# A New Lightweight Watchdog-Based Algorithm for Detecting Sybil Nodes in Mobile WSNs
## 1 Introduction  
Nowadays we are witnessing the emergence of new WSN applications in different fields such as military, urban services, the environment, medicine, explorations and Intrusion Detection Systems (IDS). WSNs comprise a large number of small sensor nodes featuring small memory and low power. The broadcast nature of wireless and unattended operation of WSNs necessitate the implementation and improvement of security schemes [1; 2]. Operation disruption in hostile wireless networks can be realized in Physical (PHY) or higher layers. In the former case, a malicious node tries to harm communication between wireless nodes by broadcasting jamming signals [3] or imposing any other kind of interference [4] whereby normal wireless nodes become unable to interpret receiving signals. in the latter case, malicious nodes try to either deceive normal wireless nodes through disseminating fake information (e.g., Sybil, wormhole, impersonation, and etc. attacks) or overwhelm/disable normal wireless nodes using, for instance, Hello flood attack [2]. In this paper, we focus on the Sybil attack which is one of the most important attacks in WSNs. In this attack, an illegal node or a legal node captured by enemy, called a \"malicious node\", identifies itself by releasing several fake IDs or IDs fabricated from other legal nodes. The fake IDs represent some non-existing nodes known as Sybil nodes. As a result, legal nodes think they have many legitimate neighbors. Malicious nodes can affect routing and operational protocols such as data aggregation, voting, resource allocation, misbehavior [5; 6]. In general, Sybil attack detection techniques can be categorized into centralized and decentralized methods. Centralized methods feature a central node which is responsible for node identity management. In relevant detection methods, the information in central nodes are used for Sybil attack detection. Decentralized methods make use of some pre-authenticated nodes, sometimes called watchdogs, trusted, etc., which administrate the attack detection operation. These watchdogs can be fixed or mobile. From a networking layer stack point of view, Sybil attack detection techniques can be grouped into PHY-layer-based and upper-layers-based techniques. The former make use of the parameters of the radio signal and the second layer's node identity information. On the other hand, the latter techniques are based on the communication of the data which is formed in the upper layers. Nevertheless, the identity information is still required in upper-layer based techniques. PHY-layer-based category is further divided into location and non-location-based techniques. Location-based techniques mostly involve analysis of Received Signal Strength Indicator (RSSI), Time Difference of Arrival (TDoA), and Angle of Arrival (AoA). One of the techniques under non-location-based category, as far as we could identify, is the Radio resource testing [6]. The techniques under the upper-layers-based category are further divided to neighborhood-based [7; 8], code attestation-based [9; 10; 11], authentication-based (puzzle solving technique [12] for peer-to-peer networks, Identity certificate technique [13]), and identity registration-based [14]. Figure 1 illustrates the Sybil attack detection techniques categorization. In mobile WSNs, Sybil nodes corresponding to a particular malicious node appear/disappear simultaneously in/from some neighborhoods. This behavior (misbehavior) can be used for Sybil nodes detection. At the same token, Watchdog-based techniques have been extensively employed to detect misbehaviors in WSNs [15; 16]; thus, it is plausible to think of it as a tool for Sybil nodes detection as well. In this paper, we propose a lightweight, sufficiently accurate, and practical watchdog-based algorithm for detecting Sybil nodes in mobile WSNs. Our algorithm, considered as a neighborhood -based technique, does not need any centralized base station and does not require transmission of neighborhood data (neighborhood table) from normal nodes to watchdog nodes.