Sequential fusion to defend against sensing data falsification attack for cognitive Internet of Things

ETRI JournalVolume 42, Issue 6 p. 976-986 ORIGINAL ARTICLEFree Access Sequential fusion to defend against sensing data falsification attack for cognitive Internet of Things Jun Wu, Corresponding Author Jun Wu wojames2011@163.com orcid.org/0000-0002-8918-3194 School of Communication Engineering, Hangzhou Dianzi University, Hangzhou, China Correspondence Jun Wu, School of Communication Engineering, Hangzhou Dianzi University, Hangzhou, China. Email: wojames2011@163.comSearch for more papers by this authorCong Wang, Cong Wang School of Information Science and Engineering, Southeast University, Nanjing, ChinaSearch for more papers by this authorYue Yu, Yue Yu School of Information Science and Engineering, Southeast University, Nanjing, ChinaSearch for more papers by this authorTiecheng Song, Tiecheng Song School of Information Science and Engineering, Southeast University, Nanjing, ChinaSearch for more papers by this authorJing Hu, Jing Hu School of Information Science and Engineering, Southeast University, Nanjing, ChinaSearch for more papers by this author Jun Wu, Corresponding Author Jun Wu wojames2011@163.com orcid.org/0000-0002-8918-3194 School of Communication Engineering, Hangzhou Dianzi University, Hangzhou, China Correspondence Jun Wu, School of Communication Engineering, Hangzhou Dianzi University, Hangzhou, China. Email: wojames2011@163.comSearch for more papers by this authorCong Wang, Cong Wang School of Information Science and Engineering, Southeast University, Nanjing, ChinaSearch for more papers by this authorYue Yu, Yue Yu School of Information Science and Engineering, Southeast University, Nanjing, ChinaSearch for more papers by this authorTiecheng Song, Tiecheng Song School of Information Science and Engineering, Southeast University, Nanjing, ChinaSearch for more papers by this authorJing Hu, Jing Hu School of Information Science and Engineering, Southeast University, Nanjing, ChinaSearch for more papers by this author First published: 17 February 2020 https://doi.org/10.4218/etrij.2019-0388Citations: 6 Funding information This work was supported by the National Natural Science Foundation of China (No. 61771126, 61801155 and 61901152) and the Key Research & Development Plan of Jiangsu Province (No. BE2018108). AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract Internet of Things (IoT) is considered the future network to support wireless communications. To realize an IoT network, sufficient spectrum should be allocated for the rapidly increasing IoT devices. Through cognitive radio, unlicensed IoT devices exploit cooperative spectrum sensing (CSS) to opportunistically access a licensed spectrum without causing harmful interference to licensed primary users (PUs), thereby effectively improving the spectrum utilization. However, an open access cognitive IoT allows abnormal IoT devices to undermine the CSS process. Herein, we first establish a hard-combining attack model according to the malicious behavior of falsifying sensing data. Subsequently, we propose a weighted sequential hypothesis test (WSHT) to increase the PU detection accuracy and decrease the sampling number, which comprises the data transmission status-trust evaluation mechanism, sensing data availability, and sequential hypothesis test. Finally, simulation results show that when various attacks are encountered, the requirements of the WSHT are less than those of the conventional WSHT for a better detection performance. 1 INTRODUCTION The Internet of Things (IoT), first proposed by Ashton [1], describes the future scenario where daily physical objects will be connected to the Internet and be able to identify themselves to other devices. The IoT is a new revolution of the Internet and things or objects, such as radio frequency identification tags, sensors, actuators, and mobile phones, which through unique addressing schemes can interact with each other and cooperate with their neighbors to reach typical goals [2]. To realize the IoT network paradigm, a large number of IoT devices must be deployed. However, with the increasing number of IoT devices, the amount of spectra for these devices is insufficient. Moreover, owing to the interference owing to spectrum overuse by IoT devices, the transmission performance will be degenerated significantly. Therefore, it is highly import to improve the spectrum utilization in an IoT network [3]. 