## 2 Related Work  
Existing works on source location protection can be divided into two major categories: source location protection against the global attackers (SLP-GA) [10; 11; 12] and source location protection against local attackers (SLP-LA) [3; 4; 9; 13]. To defend against global attackers, [PERSON] _et al._[10] presented the FitProbRate scheme. By controlling the sending rate of packets, FitProbRate enhances source anonymity and meanwhile decreases packet transmission latency. [PERSON] _et al._[11] focused on the tradeoff between security and performance, and provide source anonymity under a global attack. The proposed model can significantly reduce the packet reporting latency based on its \"_indistinguishable even_ability\". However, this model cannot capture the source information leakage. [PERSON] _et al._[12] provides a statistical framework that is stronger than the \"_indistinguishable event_\" ability for modeling, analyzing, and evaluating anonymity in sensor networks. All the above works have limitations. First, all sensors in the above work send lots of fakes packets, which incurs a considerable energy consumption and increases the probability of packet collision (and consequently the packet loss). Second, it is reasonably difficult for an attacker to capture the traffic over a large scale area in the real world. For example, to monitor the whole traffic over the Wolong Panda Reserve in China which covers about two million square kilometers is difficult. To defend against local attackers, [PERSON] _et al._[3] propose a phantom routing protocol for source location protection. The phantom routing protocol includes two major steps. In the first step, each packet is transmitted from the source by random \(h\)-hops and then arrives at a phantom location. In the second step, each packet is transmitted from the phantom location to the base station through flooding or the shortest path routing. If phantom locations are far away from the source, attackers can be misled away from the source more effectively. However, theoretical analysis presented in [13] indicates that the probability for the distance between phantom location and source to be no more than \(h/5\) is \(p=1-e^{-h/25}\). Apparently, \(p\) approaches 1 if \(h\) is large enough. In order to generate phantom locations that are far away from the source, [PERSON] _et al._[4] proposed a directed random routing protocol. In this protocol, each sensor is designated with a \(D_{bs}\) that is equal to the shortest distance from the sensor to the base station. As sensors are assumed to be distributed evenly, the number of hops is adopted to measure the distance between two sensors. In the first step, given any sensor, say \(u\), its neighbors are divided into two sets, the parent set and the child set, satisfying any sensor in the parent set has a smaller \(D_{bs}\) and any sensor in the child set has a larger \(D_{bs}\) than that of \(u\). Once the source generates a packet, it first determines a set (_i.e._, the parent set or the child set) and then forwards the packet to a random sensor of the set. When a sensor receives the packet, it continues forwarding the packet to another sensor of the child set (which is determined by the source). This packet-forwarding process will be repeated until the packet has been forwarded \(h\)-hops. In this way, each packet is guaranteed to be transmitted far from or near the base station within the \(h\)-hops. However, the phantom locations generated by [3; 4; 13] tend to gather in two regions (to be proved by Lemma 1). As a result, the attacker is likely to be led to the source as he can reach to one of the two regions easily. Differing from above work, [PERSON] _et al._[9] considered a more powerful attacker who can observe all the sensors within \(r\) (\(r\geq 0\)) hops rather than only one hop away from him. For this attacker, the source is revealed once he traces the signals back to the unsafe area within \(r\) hops from the source.