# Network Security Situational Awareness Based on Genetic Algorithm in Wireless Sensor Networks

Authors: Jinna Zhang
Journal: Journal of Sensors
 (2022)

---

## Abstract

How to design an effective and secure user authentication scheme suitable for complex wireless sensor network (WSN) environments has very important research significance. Based on the genetic algorithm theory, the paper constructs the security situational awareness model of wireless sensor network, and studies the WSN user security authentication scheme. The model uses the genetic algorithm extraction technology combined with the hash function to generate the biometric key, which solves the data accuracy problem of network security situational awareness: the user’s biometric key is obtained through the fuzzy extraction technology; the resistance of the node is to be attacked, but it is powerless when most of the nodes are broken, and it limits the scalability of the network. During the simulation process, the authentication of the identity of the cluster head by the base station is added in the topology establishment stage, and a one-way hash function and a shared key are added to the key management, so that the encryption key and the authentication key change periodically and dynamically, so that enhanced network communication security. The analysis results show that the protocol is feasible. The algorithm proposed in this paper reduces about 70% of the features in the original feature set, the classification detection rate is increased from 95.7212% to 97.7379%, and the false alarm rate is reduced from 7.9427% to 3.1072%, effectively improving the balance between safety and design cost.


---

## Body

## 1. Introduction

A wireless sensor network, as the sensing terminal of the Internet of Things, is mainly used to collect the monitored data in a specific area and transmit it to users in real time [1]. However, in practical applications, because WSN nodes have limited resources and work in wireless channels, users face many security threats such as being tracked, intercepted, and forged when accessing the network to obtain data [2]. At present, although the WSN security authentication mechanism can effectively ensure the safe transmission of monitoring data and deny malicious access by illegal users, however, due to the increasingly complex application environment of WSN and the diversification of attack methods in the network [3–5], some existing WSN security authentication schemes cannot be implemented [6] and meet the security guarantees required for data transmission in the network. Therefore, how to design an effective and secure user authentication scheme suitable for complex WSN environments has very important research significance for data privacy protection in WSN [7].Because wireless sensor networks are generally deployed in harsh environments, unmanned areas or enemy positions [8], and the inherent vulnerability of wireless sensor networks, network security has attracted great attention [9–11], which has also given theoretical researchers and engineering technicians a lot of attention. A large number of challenging research topics are presented [12]. In the case of very limited computing speed, power supply energy, communication capability, and storage space of sensor nodes, traditional security systems are not suitable for use in wireless sensor networks [13]. The research results of the wireless sensor network security communication protocol have only appeared in recent years, and the security scheme is still in the theoretical research stage, which is far from practical application and the formation of generally accepted standards [14].Based on genetic algorithm technology, this paper proposes a two-factor user authentication scheme suitable for WSN. Firstly, the user password and user characteristic information are hashed as the password authentication factor; secondly, the blockchain which is not easy to tamper with and has distributed storage function is used to store the user’s personal information in the registration stage and assist in completing the subsequent key negotiation process; finally, the heuristic is adopted. The main content of this paper is related to several key technologies in the security mechanism of wireless sensor networks: how to consider appropriate data encryption technology, key management technology, and intrusion detection technology in resource-constrained WSNs, and through a WSN-based technology, the design and implementation of the wireless community health monitoring project apply the above-mentioned WSN security technology to the actual project, making the system more secure, practical, and reliable. Performance analysis shows that while ensuring consistent data transmission and good confidentiality in the network, the scheme also enables users to perform identity authentication without a smart card when logging in to any client across domains due to actual needs.


## 2. Related Work

In addition to a large number of military applications, WSNs have been widely used in civil fields, such as environmental and ecological monitoring, health monitoring, modern precision agriculture, home automation, and intelligent traffic control [15]. As a new information acquisition and processing technology, WSNs have become an attractive high-tech field in recent years due to their low cost, low power consumption, small size, fast deployment, and strong invulnerability [16].Traditional information security technology adopts strict access control mechanism and data encryption strategy, but with the increasing maturity of attack technology and the complexity and variety of attack tools and methods, these passive security technologies can no longer meet the requirements of network services that are highly sensitive to security [17]. A location-based key predistribution model is proposed by Liu et al. [18], which introduces node location information, which can greatly reduce the amount of computation and storage space requirements when nodes establish shared keys. The forward secrecy and backward secrecy of the key are realized by Shakya et al. [19]; the key management based on the configuration theory fully improves the connectivity of the network, the practicability of storage, and the ability to resist node capture. By monitoring the status of the system, usage, and network status, Pal et al. [20] found that it can detect the intrusion of external intruders using system loopholes and the behavior of internal users using loopholes to perform unauthorized operations. It is proposed that the WSN security system mainly includes four parts: encryption algorithm and cryptanalysis, key management and access control, authentication and security protocol, and secure data fusion and security positioning.With the increase of network penetration rate and the increase of data transmission, the massive data transmitted in the network system brings more and more pressure to the detection system. Alqahtani et al. [21] thought it has become a top priority to improve the intrusion detection system, such as low detection speed, heavy load, and too late to deal with the massive data in the network. The recently proposed intrusion-tolerant routing protocol INSENS114J is a brand-new solution for WSN’s secure routing, which allows malicious nodes to threaten its surrounding nodes. Using feature selection is an effective way to deal with this problem. In the process of feature selection, the number of features is a key indicator [22]. There is no linear relationship between features and classifier performance. When the number of features exceeds a certain limit, it will lead to poor classifier performance [23].


