# Intrusion Detection Technology for Wireless Sensor Networks Based on Autoregressive Moving Average

Authors: Ju-zhen Yu
Journal: Advances in Multimedia
 (2022)

---

## Abstract

In wireless sensor networks (WSNs), aiming at the problems that internal attacks such as network congestion and high energy consumption seriously threaten the network security and normal operation, an intrusion detection technology based on traffic prediction is proposed. Firstly, the technology uses the autoregressive moving average model ARMA (autoregressive moving average) to establish the ARMA traffic prediction model for the node and then uses the predicted traffic value to obtain the traffic reception rate range through the node. Finally, the detection effect is achieved by comparing whether the actual service reception rate exceeds the prediction range. The experimental results show that, compared with the single ARMA model, under the same message playback rate, this technology has higher detection rate and lower false alarm rate and reduces the energy consumption of network nodes.


---

## Body

## 1. Introduction

In recent years, wireless sensor networks have developed more and more rapidly and skillfully and have been rapidly developed and widely used in daily life. Wireless sensor network is a research hotspot in the world. It integrates various technologies and has strong discipline. Wireless sensor network consists of microsensors deployed in the monitoring area. A multihop, real-time, and self-organizing network model [1, 2] is formed between nodes to realize real-time monitoring and data perception of the target area, which plays a great role in the information collection of the monitoring environment and monitoring objects.Wireless sensor network is a challenging interdisciplinary field, and it is also recognized as a high-tech industry with broad development prospects at home and abroad. In the future, wireless sensor networks will have a wide and far-reaching impact on human life. Because it usually runs in a harsh environment or enemy camp with fewer personnel, it will have higher requirements for network security in the process of information transmission. In many practical applications of wireless sensor networks, intrusion detection is a common phenomenon in wireless sensor network security. There are some reasons in sensor networks, such as limited node energy, ease of changing network topology, diverse communication media, large number of sensor nodes, and ease of losing utility. In addition, the boundary of network defense may not be clear. These unique characteristics of wireless sensor networks make it more vulnerable to foreign intrusion than other networks, so the research on its security is more urgent and important.Reference [3] proposed intrusion detection technology based on particle filter algorithm. Firstly, LEACH algorithm is used to cluster network nodes, and then particle swarm filter algorithm is used to detect node traffic to find abnormal nodes. However, this method has the problem of large energy consumption of cluster head nodes.Reference [4] proposed an intrusion detection technology based on statistical anomaly. Firstly, the system uses some system features to establish a model for the node in the normal state and judges whether there is intrusion through the deviation degree between the statistical observation value and the model. However, the characteristic parameters and eigenvalues required by the scheme to establish the model will change according to the application scenario, so as to affect the monitoring effect. Reference [5] proposed a Markov based intrusion detection mechanism for wireless sensor networks. Firstly, by using Markov model, a traffic prediction model is established for each node to detect network abnormal traffic. At the same time, an alarm evaluation mechanism is also proposed, which can effectively detect denial of service attacks; however, the detection results will be affected by the setting of parameters in the evaluation mechanism.Reference [6] designed a denial-of-service attack detection scheme TPDD (Traffic Prediction Based Dos Attack Detection) for wireless sensor networks based on ARMA model. Firstly, the ARMA model is used to predict the traffic and the difference between the actual traffic and the predicted traffic exceeds the predetermined threshold to see whether there is an exception and designed an exception detection alarm evaluation mechanism; when the number of alarms exceeds a certain range, it is proved that an attack has occurred. This method also requires manual setting of parameters in the evaluation mechanism, which increases the uncertainty of the system. This paper mainly improves on TPDD.The intrusion detection system based on sinkhole attack proposed in [7] uses the characteristics of sinkhole attack to design a specification based distributed intrusion detection system. The system needs cooperation between nodes to detect, which increases the energy consumption of the network.Reference [8] proposed an intrusion detection technology based on traffic analysis. This method determines whether there is an intrusion in the network by calculating the two traffic characteristics of network traffic reception rate (PRR) and interval time. The scheme also has some human factors in the network parameter setting, which will affect the detection results. Reference [9] designed an anomaly intrusion detection method using several typical traffic prediction models. The system detects whether there is intrusion by the difference between the predicted traffic sequence and the actual traffic sequence of nodes in the network. Due to the lack of a reasonable evaluation mechanism, the detection results of the system may change for other reasons.It can be seen from the above example that the current use of traffic characteristics to design intrusion detection system can achieve certain results for specific applications. However, there are common problems such as excessive energy consumption and large human participation factors, which will increase the uncertainty of detection. This paper improves on the TPDD technology in [10], because in the alarm evaluation mechanism, the setting of the number m of exceptions to evaluate whether there is risk will directly affect the detection results. If M is too large, it will cause omission attack, and if M is too small, it will increase the false alarm rate. Experiments show that the single-step prediction effect of ARMA model on traffic is very good, so the system uses the traffic value predicted by ARMA model to calculate the traffic reception rate range, judges whether there is an attack by comparing whether the actual traffic reception rate range exceeds the range, and uses the traffic reception rate to replace the alarm evaluation mechanism in TPDD, to reduce the influence of human factors. Experiments show that the system has higher detection rate, lower false alarm rate, and less energy consumption than using ARMA model alone.


