## 7 Module III: Temporal Privacy  
WSN could suffer from time correlation attacks [11, 13, 14, 23, 42] by observing the time between correlative packets sent and received in a certain neighborhood. The adversary can trace forward and backward the messages until they reach to the BS or to the source. Hence, hiding temporal information is crucial for both anonymity and location privacy. Using routing schemes to protect against time correlation attacks is found to be efficient to certain extent where local adversary usually has limited mobility and partial view of the network traffic. However, routing based schemes do not work for global adversary where the traffic of the whole network can be easily monitored with a full spatial view and the adversaries can collude together to promptly detect the origin and time information of the event [18, 34]. A mechanism is required to divert attention of the adversary when there is event-driven transmissions,especially with the presence of global adversary [43]. Figure 8 exhibits a probabilistic distribution for the fake messages. The distribution of events changes which could be a reason for the adversary to detect the event timing and thereafter the source of the event. The message distribution (both real and fake) needs to be adjusted to prevent time correlation. In some applications, such as monitoring and surveillance, we cannot guarantee a certain event distribution. The literature talk about three ways to maintain an obfuscated message distribution: (i) By issuing message delays; and (ii) by issuing fake messages; and (ii) by using both delays and fake messages. Using delays works well against local adversary but might not be suitable for time sensitive networks. In contrast, using fake messages is required to protect against multi-local and global adversary, however, it is very expensive in terms of energy dissipation. Furthermore, adversary with good statistical analysis can easily detect the message distribution if the scheme is not designed carefully [34]. Some work in the literature clearly differentiates between two terms: the _event_ (of transmission) and the _interval_ (of transmission). If every interval has only one transmission, then event and interval are the same, however, this might not be the case when we have multiple transmissions during one interval. So, the anonymity level depends on the capability of the adversary to distinguish between real and fake transmissions. This means, given multiple transmissions by a SN, the adversary must be unable to distinguish, with significant confidence, between transmissions carry real data and transmissions carry fake data. [PERSON] _et al._[34] suggested that transmission \"indistinguishability\" is not enough. They claim that indistinguishability is achieved when adversary monitoring the network over multiple time intervals, in which some intervals contain real event transmissions and others do not, is unable to determine, with significant confidence, which of the intervals contain the real traffic. If intervals are indistinguishable, the individual transmissions within the interval should also be indistinguishable. We should have a mechanism to quantify anonymity while it is used, in the literature, in different ways. However, in our work, anonymity means how to prevent the adversary from knowing the source of the message. In other words, the adversary could know that a particular sensor sent a message at one time, but it should not know that sensor is the source of the message. By delaying the real messages and  
Figure 8: Nodes transmit fake messages according to a probabilistic distribution. When real messages are sent, the system should maintain the required distribution by delaying some fake messages [34,44]. by issuing multiple messages at one interval would mislead the adversary. As an example, for one transmission and one adversary, where the adversary can guess either the message is real or fake without any anonymity measurement taken, it should be 0.5 (either fake or real).