## 3. Construction of Network Security Situation Awareness Model Based on Genetic Algorithm in Wireless Sensor Network

### 3.1. Wireless Sensor Network Hierarchy

Wireless sensor network nodes use sensors of various natures to cooperatively monitor physical or environmental conditions at different locations, and each node forwards data to neighboring nodes while sensing data, so that the data sensed by each node can be centrally transmitted to multiple hops. The base stationvx,t (see the multihop data transmission path between each node et,m) is then transmitted to the user by the base station through the computer network ex,m or satellite.The cluster head and member nodes have loose time synchronization, so time-sharing authentication can be used. That is, every time period, the transmitted sensing data is authenticated, and if the authentication result indicates that the data is reliable, then all the sensing data transmitted within the time period are considered to be reliable. Among the many nodes deployed in the monitoring areac1−x, there is one or several special gateway nodes, which are called base stations or sink nodes.
(1)vkex,t=ekex,m,eket,m,ekem,∑cn−1k−11−x−tk−1=1,∑cn−1k−11−xk−2=1−x.Perceptual dataax,t is usually relatively large, so the message authentication code micm attached to the perceptual data usually brings a lot of energy consumption emt,m. If a member node needs to attach the sensing data every time it transmits the sensing data, the energy ipm of the member node cannot meet the general application requirements at all.
(2)akex,t−bx,t=ekex,mmicm−emket,m,akex,t∪bx,t⊗ipekex,m−ipm⊕am−bkem.Since the amount ofpx is large and sent periodically, generating its MAC (Media Access Control) is time-consuming and expensive, which has no practical significance for wireless sensor networks. An enhanced authentication scheme is employed here. Since all nodes in the same cluster share the same cluster key py−x, even if the erroneous behavior of a node in the cluster is detected, the member nodes that are compromised by fx cannot be identified. Therefore, using a shared key instead of a cluster key can help identify compromised nodes. As the security value of the system decreases and the tendency fy−x of detection nodes to be unprotected increases, the possibility of node selection attacks increases.
(3)pdxdyx∗pdxdyy∈pΔy−x∗pΔy+x,Δfx≠Δfy,Δfx−Δfy≠Δfy−x.1−px,y generates random keys to generate a session key chain of length k−1 before sending the perception data pk+x. When x sends k, a key is selected from the keychain as k’s authentication key. After tm is sent, the next key in the key chain is selected as the authentication key for the next perception data. When the last key K, in the key chain is used, a new key chain will be regenerated.
(4)1−pdxdyx,yk−1⊆py−kk−xpx−kk+x,RDakex,t,bx,t=x,t⊗htkex−t⊕tkem.For the cluster head, once it receives the key in the key chain, the encrypted first authentication key can be used to verify thex-th sensing data with the authentication key. If the authentication key is trusted, then trust k. The control message is usually sent from the base station or the cluster head to the member nodes, and the amount of data is not large. The message authentication code method can be used to ensure the integrity of the message and the reliability of the sending source. At the same time, the transmission timestamp can ensure the freshness of the message. The characteristics of nonparametric regression include that the nonparametric regression method has nothing to do with the parameters of the overall distribution, the sampling of samples to estimate the population does not depend on the distribution form of the population to which the sample belongs, and the nonparametric regression method does not depend on the parametric regression method.The experimental input data in Figure1 are converted according to the required data format, and the intrusion detection performance is evaluated for the original feature set, the selected feature subset, and the feature subset selected by the method proposed in this chapter. The three evaluation indicators of detection time, detection rate, and false alarm rate are used to evaluate the performance: under the same number of iterations, the detection rate of this algorithm is obviously higher than that of the traditional genetic algorithm (GA) method. Compared with the traditional genetic algorithm, this algorithm has fewer subsets in the feature selection subset reduction.Figure 1
Wireless sensor network level performance evaluation.


