor node can be

Figure 4: Local detection scheme for CMs

constructed similarly. The temperature sensor node’s rulebase involves only 32 rules and the light, smoke-density, andrule base comprises a set of rules designed to decide about

humidity sensor nodes’ rule bases each involve only their own

the maliciousness of the CM. An example of the format ofsubset of 24 rules. Finally, the defuzzifier converts the output

the rule is “ IF Malicious is H AND Most(CMsDecision) is

fuzzy variable back to a crisp value, which is used to make a

L THEN Malicious is H.” Fuzzy inference combines the rules

local decision and send a report message to the CH for theto obtain an aggregated fuzzy output. Finally, the defuzzi-

further analysis that eventually leads to a groupl decision.

fier converts the fuzzy output variable back to a crisp valuethat will be used to make a group decision and reported to
the CH.
4.3.

Cluster detection by the CH

Cluster identification is processed in the CH level by considering the ST and MVA sensor correlations. In this detec-

Figure 5: Group detection scheme for the CAtion module, a more accurate decision is made by including
4.2.

the group decisions of multiple heterogenous CAs located inGroup detection by the CA

The group detection module operates at the CA level byconsidering ST correlations. In this detection module, a moreaccurate decision is made by including the local decisions ofmultiple homogenous CMs located in the same group within
the same cluster. After receiving a local decision message
from a CM, the CA stores the crisp decision value. After
collecting all the CMs’ local decisions, the CH executes thecluster-detection process for each CM node to give a groupdecision about the node’s maliciousness. Figure 5 illustrates
the details of the design of the adopted scheme to detect malicious nodes within a group. The group detection module
uses two inputs: i.e., every individual CM’s crisp local decision and all the CMs’ local decisions. The fuzzifier converts
the crisp values into degrees of membership by applying thecorresponding MF. After being fuzzified, a sigma-count fac-

the same cluster. After receiving a group-decision message
from a CA, the CH stores the crisp decision value. After collecting all the CA group decisions, the CH performs the fuzzy
inference for each sensor node to give the cluster decision
about the node’s maliciousness. The detection mechanism
is similar to that for group detection. However, comparedto the group decision, the cluster decision considers the observations from heterogeneous-sensor nodes in addition to
only homogenous-sensor nodes. The CH’s fuzzy rule basecomprises a set of rules designed to decide about the CM’s
maliciousness. An example of the rule might be “IF Malicious is L AND Most(CAsDecision) is L THEN Malicious
is L. If malicious nodes are detected, the CH sends a reportmessage to the BS.

5.

Experimental Results and Analysis

tor [12] is used as a measure of fuzzy cardinality to quantify
There are various limitations to using synthetic datasets

the CMs’ local decisions:∑

Count(F ) =∑and none of the previously proposed misbehaving-nodeµF (Si )(3)Here, F is a fuzzy set characterized by an MF µF (Si ), which
gives the degree of similarity for S, and Si = (S1 , S2 ,. . . ,Sn )is the set of CMs. Finally, F is the property of interest related to the sensor-node’s local decision, e.g. “Misbehavior
level is high.” A fuzzy majority quantifier is then used toobtain a fuzzified indication of the consensual CMs’ local
decisions. For a more accurate decision, we use the Most
quantifier to characterize the fuzzy majority of the CMs’ local decisions [13]:∑µF (Si )Count(F )umost (
) = umost ( i
)
|Si |
n


0 if x <= 0.3;

where umost (x) = 2x − 0.6 if 0.3 < x < 0.8
1 if x >= 0.8

detection approaches have yet been developed as deployablesystems. In this paper, we evaluate the detection eﬃciencyof our approach under realistic conditions. Sixteen sensor
nodes were deployed in our laboratory using the Raspberry
Pi 2 Model B microcontroller platform. Each sensor nodeis equipped with one temperature sensor module, one digital light-intensity sensor, one smoke-density sensor, and one
humidity sensor, which gives a total of 64 sensors. The sensor nodes were divided into three clusters separated fromeach other and with diﬀerent environmental conditions. One
cluster comprised five sensor nodes located in our laboratory∑

room, the second was composed of five sensor nodes locatedin a server room, and the third was composed of six sensor(4)Next, the fuzzified inputs and the quantified CMs’ local decisions are fed into the fuzzy inference process. The fuzzy

nodes located in a kitchen corner.
5.1.