## 2. Related Works

Wireless sensor network is composed of a group of sensor nodes and gateway nodes. It is generally deployed in bad environment or enemy environment to collect the information of the surrounding environment and transmit it to the gateway node. Sensor nodes are vulnerable to various man-made or natural environments, and information is vulnerable to various external intrusions in the process of transmission. In order to ensure the security of information, intrusion detection is very necessary and important for wireless sensor networks. Due to the self-organization of wireless sensor networks, low battery energy supply, limited bandwidth constraints, the distributed operation mode of wireless media, multihop transmission mode, and the characteristics of mutual independence and cooperation between nodes, wireless sensor networks are vulnerable to various security threats under the open interaction model.On the one hand, because wireless sensor is economical and easy to deploy, wireless sensor networks are often used in various scientific and technical fields, such as collecting information according to human behavior, monitoring physical and environmental phenomena, and monitoring industrial sites.On the other hand, the security of wireless sensor networks is also a very important problem, especially when wireless sensor networks shoulder important tasks. Ensuring network security is extremely important in military applications, because any security gap in the battlefield may lead to serious casualties.Intrusion detection system (IDS) is a solution for wireless sensor networks to deal with a wide range of security attacks. At the same time, it is also used as the second line of defense of wireless sensor networks, but it can only detect intruders and cannot prevent or respond. Once the attack is detected, the intrusion detection system will alert the system controller to act. At present, there are two important intrusion detection system strategies: defense-based strategy and detection-based strategy [11]. The former is called signature-based intrusion detection system, which is usually supplemented by the established signature to detect the behavior of intruders. It can detect the well-known intrusion behavior, but cannot detect the unknown intrusion behavior, and the anomaly-based intrusion detection system can detect the known and unknown abnormal behavior.Security attacks in wireless sensor networks can be divided into active attacks and passive attacks. Passive attack is essentially silent, mainly to extract information from the network. It will not destroy the network structure or network resources. Active attacks are mainly used to mislead, reconcile, and lose data packets. The unique characteristics of wireless sensor networks, such as wireless media, contention-based media access, multihop characteristics, distributed structure, and random deployment, make wireless sensor networks more vulnerable to security attacks.Wireless sensor networks have a five-layer protocol network structure. For the security of different protocol levels, they may face the risk of being invaded by attackers [12]. Therefore, it is impossible for one or several exception checking strategies to meet the characteristics of all levels of security problems at the same time. It cannot be said that a certain inspection strategy must be the best or can achieve the best in all aspects, and there will be defects. Therefore, the starting point of this paper is to find an optimal balance in the intrusion detection scheme.