### 3.2. Logic Analysis of Genetic Algorithm

The processing capabilityvi, communication capability vj and storage capability vx,y of the genetic algorithm logic layer vs,t can be much stronger than other ordinary sensor nodes. It is responsible for collecting the data of each sensor node and connecting to the external network (for example, through the Internet or satellite) to realize both WSNs and external networks. This command sending method is called “top-down” user monitoring command propagation hkey and execution process tkkey.
(5)Di,j−Ei,j⊆vi,vj,vx,yi,vx,yi−1,hkeytkkeytkey⟶key−tkeyt−keym−keyn.In the control message authentication process, the multinode joint confirmation method is used to ensure the security of the control message. Instead of simply relying on the authentication result of one node, it comprehensively judges the authentication results oftnx,sx nodes (where t represents the number of joint authentication nodes). Only when tmx,mx′ nodes agree that a control message is unreliable, the node discards the control message. Therefore, the appropriate t value should be selected in the specific application process.
(6)1−mnx−ny−1x,pxkk−1−1−pk−1xy−kk−x=k,tmx,mx′>tmx,mx′>tnx,sx′>x′.The value oftx is generally determined during the network initialization phase. The t nodes that are in contact with each other authenticate the received control messages, respectively, send the authentication results to each other in time, and determine whether to discard the control messages according to the result of the joint authentication twait. Also, in order to prevent individual compromised nodes from damaging the network, joint authentication is also recommended to ensure the reliability Ainner of control messages.
(7)tx1−tx=2twait−ton−Nx∗tnxtx,Ai,j=maxAinnerBinnertkey,minkeyi−keyj.Since the monitoring alarm message may be forged by the compromised node, it is unreliable to judge a cluster head as an attacker only based on the monitoring alarm message of a monitoring node. Therefore, when at leastX monitoring nodes have monitored the abnormal behavior of the same cluster head, the monitoring alarm message is credible. In addition, since the sensor nodes are relatively fixed after the arrangement, the removal information should be limited to this cluster. Once the abnormal cluster head is removed from the cluster by the monitoring node, it cannot communicate with other sensor nodes. The removal process of an abnormal cluster head is described in Table 1.Table 1
Description of genetic algorithm.
Genetic algorithm codesDescription words#include <ctime>The cluster head is responsible#include <eigen/dense>In the clustertkeyUsing namespace eigen;Since the monitoringkeyiMatrix<double, iters, p_num> f_test;Binner be forgedMatrix<double, iters, p_num> pos_mat;Monitoring all member nodesStatic std::uniform_real_distribution<double>;A monitoring nodeAinnerFor (int i =0; i < p_num; ++i)Judge a cluster headΔfyFor (int step =1; step < iters; ++step)It is unreliable tovi,vjPos.push_back(distribution1(rng));Monitoring alarm message oftmx,mx′Spd.push_back(distribution2(rng));Alarm messagetwaitF_test(0, i) = temp;By the compromised nodePos_mat(0, i) = pos[i];Based on theΔfy−xP_best.push_back(pos[i]);As an attackerNx∗tnxIn the cluster routing protocol, the cluster head and member nodes have different roles. Therefore, this scheme adopts two different monitoring methods for cluster heads and member nodes, respectively. In the proposed energy-saving intrusion detection scheme, several member nodes cooperate to monitor a cluster head, and the cluster head is responsible for monitoring all member nodes in the cluster. As the network scale increases, the increased energy consumption of the cluster head will show a downward trend. When the network is attacked, the energy consumption of message authentication will increase compared with that under safe conditions, but it is worthwhile to resist the attack of some malicious nodes, inject illegal data, and even destroy the entire network.


