# Source Anonymity against Global Adversary in WSNs Using Dummy Packet Injections: A Survey
## 5 Global Adversary Models
In _SECLOUD_, the adversary capabilities are a combination of different adversary models presented in [59; 39; 58]. In this model, the attacker knows the network topology and retains the measurements of the entire network traffic including _Rate Monitoring_ and _Time Correlation_. In addition, the attacker has the ability to visualize the network traffic and regulate the network links density. However, the adversary is passive and cannot compromise network nodes. The attacker has its own network that consists of several malicious nodes. These nodes collaborate together using a different frequency band to transmit the collected data to a centralized malicious entity [53]. The _CSPSLP_ adversary model deploys its monitoring devices in the targeted areas within the network. The adversary collects information from multiple areas, but not from the entire network. These areas are called the observation points, and their location is adjustable to be as close as possible to the real asset. This model has three different characteristics: passive, well-equipped, and informed. Passive means that the adversary does not modify the network transmissions; it only observes transmissions among nodes. Well-equipped means that each attacking device can measure the angle of arrival and strength of the signal to determine the source location. However, the adversary is unable to spot the receiving nodes because all nodes within the range of the transmitting node will receive the signal. Lastly, the adversary is informed; it knows the sink location and is able to monitor the sink node traffic as well [49]. _DWUS_ assumes that the adversary is passive and has unlimited resources. Further, the adversary can distribute attackers throughout the network to sense all transmitted packets [50]. In the _GAFG_ technique, the adversary is aware of the sink location and network topology. The adversary is passive and can detect the time and location of all transmissions. Moreover, it has the ability to perform sophisticated statistical methods for detection. However, the adversary cannot break the encryption of packets [51]. The adversary model in _SoSi_[52] is considered to be fast and effective. It has two possibilities: First, the adversary uses a large number of devices to monitor the entire network. Second, the adversary can deploy a smaller number of devices that have more capabilities and resources. However, [PERSON], [PERSON] et al. [52] argued that the second option is impractical because of the high cost. They also assume that the adversary can sense the actual asset instead of overhearing the traffic among authorized nodes. In this technique, the adversary uses _GPS_ or one of the localization techniques to determine roughly the occurrence area of the real event. The _PA-SLP_ adversary model is assumed to be both external and internal. Moreover, it can perform active and passive attacks. The adversary has the ability to eavesdrop on the entire network. In addition, it can apply _Time Correlation_ and _Size/Structure Correlation_ attacks. The adversary might capture intermediate nodes and disclose the secret keys. Exposed keys are utilized to pollute the traffic by inserting new packets into the network or altering the existing packets [30]. The _UHT_ technique follows the external, global, and passive adversary model. However, _UHT_ has further assumptions. In cases where the adversary knows the location of the sink, it will snoop on all communications within the network. The adversary can attack communications among intermediate nodes in a parallel manner. After collecting data, the adversary checks the content of packets to gain information about the source _ID_. However, in a situation where packets are well-encrypted, there are two possibilities: First, if packets remain the same without re-encryption when they are forwarded, the adversary can trace them back to the origin.