# A Hybrid Trust Model against Insider Packet Drop Attacks in Wireless Sensor Networks
## 1 Introduction  
In wireless sensor networks (WSNs), sensor nodes will generate data packets and send them to the base station (BS) in a collaborative multi-hop fashion to overcome the problem of their limited energy and transmission range. While being routed to the BS, data packets may be lost because of collision, congestion, fading, obstacles in the field, or other network problems. The so-called _insider packet drop attacks_ refer to a set of attacks where compromised nodes intentionally drop packets [1, 2]. These attacks have become a serious security threat in WSNs [1, 3, 4, 5, 6, 7]. A well-positioned attacker can be on the routing path of many nodes and thus receive many data packets. It can simply drop them to cause damage to the network. Moreover, it is challenging to detect and defend against such inside attackers because they can disguise their malicious packet dropping behavior behind the aforementioned natural packet loss phenomenon. A trust mechanism has been proven as a promising approach to identify inside packet drop attackers [8, 9, 10, 11, 12, 13, 14, 15]. In this approach, each node will monitor its neighbor's packet forwarding behavior and use this observation to measure the trustworthiness of its neighbors. Once a neighbor's trust value falls below a pre-determined threshold, the monitoring node will consider this neighbor as an inside attacker, eliminate it from the routing table, and establish a new routing path to avoid it. Such trust-based routing approaches can gracefully mitigate insider packet drop attacks by building trustworthy paths to the BS. It is shown that trust-based routing can improve the packet's successful delivery under insider packetdrop attacks over routing algorithms that do not consider trust [8; 11; 12; 14; 16]. The simplicity and effectiveness make trust mechanisms a good choice to mitigate insider packet drop attacks in a WSN where the nodes have limited resources and computation power. However, inside attackers are also legitimate members of the network and they will know the trust mechanism being used. As we will elaborate on later, it is important for attackers to launch insider packet drop attacks without being detected by the existing trust mechanisms. Meanwhile, inside attackers can continue to drop packets and cause damage to the network performance before they are detected and eliminated from the network. Therefore, quick and accurate detection of inside packet drop attackers is critical to minimize the damage to the network, especially for networks that carry out mission-critical applications. Clearly, any characteristics that can distinguish inside packet drop attackers from other normal nodes will help in evaluating a node's trustworthiness and thus improves the detection effectiveness of trust mechanisms. In this article, we propose _consecutive packet drops_ as one of these characteristics for the following three reasons. First, in many applications, inside packet drop attackers have to drop packets consecutively to achieve their goal, and this has been demonstrated in previous studies [9; 12; 17]. Second, a large number of consecutive drops are unlikely to happen naturally at a normal node. Third, when a normal node drops packets consecutively due to a network problem, although it is not an attacker, it may be advantageous to eliminate this node from the routing path to improve network performance. Basically, the first two reasons indicate that consecutive packet drops can distinguish behavior between attackers and normal nodes; the last reason argues that a false alarm (that is, misclassifying a normal node as an attacker) may not cause much damage to the network performance. Current trust models, including the popular beta trust model [18] and entropy trust model [8], only consider the total number of packet drops and do not address the distribution of these drops. As we will show later in this article, such models cannot be effective in detecting inside attackers.