# Clone Node Detection Attacks and Mitigation Mechanisms in Static Wireless Sensor Networks
## 3 Cybersecurity Attacks in Wireless Sensor Networks
### Clone Node Attack (Replication Attack) in Static Wireless Sensor Networks
#### 3.3.2 Clone Node Attack Detection Techniques in Static Wireless Sensor Networks  
Various techniques have been proposed to detect the replicas nodes in static wireless sensor networks. There exist generally two common ways of detecting this attack, and they can be categorized into two classes, which are _centralized_ and _distributed_ techniques. Once a node is cloned, the attacker can then launch any other attacks of his choice. The centralized approach uses the base station node to detect and foil the activities of the illegitimate nodes (clone nodes,) while the second approach selects nodes to detect clone nodes and disturb their activities in the network. The distributed approach is an appropriate technique for static WSNs because it uses the information of the location of the nodes to detect clones and sensor nodes with the same identity, but dissimilar addresses are taken as clone nodes. Before going into the depth of this section, one of the most popular ways of detecting replication attacks in WSNs is elaborated on in the very next subsection. Common Step of the Detection in Static WSN  
Usually, it involves the analysis of the logical ID of a legitimate node, to check if it is connected with more than one node in the network. However, this step of detecting replication attacks in static WSNs is inefficient in mobile WSNs. The reason is that, in mobile WSNs, the nodes keep moving around the network. Therefore, an ID can be detected in some location, and it is possible after checking the network again, that the ID is found in another location, which does not mean there is a clone attack because of that. (See [14,15] for more information). Centralized Clone Detection Techniques  
Figure 5: Procedures of creating a replication attack in static WSNs. These approaches mostly rely on a potent base station, usually called _sink_ for decision making and data convergence. (1) In this scenario, the nodes send their location claims to the sink with the help of their neighbors. (2) The sink will verify the behavior of the IDs of the nodes. (3) If one ID is found in more than one position, then an alarm will trigger to alert the presence of a replica attack. These methods are powerful enough to detect replication attacks in WSNs. However, they cannot guarantee that the secrete data of the sensor nodes are secured, since they relate only to IDs that belong and location verification. Another significant issue is that the lifetime of the network may lessen speedily due to the phenomenon that the closest nodes to the base station nodes lose their energy swifter. The static WSNs centralized detection approaches (parent-class) can be classified into the following categories (child-class):  
* Base station-based,
* Key usage-based,
* Location-based,
* Cluster head-based,
* Neighbor ID-based. Advantages and Disadvantages of These Categories  
In the _base station-based_ scheme or category, it maintains few beneficial properties, which are considered as an advantage. Among which, some are highlighted as follows: location independent, high detection probability, low memory overhead, equal distribution of witnesses using pseudo-random choice or selection of the witness nodes, low storage overhead and communication. Disadvantages: need of a trusted third party, deterministic, lack of scalability, costly etc. (We take SET [16], RED [17], and Tayeb [18] algorithms as an example). _Key usage-based_ (taking [PERSON] et al. 's [19] algorithm as an example): High rate of false positive and false negative alerts are categorized as drawbacks. _Location-based_, commonly named as _zone-based_ (taking the ZBNRD [20] algorithm as an example). Advantages: dynamic detection of the clone nodes. Disadvantages: deterministic. (See also [21] for dynamic detection clone nodes.). _Cluster head-based_ (taking ABCD [22], and LNCA [23] algorithms as an example). Advantages: probability of detection is high, communication overhead is low. Disadvantages: Clone nodes detection likelihood is extremely low.