### 2.1. Traditional Intrusion Detection Architecture

Wireless sensor networks have the disadvantages of narrow bandwidth, low energy, limited computing, and storage capacity, which require the traditional intrusion detection system (IDS) to adapt to the special environment of the new WSN and design the corresponding detection scheme. The traditional intrusion detection schemes [3] are classified into three types.We know that 80% of the energy consumption in wireless sensor networks comes from the consumption of data communication. Therefore, in order to reduce the energy consumption of nodes, early intrusion detection schemes only deployed detection programs in specific and energy sufficient nodes. There is no specific relationship between detection nodes, and different detection programs can also be deployed. The detection result of the detection node is directly transmitted back to the base station. Reference [13] proposed distributed anomaly detection architecture. The detection node broadcasts abnormal information and notifies the base station to deal with it—path based intrusion detection [14].The distributed architecture is simple to deploy and easy to implement. The disadvantage is that there is a lot of redundant information in the network due to the independence and lack of cooperation of each detection node. Moreover, facing the intrusion of the whole network, this method has great limitations.Agent operation needs environment, and its essence is virus mechanism. Intrusion detection analyzes a node.The network and node information of the node are analyzed. Then, the analysis continues immediately after another node and then continues. The agent path is arbitrary or can be specified specifically.For clustered WSN, through the combination and cooperation of local detection and joint detection, several parts of information collection, data processing, and detection result response are completed by multiple agent modules of WSN. The advantages of performing different detection tasks through cluster head nodes are clear structure, detailed division of labor, high security, and ease of expansion. However, no matter whether the node is normal or not, it needs to patrol, which wastes time and energy and requires additional communication cost. Because each node needs to be equipped with monitoring program, detection program, and response program, the energy consumption of ordinary nodes is obviously too large, resulting in the reduction of node life.The intrusion detection scheme is proposed to save the energy consumption of sensor nodes. The idea is to divide wireless sensor networks according to the functional characteristics of sensor nodes. The bottom node simply collects data. The upper nodes usually deploy large energy supply, or even complete energy supply (such as base stations). Therefore, data fusion and intrusion detection tasks are completed by high-level nodes.Hierarchical intrusion detection can not only effectively improve the accuracy, but also effectively reduce the energy cost of ordinary nodes in the network, which makes most of them just complete simple data collection tasks and forward data. At present, the research hotspot of intrusion detection system generally tends to choose this system. However, the scheme also has some defects, such as network delay. Reference [15] proposed a layered intrusion detection scheme. While focusing on solving the problem of energy consumption, it increases the component mechanism and brings burden to the system.In this process, a large amount of data will grow explosively in unit time, which will affect the self-similarity of the network itself. Therefore, the self-similar parameters used to describe the variation characteristics of network traffic can be used to judge whether the network is in a normal and abnormal situation.If an object is self-similar, it is completely or almost like a part of itself. If a curve is self-similar, each part of the curve has a small piece like it. Many things in nature have self-similar properties. For example, a small part of China's coastline is like it, and so on. Self-similarity means that the part of an object may show similarity with the whole in some aspects, such as state, structure, information, function, time, and energy under certain conditions or processes; that is, it has scale invariance: statistically speaking, self-similarity means that the part is like the whole in some way.For network traffic, it shows self-similar characteristics without the natural length of network traffic burst parameters. In each time scale of tens of milliseconds, seconds, minutes, and hours, network traffic burst is composed of some outbreak areas separated by relatively stable subintervals. We can use Hurst index H (0.5 <h < 1) to measure the self-similarity of random processes.Because the wireless sensor network adopts hierarchical network structure, the detection scheme also adopts hierarchical, that is, logical, subnet and backbone network. Logical subnet is that we divide the information collection nodes in sensor networks into several areas—logical subnet. In the logical subnet, we set up a center node (cluster head node) and deploy the corresponding module of center node exception on the cluster head node. All cluster head nodes send data to the master node on the backbone network, and the master node intrusion detection module is set in the master node.At this time, the method of iteratively calculating Hurst value will completely change this dilemma. The specific strategies are as follows:(1)
We can set a time threshold in the master node and center node, such as 10 minutes. The Hurst value calculation can be performed every ten minutes. As a result, the sensor node can set a small storage space.(2)
If the time exceeds ten minutes, the Hurst value is recalculated.In the network traffic anomaly detection scheme proposed in this paper, master node plays the role of controlling the whole situation. For users, in view of its strong programmability and scalability, user-defined detection rules and detection methods can be deployed in real time on the master node according to the actual situation of the network. Master node is the logic control center of the whole detection system.


#### 2.1.1. Combination of Multilayer Detection Mechanism

In the new intrusion detection scheme proposed in this paper, there are detection mechanisms of backbone network and logical subnet from top to bottom. Intrusion detection adopts the idea of layering, which simplifies the intrusion detection process and improves the efficiency.The data collection and processing are separated from the logical control of the network and the intrusion detection of the network, which simplifies the network structure and the program design inside the sensor.


