# Clone Node Detection Attacks and Mitigation Mechanisms in Static Wireless Sensor Networks
## 5 Ontology in Wireless Sensor Networks
### Ontology for Replication Attacks in Static Wireless Sensor Networks (ORASWSN)  
To develop our ontology, we take into account a few key points that must be addressed in the mitigation phase, which are:  
(a) The origin of the attacker, (b) what information is provided by the attacker and where it is provided, (c) how can we distinguish the clone node attack information from innocent input, or an accidental change, (d) what other metadata are needed when trying to analyze the network behavior, (e) what information is monitored by IDS/IPS systems or firewalls, etc. Our ontology (ORASWSN) chart description consists of five main parts:  
(1) Physical security layer: For the attacker to generate replication attacks to the wireless sensor networks, he must have physical access to the sensor nodes. Therefore, this ontology requires that a physical safegu should be set, which will represent the first barrier the attacker has to break to enter into the WSNs environment. This layer can be composed of a security agent in a gate, with a weapon, camera, and walls, etc. (2) Security measure requirements: Our scheme assumes that a maximum of security layers should be applied to the WSN network, such as cryptographic methods for the communication between the nodes, key-establishment, hash of the keys, physical security safeguard, and so many more. (3) Information-gathering: Information-gathering is performed by the **manager** class before launching the network. At the initial phase, the system gathers together all the information about the sensor nodes, ID, keys, hashed text, location (if centralized), etc., defines the relationship between the base station and nodes, and gathers the maximum knowledge about the WSN packages and attacker's needs, which if applied, can make a replication attack possible. Further, the ORASWSN scheme creates a database to store this information by installing and configuring an intrusion detection system (IDS) tool to match the stored information; the scheme also sets rules under which the nodes have to bow down. That being said, whenever a node dispatches the rules set by the administrator, an alert is triggered. (4) Zero-tolerance: This characteristic is carried out in the **IDS** sub-class. In our approach, the IDS is configured in the database as a zero-tolerance tool against any modification in the system after launching the WSN network (whether or not caused by natural events, accidental change from authorized people, or by an attacker). If the administrator is about to make changes to the WSN system (for example, changing the battery of sensor nodes, remove sensors, etc. ), then he must reconfigure the IDS for that specific interval of time; otherwise, an alarm will trigger. The IDS has three (3) primary actions to execute, i.e., monitor, log and alert. (5) Mitigation mechanism: In our proposed ontology approach, this is the place where all the cyber responses are applied. It is mostly managed by experts (manager/administrator), who utilize the information of the logged files from ID and scrutinize the data to execute the response. An intrusion prevention system tool (IPS) is also required to be established in the security zone by the security engineers. This section in this scheme is extremely significant in such a way that it helps us trace the attacker, and block his activities in an appropriate time and manner. Applying this ontology in a wireless sensor network environment will significantly improve the security of the system, by an auto-generated alert if the behavior of any component in the network does not match the intended functionality. Thus, it has the potentiality to detect the clone node attacks (replication attacks), and also, it can reduce this type of attack. Moreover, our proposed scheme can be applied for Sybil attack, DoS attack, and many more. Fortunately, thanks to the re-usability property of the ontology, one does not need to start building an ontology from scratch.