### 3.3. Node Distribution of Wireless Sensor Networks

In a clustered wireless sensor network, all keys are generally protected by a master key. However, in the sensor network model of the plane structure, since there is no central management node, the network is formed by the self-organizing collaborative algorithm, and the networking algorithm is more complicated. In this scheme, it is very important to determine the appropriate threshold value to realize the security of the network. This paper uses the relationship between the node failure probability and the number of nodes and the threshold value to determine the threshold value. Once it becomes a representative node, it will immediately send a broadcast message to inform its relevant neighbor nodes. According to the theory of radio wave propagation, the effective range of broadcast information representing a node is a circular area with itself as the center. Therefore, the transmit power of the representative node can be adjusted so that its related neighbors can receive the broadcast message.The data in Figure2 still uses the representative corrected dataset as the experimental dataset. In the experiment, the dataset is divided into two categories: normal and attack; that is, all different attack behaviors are marked as attack. 60 records were randomly selected for feature selection, and 120 records were randomly selected for the evaluation of intrusion detection performance of feature subsets, 50% of which were used as the training set for classification and the remaining 50% were used as the test set.Figure 2
Wireless sensor network node data test.The code running in each sensor node occupies 16874 bytes of ROM (Read Only Memory) after compilation (the ROM of the Mica2 node is 128 k bytes in total), and it occupies 2795 bytes of RAM (Random Access Memory) (the RAM of the Mica2 node is 4 k bytes in total). In addition to the code, the node only needs to store 3 keys, which is quite affordable for sensor nodes. It can be seen that the detection rate matrix is an important index to evaluate the cluster head intrusion detection system. It can be seen from the formula that the detection rate matrix is also an important parameter that directly affects the prior probability, thus indirectly affecting the posterior probability. This experiment examines the influence of the detection rate on the posterior probability by selecting different detection rate matrices.


### 3.4. Network Security Module Coupling

System behavior can include system information such as network security module utilization, file verification, as well as behavior data such as the time and times of normal user slamming, and the number of operation failures.The process of sample learning is relatively slow. The learning process is to change the connection weights between neurons in order to store the information about the intrusion behavior in the neural network. In order to describe normal behavior patterns, anomaly detection methods usually need to analyze and organize a large number of system event records. In the early stage of system design, we use key preset processing for each node in the WS network; that is, each node shares a master key and uses a symmetric cryptosystem for data encryption and decryption. In this way, the expansion of the system is more convenient, such as adding a new node, as long as the node is preinstalled with the master key.In order to better reflect the performance of the network, this paper also designs the network model in Figure3 for comparison. In the simulation process, the network simulation is carried out according to several performance indicators such as the failure probability p of the node, the threshold value, the successful transmission rate of the network, and the error correction rate. It can be seen that with the increase of the threshold value and the probability of node failure, the transmission rate of the network is continuously reduced, because with the increase of the threshold value, the council nodes in the domain need more nodes to restore key nodes, to ensure the effective transmission of the network.Figure 3
Network security module architecture.In the case where the number of nodes in the domain in Figure4 is 80, with the increase of the failure probability of the node and the constant change of the threshold in the domain, the comparison of the error correction rates between networks with different threshold values and the correction with the parallel structure are obtained. Compared with the error rate, it can be seen from the comparison that with the increase of the threshold value, the error correction ability of the network is getting lower and lower. From the perspective of security and the comparison with the parallel structure, it can be seen from the figure that the network error correction rates of (3, 6) and (4, 6) are optimal. In the absence of network attacks, the Low-Power Adaptive Clustering Hierarchy Protocol (LEACH) routing algorithm has the highest efficiency and the longest network life cycle because it does not need to implement any security mechanism.Figure 4
Distribution of coupling thresholds of network security modules.Although the proposed security mechanism is not significantly better than the “LEACH+IPD” case without being attacked, the proposed intrusion protection and detection scheme can significantly extend the network life cycle after being attacked and alleviate the network thrashing caused by an attack.


### 3.5. Analysis of Situational Awareness Factors

The data source of the network-based situational awareness detection system is the data packets transmitted in the network, and the goal is to protect the operation of the network. It is built on the basis of line interception and captures data packets in the network for analysis. It is composed of a security control center and multiple intrusion detection engines. The detection engine is mainly responsible for collecting data, analyzing data, and reporting events. The security control center is responsible for issuing policies, accepting time, recording and analyzing logs, and maintaining feature information databases. Such systems are typically deployed on the subnet where important servers are located and monitor connections in that subnet. It mainly lists the storage overhead of original sensing data nodes and other shared data nodes, including the storage space of sensing data, keys, and vector values. Although neural networks have been used in the field of intrusion detection, before using neural networks for intrusion recognition, a large number of intrusion samples should be used for recognition training, so the system has the ability to effectively classify intrusion behaviors, so as to correctly identify intrusions activity. The provisioning mechanism has roughly equivalent storage overhead.In the fault-tolerant simulation, we analyze the network performance of Figure5 from two aspects, the successful data transmission rate, and the error correction rate. The successful data transmission rate refers to the probability that data is successfully transmitted from the sending node to the receiving node. The error correction rate refers to the probability that data is transmitted from other paths to the receiving node when one path is blocked. In both aspects, we study the performance of the network based on the failure probability of nodes. We further measure the communication overhead required by the implementation of each round of data safe storage during the operation of this scheme. It can be known the size of the communication volume during the operation of the whole scheme, and it can be seen that the communication volume of this mechanism is not large in the stages of data sharing, integrity detection and data recovery. The data survival rate is improved, and each node undertakes the sending task in the data recovery phase, so the energy consumption of a single node is also reduced. Compared with the proposed scheme, since it adopts a signature-based dynamic integrity protection mechanism, its communication overhead is relatively large, which is not suitable for the actual operating environment.Figure 5
Situational awareness network performance.