1.1 Related studies M. Zhang and others presented the concept of cognitive IoT (CIoT) by integrating intelligent thoughts into the IoT to address the lack of intelligence, modeled the CIoT network topology, and designed cognition process–related technologies [4]. Inspired by the human cognition process, Wu and others [5] presented an operational framework for CIoT, which characterized fundamental cognitive tasks and empowered the current IoT with a "brain" for high-level intelligence. Ploennigs and others proposed a CIoT architecture [6] that combined the strength in scalability provided by a recently developed IoT architecture with self-learning and self-adaptation capabilities obtained from cognitive systems. Furthermore, [4-6] considered cognitive capability to gradually enrich the definition of the IoT and developed a brain-empowered CIoT paradigm involving key enabling techniques. However, the spectrum shortage problem has yet to be solved in the previous IoT network. Hence, cognitive radio (CR) is envisaged as a promising solution to improve spectrum utilization by sharing a licensed spectrum. CR has been defined by Mitola and later by Haykin as an intelligent wireless communication system that is aware of its surrounding environment and uses the methodology of understanding by building to learn from the environment and adapts its internal states based on new statistical variations [7]. Integrating CR technology with the IoT network allows IoT devices to sense spectrum resources that are underutilized by primary users (PUs), which is considered as complementary to existing efforts [3]. The main goal of [8] and [9] is to discuss how CR technology can be useful for the IoT paradigm. Kim proposed using CR techniques for IoT-based systems to manage the shortage of spectrum for IoT devices [10]. Zaheer and others provided a survey of the existing decision theoretic models and their usage for CIoT [11]; furthermore, an architectural CIoT framework was proposed to discuss the open issues and solution for potential challenges emerging in the CIoT research. Considering that spectrum decision by unlicensed users of CR is important in CR-based IoT in 5G and beyond networks, Akhtar described a scientific supported spectrum decision support framework for CR networks [12], in which the goal is the same as that reported in [8] and [9]. Although a comprehensive study on recent advances in CR technology for IoT has been provided [8-12], many questions are yet to be explored, such as the attack and defense involved in CIoT. In [13], Chen and others investigated the vulnerability of the IoT infrastructure under intentional attacks by relating network resilience to percolation-based connectivity. They proposed a fusion-based defense mechanism to mitigate the damage caused by such attacks and applied the results of game equilibrium (the attack and defense strategy as a zero-sum game) to evaluate the effectiveness of the proposed mechanism. Unfortunately, only a general theoretic framework for network robustness analysis and enhancement is provided and defense against specific attacks failed [13]. In [14], Zhang and others surveyed the Sybil attack and defense schemes in the IoT. They suggested several research issues regarding Sybil defense and mentioned that further research and development related to IoT is still challenging. In [15], Li and others addressed the physical layer security issue in CIoT networks by employing cooperative jamming. They proposed a novel cooperative jamming scheme, in which a secondary user is arbitrarily assigned as the helper to confound the eavesdropper by sending jamming signals. However, if the helper is a malicious node, the system security will be severely threatened. Therefore, the untrusted helper node should be considered thoroughly. In [16], Salameh and others presented a probabilistic-based channel assignment algorithm for IoT-based cognitive radio networks (CRNs) with time-sensitive traffic under jamming attacks. In [17], Lin and others proposed a protocol and a method of spectrum management that can guard against typical types of security threats despite the limitations of local processing. With a hierarchical CIoT architecture, they incorporated the strengths of CR and the physical properties of a device to improve the performance of a CRSN and resolved the primary user emulation attack (PUEA) problem. However, using a large number of IoT devices worsens the spectrum scarcity problem significantly. The usable spectrum resources are almost entirely occupied; therefore, the increasing demands of radio access from IoT devices cannot be satisfied. Both [16] and [17] primarily focused on the resource allocation algorithm to defend against Sybil attacks, jamming or PUEAs for CIoT, and subsequently ignored the spectrum sensing problem; in fact, spectrum sensing is critical to solve the spectrum scarcity problem. Additionally, extensive research has been performed to provide a structured and comprehensive overview on the security of IoT from different aspects, such as, [18-31] and the references therein. 