# A New Lightweight Watchdog-Based Algorithm for Detecting Sybil Nodes in Mobile WSNs
## 2 Related Works  
Sybil attack was introduced for the first time in [17] for peer- to- peer networks. In [2], it was noted that this attack can also be a dangerous threat to routing algorithms in WSNs and can be. [PERSON] et al. [6] present a detailed analysis of the Sybil attack in WSNs alongside some attack detection mechanisms. Also, the taxonomy of Sybil attack are introduced in the same work which is referenced to by most researchers in the field. In what follows we review some important related works within the categorization framework introduced in Figure 1.  
Focusing on PHY-layer-based approaches, in [6], several approaches in Sybil attack detection have been discussed. The first one is radio resource testing, a non-location-based technique, which relies on the assumption that a node can communicate with each of its neighbors through pre-assigned channels. When a node wants to verify one of its neighbors, it could choose a channel randomly to listen. If the neighbor that was assigned that channel is legitimate, it should hear the message. This detection technique might not work in the case of an attacker equipped with a multi-radio transceiver capable of concurrently communication through different channels. [PERSON] et al. [18] propose a Sybil attack detection scheme in Mobile Ad hoc Networks (MANETs) based on monitoring and differentiating between the entry and exit RSS behavior of legitimate nodes and the Sybil attackers. There are other techniques introduced in [6] which belong to the upper-layer-based category and will be discussed in due place. Most of Sybil attack detection approaches are based on location-verification based which use some related techniques, such as RSSI or TDOA, to distinguish between Sybil and normal nodes. Since these methods depend on some parameters of receiving signals, most probably tainted with noise and multi-path phenomena, they might end up being less reliable. The RSSI-based location determination has been used In [19] to detect Sybil nodes. Four detector nodes which are able to hear the packets from all areas of the network, cooperatively evaluate the location of the node sending the packet. Node IDs found to be sending packets from the very same location are assumed to be Sybil IDs. In [20] a solution for Sybil attack detection is proposed based on TDOA between a source node and three beacon nodes which detect the location of Sybil nodes. Since three Beacon nodes are used to calibrate the time measurements, there is some communication overhead present. Another Sybil detection system has been proposed in [21] which relies on the raging capabilities of Ultra-Wide Band (UWB) in the PHY layer. Each node periodically monitors its distance from each possible pair of its neighbors. An alarm is triggered when two or more nodes are being located in the same area. The locally computed ranging estimation is used to measure the distance between neighbors. As the authors mention, the proposed technique induces lack of compliance with old-fashioned WSNs. In this work node mobility has not been considered. Turning our focus on upper-layer-based approaches, code attestation-based techniques are another approach mentioned in [6]. these differentiate the code running on a malicious node with that of a legitimate node [9,10]. A compromised node detection algorithm, based on code attestation, is proposed in [11] and called Unpredictable Software-based Solution (USAS). USAS administers attestation on a randomly selected nodes rather than all, in order to decrease checksum computation time. Since it only attests nodes one hop from the base station, if a compromised node is far from the base station (more than one-hop), it might not be detected. An authentication-based approach, also introduced in [6], is a version of random key per-distribution.