#### 2.1.2. The Detection Mechanism Is Flexible and Comprehensive

Master node is the master node, which is close to the maintenance personnel and in the field of absolute security. It has strong programmability and scalability due to the programmable interface provided to users. It can flexibly realize network supervision and control and flexibly deploy a variety of detection schemes.


#### 2.1.3. Response Strategy

The intrusion detection scheme has active response mechanism and passive response mechanism of intrusion detection.Center node analyzes and compares the network information of each logical subnet and then feeds back to the master node to summarize and analyze the status of each subnet and the global network, to select the optimal detection scheme.


#### 2.1.4. Security Mechanism

Like the traditional network, the transmission of information in WSN is in the form of data flow. After the network is divided into some logical subnets, the sensor nodes in the logical subnets process the data information cooperatively; this reduces the transmission of data in the whole network and reduces the risk of data leakage. Between the cluster head node and the master node, and between the master node and the base station, the data transmission task is carried out through a secure channel encrypted by open flow protocol, and the security of the whole system is improved.


## 2.1. Traditional Intrusion Detection Architecture

Wireless sensor networks have the disadvantages of narrow bandwidth, low energy, limited computing, and storage capacity, which require the traditional intrusion detection system (IDS) to adapt to the special environment of the new WSN and design the corresponding detection scheme. The traditional intrusion detection schemes [3] are classified into three types.We know that 80% of the energy consumption in wireless sensor networks comes from the consumption of data communication. Therefore, in order to reduce the energy consumption of nodes, early intrusion detection schemes only deployed detection programs in specific and energy sufficient nodes. There is no specific relationship between detection nodes, and different detection programs can also be deployed. The detection result of the detection node is directly transmitted back to the base station. Reference [13] proposed distributed anomaly detection architecture. The detection node broadcasts abnormal information and notifies the base station to deal with it—path based intrusion detection [14].The distributed architecture is simple to deploy and easy to implement. The disadvantage is that there is a lot of redundant information in the network due to the independence and lack of cooperation of each detection node. Moreover, facing the intrusion of the whole network, this method has great limitations.Agent operation needs environment, and its essence is virus mechanism. Intrusion detection analyzes a node.The network and node information of the node are analyzed. Then, the analysis continues immediately after another node and then continues. The agent path is arbitrary or can be specified specifically.For clustered WSN, through the combination and cooperation of local detection and joint detection, several parts of information collection, data processing, and detection result response are completed by multiple agent modules of WSN. The advantages of performing different detection tasks through cluster head nodes are clear structure, detailed division of labor, high security, and ease of expansion. However, no matter whether the node is normal or not, it needs to patrol, which wastes time and energy and requires additional communication cost. Because each node needs to be equipped with monitoring program, detection program, and response program, the energy consumption of ordinary nodes is obviously too large, resulting in the reduction of node life.The intrusion detection scheme is proposed to save the energy consumption of sensor nodes. The idea is to divide wireless sensor networks according to the functional characteristics of sensor nodes. The bottom node simply collects data. The upper nodes usually deploy large energy supply, or even complete energy supply (such as base stations). Therefore, data fusion and intrusion detection tasks are completed by high-level nodes.Hierarchical intrusion detection can not only effectively improve the accuracy, but also effectively reduce the energy cost of ordinary nodes in the network, which makes most of them just complete simple data collection tasks and forward data. At present, the research hotspot of intrusion detection system generally tends to choose this system. However, the scheme also has some defects, such as network delay. Reference [15] proposed a layered intrusion detection scheme. While focusing on solving the problem of energy consumption, it increases the component mechanism and brings burden to the system.In this process, a large amount of data will grow explosively in unit time, which will affect the self-similarity of the network itself. Therefore, the self-similar parameters used to describe the variation characteristics of network traffic can be used to judge whether the network is in a normal and abnormal situation.If an object is self-similar, it is completely or almost like a part of itself. If a curve is self-similar, each part of the curve has a small piece like it. Many things in nature have self-similar properties. For example, a small part of China's coastline is like it, and so on. Self-similarity means that the part of an object may show similarity with the whole in some aspects, such as state, structure, information, function, time, and energy under certain conditions or processes; that is, it has scale invariance: statistically speaking, self-similarity means that the part is like the whole in some way.For network traffic, it shows self-similar characteristics without the natural length of network traffic burst parameters. In each time scale of tens of milliseconds, seconds, minutes, and hours, network traffic burst is composed of some outbreak areas separated by relatively stable subintervals. We can use Hurst index H (0.5 <h < 1) to measure the self-similarity of random processes.Because the wireless sensor network adopts hierarchical network structure, the detection scheme also adopts hierarchical, that is, logical, subnet and backbone network. Logical subnet is that we divide the information collection nodes in sensor networks into several areas—logical subnet. In the logical subnet, we set up a center node (cluster head node) and deploy the corresponding module of center node exception on the cluster head node. All cluster head nodes send data to the master node on the backbone network, and the master node intrusion detection module is set in the master node.At this time, the method of iteratively calculating Hurst value will completely change this dilemma. The specific strategies are as follows:(1)
We can set a time threshold in the master node and center node, such as 10 minutes. The Hurst value calculation can be performed every ten minutes. As a result, the sensor node can set a small storage space.(2)
If the time exceeds ten minutes, the Hurst value is recalculated.In the network traffic anomaly detection scheme proposed in this paper, master node plays the role of controlling the whole situation. For users, in view of its strong programmability and scalability, user-defined detection rules and detection methods can be deployed in real time on the master node according to the actual situation of the network. Master node is the logic control center of the whole detection system.