1.2 Motivation and contributions Although the security of IoT has been extensively discussed and addressed, some of which pertain to the current state of research and future directions of IoT security requirements, strong scalability concerns still exist, especially in spectrum sensing security. Most of the previously conducted research failed to consider the peculiarities of such services, such as spectrum sensing; therefore, the high bandwidth demand to serve massive numbers of IoT devices may result in spectrum scarcity for IoT applications. Such limitations fuel the motivation for providing a broader and more complete view of CIoT security challenges in spectrum sensing. To the best of our knowledge, a sequential probability ratio test design for spectrum sensing in CIoT networks had not been studied. Local spectrum sensing by a single IoT device is often inaccurate as the channel often experiences fading and shadowing effects; therefore, cooperative spectrum sensing (CSS) has been proposed to overcome this problem. Although CSS performed by several IoT devices can provide a more reliable decision regarding the PUs, abnormal IoT devices (AIDs) may appear, which is disadvantageous. During spectrum sensing, AIDs alter the cooperative decision by transmitting false signals, thereby resulting in the incorrect prediction of PU presence. Such attacks are known as sensing data falsification attacks (SDFAs). During SDFAs, the traditional encryption method (such as symmetric and asymmetric ciphers) may not be suitable for CIoT networks, as these networks are composed of low-profile devices. Hence, we design a weighted sequential hypothesis test (WSHT) for CIoT to secure CSS and decrease the number of samples required at the fusion center (FC). By analyzing the malicious behavior occurring during CSS, we formulate a hard-combining SDFA model. According to the periodic spectrum sensing frame structure, we formulate a data transmission status-based trust evaluation mechanism instead of the global decision-based trust evaluation mechanism to evaluate the sensing data availability. Furthermore, we integrate the sensing data availability into the weight of the sequential hypothesis test, and propose a WSHT to defend against SDFAs in CIoT. The remainder of the paper is structured as follows. Section 2 provides the system model including the spectrum sensing and SDFA models. Section 3 formulates the WSHT, including the data transmission status-based trust evaluation mechanism, sensing data availability, and sequential hypothesis test. Performance evaluation is presented in Section 4. Finally, conclusions and future work are presented in Section 5. 2 SYSTEM MODEL A generic CIoT is typically structured into four layers: application, transport, perception, and sensing layers, as shown in Figure 1. The application layer employs intelligent computing technologies (eg, data mining and cloud computing) to extract valuable information from processing voluminous data and provides an interface between users and other applications. The transport layer manages network operations, whereas the perception layer collects information [26]. The three layers above constitute a basic IoT architecture; however, because a spectrum bandwidth is not available, an IoT network cannot be realized. Hence, combined with CR technology, the sensing layer is proposed to provide an empty spectrum bandwidth for data delivery in three layers of the IoT architecture. Figure 1Open in figure viewerPowerPoint A generic CIoT architecture As shown from the four-layered CIoT architecture above, CIoT security should include the security of the entire system crossing all four layers mentioned previously. Because the sensing layer is the fundamental brick of the upper three layers, the focus of this study is to solve the security of the sensing layer. In this section, we present the spectrum sensing and SDFA models in the sensing layer. 2.1 Spectrum sensing model In the sensing layer, strict requirements regarding the spectrum sensing accuracy are set to avoid collisions with the PU. However, it is extremely difficult to attain such an accuracy by individual spectrum sensing owing to shadowing and multipath fading encountered by IoT devices. Once the PU signal experiences deep fading or blocked by obstacles, the power of the received PU signal at the IoT devices may be too weak to be detected. Hence, CSS is proposed; the CSS performance will be improved by utilizing independent fading and multiple-user diversity. In the CSS architecture, all the participating IoT devices forward their observations regarding the presence or absence of the PU to the FC, which makes the global decision regarding whether the PU is transmitting. The channel between IoT devices and the FC is an error-free communication channel. Based on the CSS process, we consider an infrastructure-based CIoT network comprising a PU, FC, and N IoT devices, wherein the AID ratio is . Figure 2 illustrates an example of time slot