# A Protocol Layer Trust-Based Intrusion Detection Scheme for Wireless Sensor Networks
## 1 Introduction  
Wireless sensor networks (WSNs) are widely used in variety of fields, such as agricultural, environmental, industrial and military monitoring applications. WSNs can be divided into flat- architecture WSNs and clustered-architecture WSNs according to their architecture. In the flat- architecture WSNs, all the sensor nodes (SNs) transmit their own data or relay data for other nodes to the base station (BS). In the clustered-architecture WSNs, the adjacent SNs are organized as a cluster, and a cluster head (CH) controls its cluster. The SNs that belong to the same cluster can only exchange information via their CH and the CH transmits information either directly or through some other CHs to the BS. Clustering brings many advantages, such as energy efficiency, better network communication, efficient topology management, minimized delay, and so on. WSNs face serious security problems, because of the openness of nodal deployment and wireless communication. In some WSN deployments, the SNs may be captured and the key information might be leaked or compromised. The purpose of an attacker is to disrupt the security attributes of WSNs, including confidentiality, integrity, availability and authentication. To achieve these objectives, the attacker may launch attacks from different protocol layers of WSNs. At the physical layer, the attacker can jam the physical channel by interfering with the radio frequencies that nodes use for communication [1]. The attacker can also extract the secret information from the captured node, tamper with its circuitry, modify the program codes, or even replace it with a malicious node [2]. Attacks at the medium access control (MAC) layer aim to disrupt the availability of the network bypurposefully creating collisions, obtain unfair priority in the contention for the channel or dissipate the limited energy of nodes. Attacks at the MAC layer include collision, denial of sleep, Guaranteed Time Slot (GTS) attack, back-off manipulation and so on [3; 4; 5; 6]. Attacks at the network layer aim to disrupt the network routing, and acquire or control the data flows. Examples are spoofed routing information, selective packet forwarding, sinkhole, wormhole, blackhole, sybil, and hello flood attack [7; 8; 9; 10]. Besides the attacks aiming at a single protocol layer, there are cross-layer attacks which relate to multiple layers in WSNs [11; 12; 13]. Cross-layer attack can achieve better attack effects, better conceal the attack behavior or reduce the cost of attack compared to the attacks at a single layer. Considering the limited resources of the SNs, it is not realistic for WSNs to implement high-strength security mechanisms. Furthermore, the attacker may have the ability of breaking through or bypassing the protection of security mechanism with the progress of attack technologies. Thus serving as a second wall, intrusion detection plays an important role in protecting the network. The intrusion detection system for WSNs can detect whether there are behaviors violating the security policy and record evidence of being attacked by collecting and analyzing the information from sensor nodes and networks. It can send alarm timely to the system administrator and perform some countermeasures against the attack. There are now two kinds of intrusion detection systems [14]. One is the misuse detection system, the other is the anomaly detection system. Misuse detection is based on predefined rules, where it is easy to detect known attacks, but impossible to detect unknown attacks. Anomaly detection compares present activities with normal system status and user behaviors to detect anomalies. Compared with misuse detection, anomaly detection has higher detection rate and the ability to detect unknown attacks, with its false positive rate increasing correspondingly. The focus of this paper is on anomaly detection schemes.