### 2.1.1. Combination of Multilayer Detection Mechanism

In the new intrusion detection scheme proposed in this paper, there are detection mechanisms of backbone network and logical subnet from top to bottom. Intrusion detection adopts the idea of layering, which simplifies the intrusion detection process and improves the efficiency.The data collection and processing are separated from the logical control of the network and the intrusion detection of the network, which simplifies the network structure and the program design inside the sensor.


### 2.1.2. The Detection Mechanism Is Flexible and Comprehensive

Master node is the master node, which is close to the maintenance personnel and in the field of absolute security. It has strong programmability and scalability due to the programmable interface provided to users. It can flexibly realize network supervision and control and flexibly deploy a variety of detection schemes.


### 2.1.3. Response Strategy

The intrusion detection scheme has active response mechanism and passive response mechanism of intrusion detection.Center node analyzes and compares the network information of each logical subnet and then feeds back to the master node to summarize and analyze the status of each subnet and the global network, to select the optimal detection scheme.


### 2.1.4. Security Mechanism

Like the traditional network, the transmission of information in WSN is in the form of data flow. After the network is divided into some logical subnets, the sensor nodes in the logical subnets process the data information cooperatively; this reduces the transmission of data in the whole network and reduces the risk of data leakage. Between the cluster head node and the master node, and between the master node and the base station, the data transmission task is carried out through a secure channel encrypted by open flow protocol, and the security of the whole system is improved.


## 2.1.1. Combination of Multilayer Detection Mechanism

In the new intrusion detection scheme proposed in this paper, there are detection mechanisms of backbone network and logical subnet from top to bottom. Intrusion detection adopts the idea of layering, which simplifies the intrusion detection process and improves the efficiency.The data collection and processing are separated from the logical control of the network and the intrusion detection of the network, which simplifies the network structure and the program design inside the sensor.


## 2.1.2. The Detection Mechanism Is Flexible and Comprehensive

Master node is the master node, which is close to the maintenance personnel and in the field of absolute security. It has strong programmability and scalability due to the programmable interface provided to users. It can flexibly realize network supervision and control and flexibly deploy a variety of detection schemes.


## 2.1.3. Response Strategy

The intrusion detection scheme has active response mechanism and passive response mechanism of intrusion detection.Center node analyzes and compares the network information of each logical subnet and then feeds back to the master node to summarize and analyze the status of each subnet and the global network, to select the optimal detection scheme.


## 2.1.4. Security Mechanism

Like the traditional network, the transmission of information in WSN is in the form of data flow. After the network is divided into some logical subnets, the sensor nodes in the logical subnets process the data information cooperatively; this reduces the transmission of data in the whole network and reduces the risk of data leakage. Between the cluster head node and the master node, and between the master node and the base station, the data transmission task is carried out through a secure channel encrypted by open flow protocol, and the security of the whole system is improved.


