# A Statistical Approach to Detect Jamming Attacks in Wireless Sensor Networks
## 5 EWMA Algorithm
### Detection System Design  
In hierarchical WSNs, the sensing and monitoring function of the sensor nodes is distributed into different levels. Cluster-based WSNs are a typical example of hierarchical WSN, therefore in this work, we limit our scope to cluster-based WSNs. Deployment of sensor nodes into clusters has proved to be very efficient during sensing and monitoring, as it offers advantages such as fault tolerance, efficient data aggregation and reduced energy consumption. The architecture of the clustered WSN comprises of three types of nodes; namely, the member nodes, the cluster head and the base station (see Figure 1). The member nodes forward sensed messages to their respective cluster heads through a process referred to as intra-cluster communication. The cluster head in turn aggregates and compresses the messages received from its members for upward transmission to the base station. Therefore, the architecture of cluster-based WSN can be regarded as a two-layer hierarchy WSN, where the cluster heads belong to the upper layer and the member nodes operate at the lower layer. The cluster heads in most cases perform more functions than the ordinary member nodes, therefore, cluster heads are often of higher capacity with respect to radio subsystem, processing subsystem, sensing unit and power supply. In this work, we assume that the cluster heads are of higher capacity, therefore our detection takes place in both the cluster heads and the base station (see Figure 1). All member nodes are within communication range and are one-hop away from the cluster head; likewise all the cluster heads and base stations. Our design approach is a stepwise decentralised approach, where jamming detection in member nodes are done by the cluster heads based on the input metric (i.e., IAT) received from member nodes. Just as in the case of cluster heads detection, the base stations in turn detect jamming attacks in the cluster heads based on the packet IAT input data received. As mentioned, both the cluster heads and the base station takes the packet IAT as input and use the EWMA algorithm to detect mean shifts in event intensity during jamming attack at each level in WSN. Figure 2 below depicts our DoS jamming detection framework in WSN. The member nodes sense information of interest in its deployed environment and use their inbuilt microcontrollers to process the sensed information. The corresponding result is sent to the cluster head that has the jamming detector. This detector measures the IAT of the packets received from the member nodes and uses the EWMA algorithm to detect a mean shift in event intensity during jamming attack. During jamming attack, this attack will be detected and the node generating the attack located and removed from the network. Alternatively, during the period of non-jamming attack, the packets in the cluster head will be processed and sent to the base station. In situation where the jamming attack is directed towards the cluster head, the base station receives the aggregated data from the cluster head and the detector installed on based station calculates the IAT of the received packet to detect a jamming attack using EWMA. If detected, the node generating the attack will be traced and removed from the network while legitimate packets will be stored if otherwise. The base station, in our work is located in a secure location close to the end user. In summary, our jamming detection technique consists of two phases; the first phase is the training phase that involves the capture of normal IAT from legitimate member nodes to the cluster head and also from the cluster heads to the base station to initialize its parameters and obtain a normal profile. Just like in the work of [PERSON] et al. [34], no change point detection process will be performed during this phase. In the second phase, the test phase, a pattern change is detected during a jamming attack on a per packet basis using the EWMA algorithm. If an attack is detected, an alarm is triggered and the malicious node is removed from the network.