# Depletion-of-Battery Attack: Specificity, Modelling and Analysis
## 4 DoB Analysis
### DoB Based on Excessive Packets  
We now consider the case where a DoB attack is organized by excessive packet generation. An intruder can generate spoofed packets, retransmit legal packets multiple times, use an inefficient routing path, or use other ways to increase the offered load on the sensors. In this case, the traffic intensity essentially grows, and obviously, QoS is degraded. The novel traffic rate is:  
\[\lambda^{*}=(\lambda_{A}+\lambda)p_{A}+\lambda(1-p_{A})=\lambda_{A}p_{A}+\lambda.\]  
Here, \(\lambda_{A}\) is the redundant packet rate, and \(p_{A}\) is the probability of the presence of an attack. The state diagram for sensor battery behavior is shown in Figure 2. If \(p_{A}=0\), then an attack is absent, and we get the situation described above. If \(p_{A}=1\), then the sensor is permanently under attack. Generally \(0<p_{A}<1\) for the following reasons. The intrusion duration can be non-continuous and random. It can be designed by an attacker, in that this attack is energy efficient and hardly detectable. Examples include selective forwarding, random or reactive jamming. In the DoB attack, the set of target sensors and the duration of spoofed packets injection can be randomly defined and dynamically changed, as well. Moreover, the DoB attack can be suspended for reasons beyond the attacker's control. For example, a sensor can switch itself to sleep mode. The spoofed packets can be recognized and eliminated from the outgoing flow. A sensor does not receive packets if there is buffer overflow, and so on. Being that the energy consumption for transmitting one packet is not changed, the total number of packets transmitted by a sensor is given by formula (1). The expected sensor lifetime becomes:  
\[\mathrm{MTTF}=\frac{N_{0}}{\lambda^{*}}, \tag{2}\]  
and  
\[\mathrm{SSF}=\mathcal{H}(h,\lambda^{*},N_{0}). \tag{3}\]  
The result of DoB is \(\lambda^{*}/\lambda\) times degradation in MTTF, and:  
\[\frac{\lambda^{*}}{\lambda}=1+\frac{\lambda_{A}}{\lambda}p_{A}.\]  
To estimate the value of \(p_{A}\), an additional model is required. Model details vary, depending on the objectives and scope of the researchers. Here, we consider the particular case as follows. Assume a sensor has the following states:  
* Norm--an attack is temporally absent and the sensor functions correctly
* Attack--besides legal packets, a sensor receives and transmits spoofed packets
* Safety--a sensor does not transmit any packets  
Figure 2: State diagram with absorbing state for sensor battery behavior. A sensor enters the Safety state not only under the influence of attack, but also under normal conditions. Generally, firmware of sensors supports sleep mode. It is a widely used approach for energy consumption optimization. Therefore, a sensor can switch to safety mode even if an attack is absent. In this scenario:  
* an attacker attempts to deplete the sensor battery as soon as possible, so the DoB attack can be interrupted if and only if the sensor is switched to the safety mode; and
* safety mode control does not depend on the previous sensor state  
It has been suggested to model sensor functioning by the irreducible aperiodic continuous-time Markov chain, with the states space \(\Omega=\{\)Norm, Attack, Safety\(\}\), as shown in Figure 3. The presented model is a modification of models from elsewhere [18; 53; 54]. The infinitesimal generator \(G\) of the corresponding Markov process is as follows:  
\[G=\left( \begin{array}{ccc}-(\alpha_{1}+\beta_{1})&\alpha_{1}&\beta_{1}\\ 0&-\alpha_{2}&\alpha_{2}\\ \beta_{2}&0&-\beta_{2}\end{array} \right),\]  
where \(\alpha_{1}\) is the transition rate to the attack state, and \(\alpha_{2}\) is the transition rate from the attack state. These parameters describe the attack intensity and the sensor's ability to counteract the intrusion. The variable \(\beta_{1}\) denotes the transition rate from the normal state to the inactive safety state, while \(\beta_{2}\) denotes the transition rate from the safety state to the normal state, when the sensor transmits packets.