# Depletion-of-Battery Attack: Specificity, Modelling and Analysis
## 5 DoB Detection  
In this section, we discuss some aspects of DoB detection. Implementation details of intrusion detection system (as well as specific intrusion prevention and mitigation technique, countermeasures against compromised nodes) are out of scope of this paper. A defense scheme against intrusions in WSNs can include identification of attack source, localization of victim sensors, activating safe operating mode, and malicious node isolation. But before applying reactive protection, the DoB attack has to be detected. If reactive protection is used in the normal stage, then sensor throughput degrades. Therefore, reactive protection has to be activated in the attack stage and deactivated in the normal stage. Hence, it is important to detect intrusions with high confidence, that is to say, provide a satisfactory level of false positives and false negatives. In the case of a DoS (or DDoS) attack, the principle of collaborative and distributed detection can essentially improve the efficiency of intrusion detection systems [55]. If nodes detect an attack with inconclusive evidence, then a cooperative intrusion detection procedure aggregates the node reports, and provides a decision about the presence of an intrusion. Due to the increment of QoS degradation under DoS, it allows one to recognize attacks in the early stages. The complexity of the DoB detection problem is that the principle of collaborative and distributed detection does not work well in this case. To illustrate, consider the situation in Figure 4.  
Figure 4: DoB attack based on excessive transmission power. In the normal state, the energy consumption of sensor \(s_{A}\) and the sensors of \(I_{S}\) is as follows:  
\[E_{N}=\sum_{j=1}^{n_{c}}e(j)+e(s_{A}).\]  
Here and below, \(e(x)\) is the energy consumption of sensor \(x\). Without loss of generality, assume that adjacent nodes are separated by distance \(d\). Taking into account our model assumptions, we get:  
\[\forall j\in I_{S}\,e(j)=e(s_{A})=a\cdot d^{\gamma}, \tag{6}\]  
where \(\gamma\) is called the path loss exponent, and \(a\) is a constant defined by the transmitter power amplifier [56]. Therefore:  
\[E_{N}=(n_{c}+1)\cdot a\cdot d^{\gamma},\]  
Under a DoB attack, the total energy consumption becomes:  
\[E_{A}=a\cdot d_{S}^{\gamma},\]  
where \(d_{S}\) is the distance between sensor \(s_{A}\) and the sink node. It is possible to reduce the total energy consumption under DoB. In fact, we get the following inequality:  
\[E_{A}<E_{N},\]  
and hence  
\[d_{S}<d\cdot\sqrt[]{n_{c}+1}.\]  
For example, if \(\gamma=2,\ n_{c}=8,\ d_{S}=\ 3d\), then the total energy consumption is not changed. At the same time, the system lifetime degrades by nine times. If a decision about a DoB presence is based on observation of all sensors, then the attack is not detected. Thus, it is reasonable to deploy an intrusion detection system at each node. It consumes some system resources, and leads to some QoS degradation, but it is a reasonable price for supporting system security. For DoB attack detection, the point-of-change detection technique can be applied [57]. The idea of the intrusion detection method is based on the assumption that DoB attacks lead to relatively abrupt changes in the process of sensor battery depletion compared to energy consumption in the normal case. The detection algorithm is a kind of cumulative sums method (also known as CUSUM). The incoming random values for the algorithm are observations of sensor energy consumption per time units. Let \(\xi_{j},\ j>1\) be the sensor energy consumption per a time unit (a few seconds). The time units are not necessary equal. It is reasonable to merge the successive units, when the energy consumption is very low. If an attack is launched, then the observed random sequence, \(\left\{\xi_{j}\right\}\) changes own properties. Let \(T_{attack}\) be the attack start time (change-point). Let us use the designation \(T_{alarm}\) for the moment of time when the decision about attack presence is made and the corresponding alarm signal is generated.