assignment for IoT devices, where and represent the hypothesis regarding the absence and presence of the PU, respectively. In each sensing frame, N IoT devices independently sense the usage status of a particular spectrum channel in the sensing slot and send individual sensing results to the FC. In the processing slot, the FC makes the global decision regarding the channel status based on all received reports and subsequently sends its decision results to IoT devices. Subsequently, the FC makes the global decision via a specific rule and broadcasts a message (the presence or absence of the PU) to the IoT devices; if the FC declares the presence of a PU, one of N IoT devices may start to transmit data in the transmission period over this channel. When the FC declares the absence of a PU, the IoT devices must be switched to sense the availability of another channel in the next sensing frame. Figure 2Open in figure viewerPowerPoint Periodic spectrum sensing frame structure 2.2 Sensing data falsification attack model The most vigorous and open facet of CIoT is that CRs are pregnable to multifarious malevolent attacks in the sensing layer. In CSS, the nature of aggregating data allows AIDs to launch SDFAs by sending false spectrum sensing data. For convenience, spectrum sensing data are abbreviated as sensing data hereinafter. The AIDs attempt to manipulate the FC into producing a global decision regarding the spectrum occupancy. This not only renders the spectrum scarcity problem more serious, but also creates security risks to the network. The reliable detection of the PU is important in CIoT. However, it becomes challenging when the AIDs share false sensing data in CSS, as shown in Figure 3. Figure 3Open in figure viewerPowerPoint Cooperative spectrum sensing in the presence of AIDs An SDFA on the CIoT infrastructure can be categorized into two types according to its purpose: (a) mis-detection attack and (b) false alarm attack, as shown in Figure 4. A mis-detection attack exploits a cooperative opportunity to increase the mis-detection probability (falsifying the sensing result 1 into 0); therefore, the AIDs allure other IoT devices to access the channels in use and cause an excessive interference to the PU. In contrast to causing a harmful interference to the primary network, a mis-detection attack aims to prevent other normal IoT devices (NIDs) from using the existing white space by increasing the false alarm probability (falsifying the sensing result 0 into 1) such that the AIDs can exclusively occupy the idle spectrum. Figure 4Open in figure viewerPowerPoint Sensing data falsification attack model To evaluate the effect of the SDFA on CIoT, we adopt both the mis-detection and false alarm probabilities as the local performance metric. Furthermore, the mis-detection probability which represents the IoT device, outputs the sensing result that the PU is absent when the PU is present, and the false alarm probability , which represents the IoT device, outputs the sensing result that the PU is present when the PU is absent are assumed to be the same for every IoT device irrespective of whether they are normal or abnormal, that is, and , i = 1, 2, …, N. Otherwise, the probability of the false alarm attack and the mis-detection attack are denoted as and , respectively. Subsequently, the mis-detection probability and the false alarm probability of the j th AID ( and , ) are given by (1)and (2) As shown in (1) and (2), when or , the SDFA model naturally degenerates into two simple types of attack: always-no attack and always-yes attack; when and , another special attack type appears, that is, always-false attack. In detail, the always-no, always-yes, and always-false attacks represent the AID always reporting the absence of the PU, the presence of the PU, and the PU status, respectively, as opposed to the sensing result to the FC regardless of the true sensing result. If those AIDs launch a simple attack characteristic, they can be easily identified by the decision fusion criteria at the FC. In fact, such a type of always attack has been extensively studied in [32-38]; the defense schemes in these references have shown satisfactory performance in some settings; however, when confronting the sophisticated attack probability (ie, a pair of attack probability and varying from 0 to 1), most of them are bound to fail. 3 WEIGHTED SEQUENTIAL HYPOTHESIS TEST AIDs can render the FC incapable of making a decision by completely blinding the system. In this case, the FC will be unable to decide on a particular decision regarding the presence of the phenomenon, and the performance of the FC cannot be better than a random guess of the state of channel. A critical value of 50% of the AIDs can completely blind the FC; more details regarding the blind scenario are available in [39]. In fact, a high AID ratio case has been ignored in most previous studies; however, this is a fundamental issue involved in CSS. Therefore, we consider a sequential probability ratio test-based decision fusion criterion comprising the data transmission status-based trust evaluation mechanism, sensing data availability, and sequential hypothesis test that is robust against various SDFAs. 