# A Hybrid Trust Model against Insider Packet Drop Attacks in Wireless Sensor Networks
## 3 Motivation of the Proposed Work  
Vulnerabilities exist in each of the three stages of the trust mechanisms. As the limitations of watchdogs have been well-documented [4; 30], we will focus on the last two stages to motivate our work in this article. First, in the trust measurement stage, the penalty on packet drops by current trust models does not effectively punish the attacker. It results in a long detection time to identify the attack during which damage will be made, particularly when the attackers have previously earned high trust value (called traitors). For example, when 0.80 is used as the trust threshold, an attack with initial trust value 0.99 can drop 183 and 84 packets before being detected by the beta and entropy trust models, respectively (see Section 5 for more details). Second, in the detection stage, the major threat comes from the fact that the inside attacker, as a legitimate member of the network, knows the network's trust mechanism and the trust threshold _TH_. Therefore, the attacker can estimate its trust value based on its own packet forwarding and dropping behavior, and then decide whether it would attack accordingly. For instance, when the network uses 0.80 as the trust threshold, a grayhole attacker can drop slightly less than 20% of the packets it receives without being detected, and an on-off attacker can keep its attacking period to be less than 20% to avoid being identified. We believe that the rationale behind the inefficiency of the current trust models is that they solely rely on the number of total failures and completely ignore the distribution of these packet delivery failures. As the first attempt to measure the trust value with information beyond the total number of successes and failures, we propose to use consecutive packet drops (or consecutive delivery failures) for the early detection of inside packet drop attackers. Detecting inside attackers as soon as possible (early detection) is critical  
Figure 1: GPSR (solid lines) and trust-based GPSR (dotted lines); the numbers in circles represent sensor nodes’ IDs. BS can detect the intruder. In this intruder detection problem, consecutive drops are more critical than in the former case (network performance degradation). Third, statistically, a large number of consecutive drops are much more likely to happen at attacking nodes than at nodes functioning normally in the network. We can probabilistically measure the degree of abnormality of a node generating consecutive drops as follows. Let \(P[f]\) be the probability that a packet is dropped at a normally functioning node. Then, the probability that a packet is forwarded successfully will be \(P[s]=1-P[f]\). If we observe 10 consecutive drops at the node, then the probability that the 10 drops occur consecutively is \(P[f]^{10}\). When we assume \(P[f]<P[s]\) in a well-designed WSN, even if \(P[f]\) is 0.5, \(P[f]^{10}\approx 0.000977\)(=0.977 \(\times\) 10\({}^{-3}\)), which means that it is very unlikely that 10 consecutive drops are happening. As n grows, the probability that n consecutive drops happen (\(P[f]^{n}\)) decreases exponentially. For a more realistic example, when \(P[f]=0.05\), the probability that a good node drops three packets in a row is \(0.05^{3}\approx 0.977\times 10^{-6}\). For an attack that drops 70% of its packets, this probability is 0.343, approximately 3.51 \(\times\) 10\({}^{5}\) higher than the above good node. Therefore, we believe that consecutive packet drops will happen in all types of insider packet drop attacks but are very unlikely to happen at a good functioning node. This unique characteristic should be considered in the design of trust models and trust-based defense mechanisms against insider packet drop attacks. As the above analysis shows, three consecutive drops already indicate a significant abnormality. We do not need a very large number of consecutive packet drops to distinguish an attacker from a good node. Finally, using consecutive drops for detecting packet drop attacks may generate a false alarm.