## 3. ARMA Model

Because the design of wireless sensor network intrusion detection system is closely related to its application scenario, and the data types to be processed are different for different applications, the establishment of wireless sensor network traffic model for nodes must be related to the application scenario. Reference [16], combined with the intermediate technology based on mobile agent, designed a trusted data acquisition method for wireless sensor networks based on ARMA model. This method shows that ARMA model has high reliability for data acquisition and can reduce the energy consumption of the network. This paper mainly focuses on wireless sensor networks with periodic data acquisition. Moreover, in order to make the network achieve traffic balance, it is assumed that the sensor network has been processed accordingly through the load balancing technology, to prevent network congestion caused by funnel effect.Because the energy, storage capacity, and processing capacity of wireless sensor network nodes are very limited, this paper selects the simple ARMA (2P, 2p-1) model to analyze and predict the traffic. Because the order of P is too large, it will increase the amount of calculation, so we use ARMA (2, 1) model.The system needs to use the stabilized data sequence to establish the ARMA model.Assuming that the size of the sliding time window isn, the data stream sequence collected by the node is X0,X1,…,Xn. This sequence is periodic, but it is not a required stationary sequence, so it needs to be logarithmically processed to obtain a stationary sequence. The processed sequence is X0′,X1′,…,Xn′. The ARMA model is established by using this stationary sequence and the N+1 flow value is predicted by the model.After the stationary sequence is obtained, the ARMA model is established:(1)αAXi=βAai,where A is the backward shift operator and ai is white noise. It is an independent and identically distributed Gaussian random variable with zero mean and the variance is δa2.(2)αA=1−α1A−α2A2,βA=1−β1A−β2A2.In this paper, the least square estimation method is used to solveα1, α2, β1, β2 which reduces the amount of calculation of nodes. Judge the stability of time series by estimating parameters. The stability conditions are as follows:(3)α2+α1<1,α2−α1<1,−1<α1<1,−1<α2<1.If the above conditions are met, it means that this series is a stationary series, so the ARMA fitting model is obtained as follows:(4)Xt=α1X1+α2X2+At−β1A1.Then the inverse function method is used for one-step prediction. The inverse function of ARMA is recorded as I1, I2... Ij:(5)I1=α1−β1,I2=α2−I1β1,I3=Ijβ1.Then the one-step prediction model is(6)Xt1=∑j=0mIjXj.where m is the M observations before Xt, which can be taken according to the requirements of budget accuracy.


## 4. Estimation of Flow Acceptance Rate Range

For wireless sensor networks that transmit data periodically, generally when there is no attack or affected by other factors, including software and hardware damage, and natural disasters, it should regularly transmit information between nodes at a certain rate. Therefore, the flow of each node will not fluctuate greatly and should be kept within a certain range.For this reason, this paper uses the PRR of the node as the basis for whether an attack occurs. When an attack occurs, the PRR of the node will exceed the range we predict. On the contrary, it will not be exceeded.The binomial distribution of the number of transmission failures K in a time interval is given below:(7)pK=k=nkpk1−pnk,where nk=n!/k!n−k! is the binomial coefficient, K is the number of transmission failures, n is the total number of transmissions within the specified time interval, and P is the probability of one transmission failure.Assuming that the information transmission in the network is a regular and stable transmission, the samples of the previously predicted traffic are used to extract the predicted sample values N1, N2... Nm according to each small period TW in a period windowT, where m is equal to T/Tw. Thus, the average value and standard deviation of the accepted package can be calculated as(8)N=1m∑i=1mNi,SN=1m−1∑i=1mN−Ni2,where Ni, I = 1, 2, ..., M is the sample value.Then the range of reception rate over a period can be calculated. Because the confidence levels of 3 S and 6 S are 99.87% and 100%, respectively, the PRR calculated here for the interval of 3 S and 6 S is(9)PRR=NTw.According to the range of the acceptance rate of the calculated traffic, we can judge whether there is an attack. When the subsequent traffic acceptance rate exceeds the range, it indicates that there is an internal attack in the network. In the centralized detection system, the detection effect is often poor because of “single point failure.” In this paper, the system does not process the detection data through the base station, but the nodes complete the detection alone, which improves the robustness of the system.