WSN dataset creation and description

To evaluate the detection eﬃciency of our approach, wecollected a real-world dataset over a period of one month.
New sensor readings were collected every minute, giving a

Figure 6: Comparison of the detection results with a single correlation or a combination of correlations in each cluster

total of 2.787.776 sensor readings. The collected dataset con-rectly to the BS. That is, only temporal correlation was con-tains 93% real normal readings, 4.34% real failures and 2.66%

sidered. For the only spatial correlation case, only the groupartificial injected false sensor readings.

detection is performed by the CA. And as for the ST cor-This dataset was obtained after we preprocessed the col-relation, only the local and group detections are performed.

lected sensor node data. There were two significant chal-

The detection results show that our hierarchical approach

lenges in the preprocessing. Because of individual failures,(ST +MVA correlations) demonstrates higher accuracy andsome sensor nodes had missing data for epochs in the dataset.

lower false-alarm-rate than in the other cases.

This meant that data entries would not always be consecutive. Therefore, the value “NULL” was used to substitute foreach missing sensed value in an epoch. Moreover, to investigate the performance of our approach, malicious readings
were injected to the collected dataset according to the attack
patterns described in section 3.2. We altered the readings fora certain number of sensor nodes by a certain amount in specific time slots.
5.2.

Figure 7: Accuracy results in cluster 2 where a single correlation or a combination of two-correlations are considered

Evaluation of results

Our proposed approach perfectly detected all the failed

Figure 7 depicts details of accuracy results for each sen-nodes in our deployed WSN. However, to evaluate our ap-

sor node type in cluster 2. As shown, not all sensor nodes

proach in terms of malicious-node detection, five perfor-types show high accuracy, especially when only temporal ormance metrics are used in this paper: i.e., true positive ratespatial correlation is considered. For example, the average(TPR), true negative rate (TNR), f alse positive rateaccuracy of the light sensor nodes in Cluster 2 is low, because(FPR), f alse negative rate (FNR), and accuracy (A). Fig-

the light intensity in the server room is usually very low but,ure 6 summarizes the results of the metrics for each cluster.

according to the defined fuzzy rules for the morning period,

Even though the environmental conditions for each cluster

we should expect high light intensity. As a result, the false

were diﬀerent, our proposed approach achieves a high accu-

negative rate was high. However, the results show that weracy with a small FPR for the task of analyzing the sensor

can decrease the false-alarm rate and improve the detection

readings to determine whether the sensor nodes were be-

accuracy by including more than one correlation in the deci-

having normally or had been exposed to attacks. The ratesion process. In our approach, when most of the sensor nodesof correctly classified readings (TPR and TNR) was higher

show abnormal readings, it implies that they are not underthan the number of incorrectly classified readings (FPR andmalicious attack but there may be an event in the monitored

FNR).

environment. Therefore, the detection accuracy was higher

In addition, to stress the significance of considering sen-when the ST and MVA sensor correlations are included. To

sor correlations and the hierarchical architecture in achieving
better detection accuracy, we conducted other experiments

Table 2: Incorrect classification introduced by Naive Bayes,

whereby only a single correlation or a combination of two-

J48 and our proposed approachNaı̈ve Bayes

J48

Proposed approach

Cluster 1

18.56%

1.21%

1.43%

Cluster 2

13.72%

0.67%

1.65%

Cluster 3

50.84 %

1.39%

2.45%

correlations are considered. The experimental results showthat our approach produces better detection results compared to the other cases. The first case is where each CM
performs its local detection and then send its decision di-further understand the behavior of our approach, we com-

improve the detection accuracy and decrease the false-alarmpared it to two well-known classification algorithms: a naı̈ve

rate. In addition, we aim to further investigate the detection

Bayes classifier and a j48 decision tree. Fuzzy logic is moreaccuracy by considering the setting of the thresholds such as

appropriate for describing WSN behavior than these two al-

the distance-based clustering.

gorithms. This is unlike Bayes classifiers and decision trees,
where values are considered to be discrete, fuzzy logic works

Acknowledgmentwith continuous values, which are precisely what the sensor

This research was supported by JST as part of the Japan-

readings are. We used the WEKA data-mining tool to run

Taiwan Collaborative Research Program and by MOST as

this experiment. The attribute values supplied to the clas-

part of 105-2923-E-002-014-MY3.

