# A Protocol Layer Trust-Based Intrusion Detection Scheme for Wireless Sensor Networks
## 1 Introduction
Recently, different types of anomaly detection schemes based on traffic prediction [15], statistical method [16], data mining [17], game theory [18; 19; 20], immune theory [21], or trust management [22; 23; 24; 25; 26; 27; 28; 29; 30; 31; 32; 33; 34; 35; 36; 37], etc., have been proposed. However, there are still some unsolved issues in the existing intrusion detection schemes for WSNs. Many of the schemes detect attacks according to the anomalies of network traffic. Actually, it is a great challenge to distinguish normal behavior from abnormal behavior because not all of attacks on WSNs will introduce abnormal network traffic. Many intrusion detection schemes only aim to detect several typical types of attacks, while the scenarios of different types of attacks carried out concurrently or cross-layer attacks are seldom considered. The attack behaviors on WSNs are usually interconnected and transformed mutually. It is difficult to obtain good detection performance by only studying how to detect a certain kind of attack. Therefore, it is necessary to pay more attention to complex attack behaviors, such as cross-layer attack, and study how to utilize the protocol feature parameters at different protocol layers, especially the key parameters which may have an important influence on the performance of the network in order to improve the detection ability of intrusion detection systems [38]. In this paper, we propose a trust-based intrusion detection scheme which uses the deviations of parameters of multiple protocol layers as trust metrics, considering that the attacks will inevitably have impacts on the parameters of the different protocol layers. Inspired by the method proposed by [PERSON] et al. [34; 35], we utilize weighting method to build the system model and t-distribution to analyze the performance of our scheme. In our scheme, the monitoring node observes the key parameters of the monitored nodes at the physical layer, MAC layer and network layer, and calculates the deviations of these key parameters. According to the deviations of the parameters, the monitoring node can evaluate the trustworthiness toward the monitored node by aggregating the trust values at different layers and send it to the CH or BS. The CH or BS can then calculate the aggregated trust value of a node according to the trust values which are evaluated by multiple monitoring nodes. If the trust value of a node is less than a predefined threshold, the node is regarded as abnormal. Because the key parameters of multiple layers are being monitored, it is effective for our scheme to detect different types of attacks at different protocol layers. Moreover, our scheme is applicable to both clustered WSNs and flat WSNs. The rest of this paper is organized as follows. Section 2 surveys existing work on trust-based intrusion detection in WSNs. Section 3 describes our intrusion detection scheme. Section 4 analyzes the performance of our scheme by using analytical and simulation approaches, and compares its performance results with those of an existing scheme in the literature. Section 5 concludes the paper.