# A Protocol Layer Trust-Based Intrusion Detection Scheme for Wireless Sensor Networks
## 3 System Model  
We consider a WSN where the network can be divided into multiple clusters, as illustrated in Figure 1. Each cluster consists of a number of SNs and a CH. SNs can communicate with their CH either directly or through other SNs. A CH can forward the aggregated data to the BS directly or through other CHs. Figure 1: Clustered wireless sensor networks (WSN) architecture. (SN = sensor node, CH = cluster head, BS = base station). Our trust-based intrusion detection scheme includes two levels of trust evaluation, one is CH-to-SN trust evaluation, the other is BS-to-CH trust evaluation. In CH-to-SN trust evaluation, each SN evaluates its neighbors and sends the trust evaluation results to its CH periodically. The CH evaluates all the SNs in its cluster by analyzing statistically the trust evaluation results reported by other SNs. The trust update period is \(\Delta\)t, which is a system parameter. The length of \(\Delta\)t could be made shorter or longer based on network analysis scenarios. Similarly, in BS-to-CH trust evaluation, each CH performs trust evaluation toward its neighboring CHs and sends its trust evaluation results to the BS. The BS evaluates all the CHs in the network by using the same methods as adopted in CH-to-SN trust evaluation. Since the two levels of trust evaluation use the same method, we mainly describe CH-to-SN trust evaluation. The nodal trustworthiness consists of the trust degree of each protocol layer, including physical layer, MAC layer, network layer, transport layer and application layer. Since most of the attacks against WSNs aim at the physical layer, MAC layer and network layer, for simplicity, in this paper we mainly focus on the trusts at these three layers. Let \(\mathrm{T}_{\mathrm{ij}}^{\mathrm{DIRECT}}(\mathrm{t})\) denote the trust value that the sensor node \(\mathrm{i}\) directly evaluates toward its neighboring node \(\mathrm{j}\) at time \(\mathrm{t}\). It can be calculated by:  
\[\mathrm{T}_{\mathrm{ij}}^{\mathrm{DIRECT}}(\mathrm{t})=\mathrm{w}_{1}\mathrm{ T}_{\mathrm{ij}}^{\mathrm{PHY}}(\mathrm{t})+\mathrm{w}_{2}\mathrm{T}_{ \mathrm{ij}}^{\mathrm{MAC}}(\mathrm{t})+\mathrm{w}_{3}\mathrm{T}_{\mathrm{ij} }^{\mathrm{NET}}(\mathrm{t}), \tag{1}\]  
where \(\mathrm{T}_{\mathrm{ij}}^{\mathrm{PHY}}(\mathrm{t})\), \(\mathrm{T}_{\mathrm{ij}}^{\mathrm{MAC}}(\mathrm{t})\), and \(\mathrm{T}_{\mathrm{ij}}^{\mathrm{NET}}(\mathrm{t})\) represents the trust value that node \(\mathrm{i}\) evaluates toward node \(\mathrm{j}\) at the physical (PHY) layer, medium access control (MAC) layer, and network (NET) layer, respectively, \(\mathrm{w}_{1}\), \(\mathrm{w}_{2}\), and \(\mathrm{w}_{3}\) are the corresponding weight values associated with these three trust components, \(\mathrm{w}_{1}\in[0,1]\), \(\mathrm{w}_{2}\in[0,1]\), \(\mathrm{w}_{3}\in[0,1]\) and \(\mathrm{w}_{1}+\mathrm{w}_{2}+\mathrm{w}_{3}=1\). The values of the weights \(\mathrm{w}_{1}\), \(\mathrm{w}_{2}\), and \(\mathrm{w}_{3}\) are determined according to the concrete requirement of a detection system under implementation. Generally speaking, the number of attacks aiming at the network layer is greater than those aiming at the MAC layer and physical layer. Hence, the value of \(\mathrm{w}_{3}\) is usually slightly larger than that of \(\mathrm{w}_{1}\) or \(\mathrm{w}_{2}\). In order to evaluate the trustworthiness of each protocol layer, we can choose some important parameters at each protocol layer and calculate the deviations of these parameters. Actually, our scheme is scalable. If a more accurate trust value is needed, we can choose additional parameters at each protocol layer and calculate the deviations of these parameters. Certainly, the more parameters are selected, the more complex the detection system will be. Hence, we can select parameters according to the requirement and complexity of the detection system. The trustworthiness of a SN (or CH) should be updated periodically.