## 4 Attack Model  
In order to analyze the most relevant security threats for the class of networks under consideration, a threat model for a self-organized decentralized WSN was made. This model is intended to help identify the most important threats and, consequently, attacks that need to be detected in such a network. The threat model is presented in Table 3. \begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Treat**} & **Importance of** & **Probability of** & **Description and Examples** \\  & **the Threat** & **Realization** & **Classification** \\ \hline \multirow{4}{*}{Data integrity breach} & \multirow{2}{*}{high} & \multirow{2}{*}{high} & \multirow{2}{*}{Modification of data transmitted over the network. The modified data can distort the parameters measured by nodes or change the parameters of WSN control commands (e.g., Sinkhole, Wormhole)} \\  & & & & \\ \hline \multirow{4}{*}{Data availability breach} & \multirow{4}{*}{middle} & \multirow{4}{*}{high} & \multicolumn{2}{c}{Disconnecting nodes from the network or creating conditions where nodes cannot respond to requests in a reasonable amount of time. It causes data loss in the WSN. (e.g., jamming, DoS, blackhole)} \\  & & & & \\ \hline \multirow{4}{*}{Data privacy breach} & \multirow{4}{*}{middle} & \multirow{4}{*}{high} & \multicolumn{2}{c}{Copying of data transmitted over the network by an attacker. It can be used in preparation for other attacks. (e.g., sinkhole, Sybil, wormhole, blackhole)} \\  & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Threat model of a self-organized decentralized WSN. Figure 3: State and transition graph illustrating possible states of a WSN node. After building the WSN model and tread model, we specify the attacks that a self-organized decentralized wireless sensor network is subject to. Generally, the attack model is represented as a set of tuples:  
\[\{(\text{Type}_{\text{impact}},\text{Type}_{\text{attack}},\text{Target}_{\text{attack }},\text{Involv}_{\text{selforg}},\text{Involv}_{\text{decentral}})\}, \tag{4}\]  
where \(\text{Type}_{\text{impact}}\) specifies the subclass of the object that is affected. More specifically, \(\text{Type}_{\text{impact}}\) specifies data, software of the nodes, network and transport layer protocol used or the physical communication channel. \(\text{Type}_{\text{attack}}\) determines a particular type of attack, i.e., the method used to influence the target of the attack. \(\text{Target}_{\text{attack}}\) specifies the particular target of the attack. \(\text{Involv}_{\text{selforg}}\) represents a binary characteristic determining if the attack is based on the exploitation of the self-organization property. Similarly, \(\text{Involv}_{\text{decentral}}\) represents a binary characteristic determining if the attack uses the exploitation of the decentralization property. Thus, each specific instance of the tuple defines a set of five characteristics of the attack under consideration, while the model presents a list of such tuples. As an example for a wormhole attack [16], the tuple takes on the following form: data transmitted to the WSN, wormhole type, violation of confidentiality and data integrity, true, true. Let us consider the following main and most important types of attacks inherent in WSNs. The essence of a sinkhole attack, which aims to both eavesdrop on network data and modify them, is that a malicious node forces other nodes to transmit data through it and, thereby, 'convinces' them that data transmission through it represents the shortest route [23; 24]. Therefore the nodes begin to transmit data through this attacking (infected) node only. The attack disrupts the routing mechanism and can be performed by introducing a new node into the WSN or by influencing an existing one. A wormhole attack intercepts a message from one node to another and delivers it faster, that is, in fewer hops. As a result, the original, legitimate copy of the message will be discarded by the recipient node [23; 25; 26].