3.1 Data transmission status-based trust evaluation mechanism The trust concept is used in various contexts and with different meanings [24]. When a number of devices communicate in an uncertain network environment, trust is important for establishing a secure communication between things. Trust in the system from the devices' perspective should be considered in CIoT. To gain device trust, an effective mechanism should be established for defining trust in a dynamic and collaborative CIoT environment [21]. In the spectrum sensing behavior, the main objectives of trust research are as follows: first, the conception of a new trust evaluation mechanism for spectrum sensing behavior; next, the implementation of the trust evaluation mechanism. A good policy framework is desired to incorporate the evaluated trust level and current threat level prior to decision making [21]. Before proceeding with the description of our trust evaluation mechanism, a brief introduction to the global decision-based trust evaluation mechanism is provided, as shown in Figure 5. Figure 5Open in figure viewerPowerPoint Global decision-based trust evaluation mechanism Each IoT device is assigned with a trust value; the FC utilizes the global decision to verify the consistency of the local decision results from the IoT devices in each time slot; subsequently, the trust value is renewed. When the local decision is consistent with the global decision, the trust value will be increased by one; otherwise, it will be decreased by one. Therefore, according to the global decision-trust evaluate mechanism, the trust value of the th IoT device at the th time slot is described as follows: (3)where is the local decision; is the global decision. The global decision-based trust evaluation mechanism has been adopted extensively in previous studies. In fact, this trust evaluation mechanism can cope with a few AIDs; however, when a large number of AIDs exist in CIoT, it becomes unreliable if the global decision is still used as a benchmark to verify the consistent of the local decision, because the global decision made by the FC may be compromised. Hence, it is indispensable to devise a robust trust evaluation mechanism that can verify the consistency. Unlike the global decision-based trust evaluation mechanism, the main idea of our proposed trust evaluation mechanism is inspired by the periodic spectrum sensing frame structure, we utilize the data transmission status of an IoT device to determine whether the local decision is correct. Next, we introduce this trust evaluation mechanism in two cases. 3.1.1 Case I In Case I, when the FC declares the global decision as idle and broadcasts this message to the IoT devices at the processing slot, in accordance with the entire process of CSS and periodic spectrum sensing frame structure, at least one IoT device will be allocated to the channel for data transmission at the data transmission slot. At this time, if the delivery of data transmission occurs from the IoT device at the channel, then the global decision is correct; meanwhile, if collisions with the primary network occur, then the global decision is incorrect. 3.1.2 Case II In Case II, when the FC announces that the global decision is busy, typically, all IoT devices must switch to another channel and continue sensing; in other words, data transmission should not occur from the IoT device in the channel, and the global decision is regarded as correct. However, if data transmission occurs from the IoT device, then the global decision is incorrect. In general, we can use the data transmission status of the IoT devices instead of the global decision to verify the consistency of the local decisions. The entire data transmission-based trust evaluation mechanism is illustrated in Figure 6. In addition, from the implementation of data transmission-based trust evaluation, the FC or a trusted node can be adopted to monitor the procedure above. However, it is noteworthy that the data transmission status is only used as a benchmark to verify the consistency of the local decisions and is not a substitute for the global decision as an indicator of whether the IoT device has accessed the channel (because data transmission status-based trust evaluation mechanism is executed at the end of the global decision-making). Figure 6Open in figure viewerPowerPoint Data transmission status-based trust evaluation mechanism 3.2 Sensing data availability To protect the sensing data integrity, security countermeasures are