# A Hybrid Trust Model against Insider Packet Drop Attacks in Wireless Sensor Networks
## 2 Background
### Trust Mechanism  
A trust mechanism defines a trust value (or trustworthiness) for each node and how each node measures the trustworthiness of its neighbors. It detects insider packet drop attacks in three stages: neighbor behavior monitoring, trust measurement, and attacker detection.  
1. Neighbor behavior monitoring: Each node monitors and records its neighbors' behaviors, such as packet forwarding. Watchdog [4] is a popular monitoring mechanism used in this stage. Each node A records all recently forwarded packets in a buffer. When A sends a packet to its neighbor node B, A monitors whether [PERSON] forwards the packet toward the BS by overhearing [PERSON]'s packet transmission. Each overheard packet will be compared with the packets that [PERSON] has sent to B. When A finds a match in its buffer, A will record that [PERSON] has forwarded the packet and will remove it from the buffer. If a packet remains in the buffer for a period longer than a pre-determined time, the watchdog considers that [PERSON] failed to forward the packet.  
2. Trust measurement: Based on the data collected in the previous stage, a trust model will measure the trustworthiness of the node being monitored [8; 9; 13; 14; 18; 25; 26; 27]. For example, when a node is observed to have forwarded the packet s times and dropped the packet \(f\) times, the beta trust model [18] will assign this node a trust value using the following equation: \[T_{Beta}(s,f)=E[beta(p|s+1,f+1)]=\frac{s+1}{s+f+2}\] (1) where E[beta(\(p\,|\,s+1,f+1\))] is the expectation of the probability density function of the beta distribution given s and _f_[9; 28]. The entropy trust model [8] uses entropy function: \[H(p)=-p\log_{2}p-(1-p)\log_{2}(1-p)\] (2) where \(p\) is the trust value in the beta trust model, and define the trust value by: \[T_{Entr}=\begin{cases}1-H(p),&for\ 0.5\leq p\leq 1;\\ H(p)-1,&for\ 0\leq p<0.5.\end{cases}\] (3) Note that in Equation (1), the trust value is between zero and one. However, the trust value in Equation (3) is between \(-1\) and \(1\). To have a non-negative trust value between zero and one, we define: \[T^{*}{}_{Entr}=\frac{1+T_{Entr}}{2}.\] (4)
3. Detection: By comparing the measured trust value with a pre-determined threshold _TH_, a node can decide whether its neighbor is trustworthy. If the neighbor's trust value becomes lower than _TH_, it will consider this neighbor as an inside attacker. That is, if node A evaluates its neighbor B's trust value as \(T\) and the trust threshold _TH_, the A will classify the state of trustworthiness of B, \(S[B]\), by the following simple comparison: \[S[B]=\begin{cases}Trustworthy&if\ T\geq TH\\ Untrustworthy&if\ T<TH\end{cases}\] (5) Since inside packet drop attackers are likely to have low trust values, they will be classified into untrustworthy nodes and discarded from the monitoring node's routing table. Depending on the network's trust mechanism, the detection of inside packet drop attackers may or may not be broadcast to the rest of the nodes in the network. In our paper, we assume that the decision will not be broadcast for simplicity.