## 5. Simulation Experiment

OMNeT simulation software is used to simulate this experiment, because it has good system compatibility and can be compiled withC++ under windows and various UNIX operating systems. The simulation of wireless sensor network can achieve good results. The experimental simulation is divided into two parts. Firstly, it verifies whether the ARMA model can accurately predict the traffic in one step. Secondly, when the nodes are subjected to internal attacks of different intensities, the detection accuracy and false alarm rate of the system and the ARMA model alone are compared. At the same time, the average energy cost of the system nodes is simulated.In this experiment, the data flow is sampled once per second within 250 s from any time, and then the flow is predicted by the model.The experiment mainly analyzes the detection accuracy, false alarm rate, and average energy cost of the intrusion detection system to judge the feasibility of the system.Detection accuracy refers to the ratio of malicious messages detected by the system to all messages and the ratio of nonmalicious messages detected by the system to the number of all detected messages.False alarm rate specifically refers to the ratio of the number of malicious messages as normal messages to all messages and the ratio of the number of normal messages as malicious messages to all messages.At the same time, in order to detect the average energy cost of network nodes, this paper carries out simulation experiments under the three conditions of attack with detection, no attack without detection, and attack without detection and compares the average energy cost of nodes under the three conditions.A good intrusion detection system for wireless sensor networks must have high detection accuracy, low false alarm rate, and low energy cost as shown in Table1. The following is the setting of some simulation parameters of this experiment:Experimental area: 50 m × 50 m, 200 m × 200 m.A base station.Number of nodes: 100.Node uniform network deployment.Message sending rate: packet/1.5 s or packet/15 s.Package size: 10 ∼ 100 b.Transmission rate: 100 kbps, 250 kbps.The packet loss rates of attacks: 30%, 50%, and 100%, respectively.Table 1
Detection accuracy.
0.10.20.30.40.50.6Ours0.520.710.750.810.870.97ARMA0.480.620.680.740.790.87PRR0.390.490.590.660.740.78Figure1 shows the comparison of detection accuracy between the intrusion detection system designed in this paper and using ARMA model alone and PRR alone. The abscissa is the message replay rate and the ordinate is the detection rate. It can be seen from the figure that the detection rate of the three schemes is closely related to the message replay rate. When the replay rate is lower than 10%, only the detection rate of this scheme exceeds 50%, this is because the other two schemes may ignore some messages because the artificially set threshold is not accurate enough. However, when the playback rate reaches 40%, the detection rates of the three schemes are close to 100%, so when the attack is obvious, the three schemes can be used to detect denial of service attacks and can achieve good results, as shown in Table 2. However, when the attack is not obvious, this scheme has better detection accuracy.Figure 1
etection accuracy.Table 2
False alarm rates.
0.10.20.30.40.50.6Ours0.180.150.110.080.050.02ARMA0.250.220.180.140.110.07PRR0.390.320.290.260.240.18Figure2 shows the false alarm rate of the above three schemes. The abscissa is the message replay rate and the ordinate is the false alarm rate. It can be seen from the figure that, with the increase of the replay rate, the false alarm rate of the three schemes is maintained at a very low level, because the packet loss caused by channel error objectively reduces the false alarm rate of replay message attack, as shown in Table 3.Figure 2
False alarm rates.Table 3
Energy consumption.
0.10.20.30.40.50.6Ours0.520.710.750.810.870.97ARMA0.480.620.680.740.790.87PRR0.390.490.590.660.740.78Figure3 shows the energy consumption of the above three schemes. The abscissa is the message replay rate and the ordinate is the energy consumption. As can be seen from the figure, with the increase of playback rate, the energy consumption of the three schemes is increasing. Compared with the other two models, our energy consumption is significantly lower than the latter.Figure 3
Energy consumption.


## 6. Conclusions

The experimental results show that the one-step prediction of periodic wireless sensor network traffic using ARMA model can achieve good results. For detecting internal attacks, compared with using ARMA model alone, this scheme reduces the impact of human factors on detection, has higher detection rate and lower false alarm rate, reduces the average energy consumption of network nodes to a certain extent, and prolongs the network life cycle. However, for aperiodic networks, the system still has some defects and cannot achieve good results. In the later stage, while continuously optimizing the system, we further study the intrusion detection technology of aperiodic sensor network system.



---

*Source: 2155748-2022-04-01.xml*