divided into two main categories: preventive and reactive. Preventive countermeasures seek to prevent intrusion attempts by directly protecting data and communications. Examples of preventive security include cryptographic protocols to authenticate the identity of devices and authorize users to access data. Authentication and authorization protocols ensure that the FC receives data streams only from trusted devices. They prevent an adversary from introducing malicious data to the FC via a rogue, unverified device [30]. Reactive countermeasures aim to mitigate failures in preventive security and ensure that the system continues to operate appropriately even when the preventive security fails. Meanwhile, preventive security protects CIoT networks by rendering it more difficult for an adversary to compromise data, and reactive security ensures that systems operate resiliently even when a number of IoT devices become hijacked. Reactive countermeasures include attack detection and identification algorithms for cyberphysical systems. The objectives of attack detection and identification are to determine if the measurements from any of the IoT devices have been altered by an adversary and to identify IoT devices that have been compromised, respectively. After detecting or identifying an attack, the system may perform a corrective action to mitigate the damage [30]. Following reactive countermeasures, we utilize the consistency verification of the local decision to evaluate the sensing data availability. After the th sensing slot, the consistency of the th IoT device is empirically defined as (4) As shown in (4), is measured only when ; in other words, the IoT device correctly detects the PU status at least times in sensing frames; subsequently, its consistency can be measured. The goal is to mitigate the effect of abnormal sensing data on the global decision. Next, the sensing data availability must be measured according to the consistency. Here, we use a new weight allocation to evaluate the sensing data availability, wherein the weight is a function with regard to the consistency and is presented as (5) In fact, the sensing data availability can be expressed as various functions involved in the consistency . However, it needs to comply with the basic principle, that is, the higher the consistency, the higher is the sensing data availability, except that the slope of the sensing data availability increases with increasing consistency in different functions, which affects the global performance and sample size. However, this is beyond the scope of this paper. 3.3 Sequential hypothesis test In the typical decision fusion criteria (ie, voting rule, Neyman–Pearson detection, and Bayesian test), the same methodology is employed for a multiple but fixed number of observation samples. In many practical situations, however, observations are collected sequentially and more information becomes available as time progresses. In such cases, we may wish to process the observations sequentially and make a global decision as soon as we are satisfied with the decision quality or detection performance. The aim is to perform additional observations only if they are necessary [40]. In the sequential hypothesis test process, after each sensing frame, the FC computes the likelihood ratio and compares it with two thresholds. Either it decides on one of the two hypotheses or it decides to take another observation. The main advantage of the sequential hypothesis test is that it requires, on the average, fewer observations to achieve the same probability of error performance as a fixed sample size test. This advantage is attained at the expense of additional computation [40]. Hence, the likelihood ratio is computed and compared with the lower threshold and the upper threshold , which are determined by the specified values of and , respectively. If the likelihood ratio is greater than or equal to , the FC decides that is present. If the likelihood ratio is less than or equal to , then the FC decides that is present. To secure CSS, we integrate the sensing data availability into the weight of the likelihood ratio; subsequently, the decision variable can be described as. (6)where is the required number of samples at the th sensing frame. As illustrated in Figure 7, the procedure of the sequential hypothesis test is described as follows: Figure 7Open in figure viewerPowerPoint Weighted sequential hypothesis test If , the FC decides ; If , the FC decides ; If , the FC takes another decision sample, where and . However, it is noteworthy that when sequentially calculating the likelihood ratio of the FC, the IoT device with a high trust value preferentially calculates the likelihood ratio such that the negative effect of abnormal sensing data on the global decision can be further mitigated. After the FC decides that is present by