sification algorithms were the same raw input data used for

References

the fuzzy module in our approach (i.e., temperature, light in-[1] L.A. Zadeh, “Fuzzy Sets,” in Information and Control, Volume 8, Issue 3, pp. 338–353, (1965)[2] N. Berjab, C.M. Yu, S.Y. Kuo, and H. Yokota, “Hierarchical Abnormal-node Detection using Fuzzy Logic for ECA
rule-based Wireless Sensor Networks,” in Proceedings of theIEEE 23rd Pacific Rim International Symposium on Dependable Computing (PRDC), pp. 289–298, (2018)[3] K. Kapitanova, S.H. Son, and K.D. Kang, “Using Fuzzy
Logic for Robust Event Detection in Wireless Sensor Networks,” in Ad Hoc Networks, Volume 10, Issue 4, pp. 709–
722, (2012)[4] M. Marin-Perianu and P. Havinga, “D-FLER: A Distributed
Fuzzy Logic Engine for Rule-Based Wireless Sensor Networks,” in Proceedings of the 4th International Conference on Ubiquitous Computing Systems (UCS), pp. 86–101,(2007)[5] S. Rajasegarar, C. Leckie, M. Palaniswami, and J.C.
Bezdek, “Distributed Anomaly Detection in Wireless Sensor Networks,” in Proc. IEEE International Conference on
Communications, ICCS, (2006)[6] B. Sheng, Q. Li, W. Mao, and W. Jin, “Outlier Detection in
Sensor Networks,” in MobiHoc ’07, Proceedings of the 8th
ACM International Symposium on Mobile ad hoc Networking and Computing, pp. 219–228, (2007)[7] P. Levis and D. Culler, “Mate: A Tiny Virtual Machine for
Sensor Networks,” in International Conference on Architectural Support for Programming Languages and Operating
Systems, pp. 85–95, (2002)[8] M. Marin-Perianu, T.J. Hofmeijer, and P.J.M. Havinga,“Implementing Business Rules on Sensor Nodes,” in 11th
IEEE International Conference on Emerging Technologies
and Factory Automation (ETFA), pp. 292–299, (2006)[9] A. Paschke, “ECA-RuleML: An Approach Combining ECA
Rules with Temporal Interval-Based KR Event/Action Logics and Transactional Update Logics,” in Computer Research Repository, abs/cs/061, (2006)[10] N. Berjab, C.M. Yu, S.Y. Kuo, and H. Yokota, “Impact
Analysis for Dos and Integrity Attacks on IoT Systems,” inProceedings of the 7th International Conference on Information Systems and Technologies, pp. 1–8, (2017)[11] N. Berjab, H.H. Le, C.M. Yu, S.Y. Kuo, and H. Yokota,“Abnormal-node Detection Based on Spatio-temporal andMultivariate-attribute Correlation in Wireless Sensor Networks,” in 16th IEEE Intl. Conf. on Dependable, Autonomic, and Secure Computing, pp. 568-575, (2018)[12] J. Kacprzyk, “Group Decision Making with a Fuzzy Linguistic Majority,” in Fuzzy Sets and Systems, 18(2), pp.
105–118, (1986)[13] L.A. Zadeh, “A Computational Approach to Fuzzy Quantifiers in Natural Languages,” in Computers and Mathematics
9, pp. 149–184, (1983)

tensity, humidity, smoke density, and their average temporalsimilarity.) In the evaluation, we performed a 10-fold crossvalidation for both classification algorithms.
Table 2 shows the number of incorrectly classified instances
for the three clusters. Both algorithms wrongly classified
a certain number of instances. Note that naı̈ve Bayes introduced the most incorrect classifications. Our proposed
approach had a lower percentage of incorrectly classified instances than naı̈ve Bayes, but it was higher than that for
the J48 decision tree. However, compared to these othertwo classification algorithms, fuzzy logic is better suited to
WSNs, not only because it works with continuous readingsof the sensor nodes, but also because it only needs to specify
MFs and rules, which is more straightforward and computationally more eﬃcient than having to build complex probability models. Besides, naı̈ve Bayes and J48 not only needs
time to train their model, but also they need to split thedataset into testing and training data. While our approach
does not need any training data to perform the detection
process.

6.

Conclusion

In this paper, we propose a novel hierarchical approachto detect misbehaving nodes in WSNs. The proposed approach uses fuzzy logic for ECA rule-based WSNs to detect malicious nodes while considering failed nodes. The
ST semantics of heterogeneous sensor readings are considered in the decision process to distinguish malicious datafrom other anomalies. Our experiments on real-world sensor
data demonstrate that our approach can provide high detection accuracy with low false-alarm rates. The experiments
also support the hypothesis that including ST and MVA sensor correlations in the decision process further improves themalicious-nodes detection accuracy. In addition, when compared to two well-known classification algorithms, our proposed approach performed well. In our future work, we plan
to implement a mechanism that derives the fuzzy rule set
automatically, perhaps via machine learning techniques, to