# Evaluation of Resource Exhaustion Attacks against Wireless Mobile Devices
## 6 Discussion  
Generally, ERE attacks are applicable to devices using autonomous exhaustible power sources. The experiments have confirmed the potency of ERE attacks to reduce the lifetime rapidly. The variability of such attacks is limited by a variety of influences on more energy-consuming units to increase the intensity of their use. At the same time, ERE attacks make sense only if the device has a critical purpose and its business functions cannot be suspended to recharge the battery. Such attacks lose effectiveness if the drained device or the battery can be replaced rapidly. ERE attacks are seen as extremely important in various application domains. In particular, realizing an ERE attack on an unmanned aerial vehicle (drone) allows exhausting implicitly its energy used by the engine, raising a risk the owner of the drone will not have enough time to land in an emergency and the drone will crash. Another example presents autonomous modules of a Smart City, such as mobile interactive road signs/traffic lights, pollution sensors, etc. being attacked by a dishonest competitor to cause to frequent maintenance and extra expenses during the system management. The assumed intruder's skills and knowledge on the devices (e.g., sleep mode settings, victim identifier, XBee PAN ID, encryption key used, etc.) are application specific. Performed experiments on the modeling of two attacks for different devices show the strength of the ERE attacks to reduce the life time of battery of devices several times, which is quite important for mission-critical systems. ERE attack detection appears to be an application-specific intelligent process, including detailed monitoring data on power consumption of the device, its software and hardware modules transitions between specific modes, logs on starting and suspending applications, local storage calls, etc. All these data should be used to analyze events and verify feasibility of correlation rules to detect signs of ERE attacks. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Time Period, msec** & **0–1000** & **1000–11,000** \\ \hline \hline I\({}_{\text{IDLE}}\), mA & 45 & 8 \\ I\({}_{\text{ATTACK}}\), mA & 51 & 51 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: The results of the XBee power consumption in normal mode and under attack. Detection should be specific to the expected ERE attack type. In particular for an attack of a wireless incoming traffic growth, the traffic should be validated for its legitimacy, starting from its source, application protocol, other header and payload, considering the history of interaction. ERE attack monitoring is application-specific as well. The use cases expose differences in current consumption measurements by software and hardware means having inherent limitations and precision. ERE attack detection can be energy consuming itself according to developers of cyber-physical systems. Generally hardware based measurements are regarded as less power consuming, more customizable and more exact; however it may be more difficult to implement it due to the need of soldering the current sensor to the battery contacts physically. The discussed instances of attacks as well as their complexity can significantly differ by amounts of prior intruder's knowledge of the victim device and specific applications running on it. For instance, for XBee based devices such information may include sleep mode parameters (SM, ST, SP, etc. ), the unique 64-bit address of the victim host, the network PAN ID, symmetric encryption key (if used), etc. Let us analyze the practical applicability of the four types of energy exhaustion attacks considered:  
* Denial-of-sleep attack. This type of attack is specific to stand-alone or autonomous modules moving in space, including modules with long-term functioning--for example, terminal nodes of the sensor network, BodyNet elements, wireless devices. communications, etc., assuming an ability to activate core computing and communication functions sporadically when a certain type of event occurs.