# An Efficient Location Verification Scheme for Static Wireless Sensor Networks
## 5 Security and Performance Analysis
### Security Analysis
#### 5.1.2 Analysis of the Successful Detection of Location Fraud  
In order to successfully commit location fraud, an attacker has to fabricate the legitimate MSR token. If there is only one attacker, location fraud is not feasible because the attacker cannot collect all of the necessary packets to calculate the MSR token alone. The only way for the attacker to make a legitimate MSR token is by guessing the content of the packets that are transmitted from the MSR of the attacker and the verifier. However, it is also difficult to guess and fabricate the proper MSR token because we used the randomly-generated value to calculate the MSR token. Assuming that the attacker knows the verification process, the attacker can try to bypass D-filtering by carefully faking its location while still maintaining the same distance from the target verifier. This can be done by adjusting the angle between the line from the real location of the malicious sensor to the verifier and the line from the fake location of the malicious sensor to the verifier. We denote this angle as the fake-angle from now.  
Figure 7 shows an example scenario in which a malicious sensor \(M\) tries to claim that it is located at \(M^{\prime}\) by adjusting the fake-angle, \(\theta\). \(M\) must collect the packets from the MSR between \(M\) and \(V\), especially including those originating in the EMSR. As a result, the successful detection of the malicious sensor can be achieved when there is at least one sensor in the EMSR. Then, we can expect the probability of successfully detecting a malicious sensor using simple statistics.  
Since the deployment of sensors in the system follows a uniform distribution, the probability of no sensor being in the EMSR can be predicted. When we denote the entire network region for sensor deployment as \(Z\), and its area as \(A\), the probability distribution function (pdf) for any given sensor \(i\)'s coordinates (x, y) is as follows:  
\[f_{i}(x,y)=\begin{cases}\frac{1}{A}&\text{if $(x,y)$ is within $Z$}\\ 0&\text{otherwise}\end{cases} \tag{3}\]  
The probability of a sensor being located in the EMSR can then be calculated by multiplying the area of the EMSR, denoted as \(S\), to the pdf Equation (3).  
\[P(i\text{ is in EMSR})=S\times\frac{1}{A} \tag{4}\]  
Figure 7: Analysis of the successful detection of a malicious sensor.  
When there are \(N\) sensors in the network, the probability that no sensor is in the EMSR can then be calculated using Equation (4):  
\[P(\text{no sensor in EMSR})=\Phi(S,A,N)=(1-\frac{S}{A})^{N} \tag{5}\]  
As we can see from Equation (5), the probability denoted as the function \(\Phi\) becomes smaller as \(S\) increases, assuming that \(N\) and \(A\) are fixed. In the other case, the function \(\Phi\) decreases as \(N\) increases, assuming that \(S\) and \(A\) are fixed. Considering the applications of WSNs, \(A\) and \(N\) can be predetermined, leaving \(S\) as the only variable that is affected by the attacker's fake location. When the fake angle grows, so does \(S\), as shown in the Figure 7. Thus, an attacker's chance of passing the verification process decreases by the proportion at which the faked location differs from the real location of the malicious sensor.  
This analysis shows that an attacker \(M\) must cooperate with at least one other attacker, \(CM\), which can overhear the packets sent from the EMSR, as shown in Figure 8. In this collaborative attack scenario, more than two attackers can collude to pass the location verification process. As shown in Figure 8, a malicious sensor \(M\) tries to fake its position as if it is at the position of virtual sensor \(M^{\prime}\), and the colluding sensor \(CM\) assists \(M\) by delivering its neighbors' packets, which are unreachable by \(M\). Although the \(CM\) can gather the packets required for \(M\) to generate the MSR token, \(M\) should spend more time filtering out unnecessary packets after receiving all packets from \(CM\). Thus, \(M\) will spend more time than the usual situation.