## 3.1. Wireless Sensor Network Hierarchy

Wireless sensor network nodes use sensors of various natures to cooperatively monitor physical or environmental conditions at different locations, and each node forwards data to neighboring nodes while sensing data, so that the data sensed by each node can be centrally transmitted to multiple hops. The base stationvx,t (see the multihop data transmission path between each node et,m) is then transmitted to the user by the base station through the computer network ex,m or satellite.The cluster head and member nodes have loose time synchronization, so time-sharing authentication can be used. That is, every time period, the transmitted sensing data is authenticated, and if the authentication result indicates that the data is reliable, then all the sensing data transmitted within the time period are considered to be reliable. Among the many nodes deployed in the monitoring areac1−x, there is one or several special gateway nodes, which are called base stations or sink nodes.
(1)vkex,t=ekex,m,eket,m,ekem,∑cn−1k−11−x−tk−1=1,∑cn−1k−11−xk−2=1−x.Perceptual dataax,t is usually relatively large, so the message authentication code micm attached to the perceptual data usually brings a lot of energy consumption emt,m. If a member node needs to attach the sensing data every time it transmits the sensing data, the energy ipm of the member node cannot meet the general application requirements at all.
(2)akex,t−bx,t=ekex,mmicm−emket,m,akex,t∪bx,t⊗ipekex,m−ipm⊕am−bkem.Since the amount ofpx is large and sent periodically, generating its MAC (Media Access Control) is time-consuming and expensive, which has no practical significance for wireless sensor networks. An enhanced authentication scheme is employed here. Since all nodes in the same cluster share the same cluster key py−x, even if the erroneous behavior of a node in the cluster is detected, the member nodes that are compromised by fx cannot be identified. Therefore, using a shared key instead of a cluster key can help identify compromised nodes. As the security value of the system decreases and the tendency fy−x of detection nodes to be unprotected increases, the possibility of node selection attacks increases.
(3)pdxdyx∗pdxdyy∈pΔy−x∗pΔy+x,Δfx≠Δfy,Δfx−Δfy≠Δfy−x.1−px,y generates random keys to generate a session key chain of length k−1 before sending the perception data pk+x. When x sends k, a key is selected from the keychain as k’s authentication key. After tm is sent, the next key in the key chain is selected as the authentication key for the next perception data. When the last key K, in the key chain is used, a new key chain will be regenerated.
(4)1−pdxdyx,yk−1⊆py−kk−xpx−kk+x,RDakex,t,bx,t=x,t⊗htkex−t⊕tkem.For the cluster head, once it receives the key in the key chain, the encrypted first authentication key can be used to verify thex-th sensing data with the authentication key. If the authentication key is trusted, then trust k. The control message is usually sent from the base station or the cluster head to the member nodes, and the amount of data is not large. The message authentication code method can be used to ensure the integrity of the message and the reliability of the sending source. At the same time, the transmission timestamp can ensure the freshness of the message. The characteristics of nonparametric regression include that the nonparametric regression method has nothing to do with the parameters of the overall distribution, the sampling of samples to estimate the population does not depend on the distribution form of the population to which the sample belongs, and the nonparametric regression method does not depend on the parametric regression method.The experimental input data in Figure1 are converted according to the required data format, and the intrusion detection performance is evaluated for the original feature set, the selected feature subset, and the feature subset selected by the method proposed in this chapter. The three evaluation indicators of detection time, detection rate, and false alarm rate are used to evaluate the performance: under the same number of iterations, the detection rate of this algorithm is obviously higher than that of the traditional genetic algorithm (GA) method. Compared with the traditional genetic algorithm, this algorithm has fewer subsets in the feature selection subset reduction.Figure 1
Wireless sensor network level performance evaluation.


## 3.2. Logic Analysis of Genetic Algorithm

The processing capabilityvi, communication capability vj and storage capability vx,y of the genetic algorithm logic layer vs,t can be much stronger than other ordinary sensor nodes. It is responsible for collecting the data of each sensor node and connecting to the external network (for example, through the Internet or satellite) to realize both WSNs and external networks. This command sending method is called “top-down” user monitoring command propagation hkey and execution process tkkey.
(5)Di,j−Ei,j⊆vi,vj,vx,yi,vx,yi−1,hkeytkkeytkey⟶key−tkeyt−keym−keyn.In the control message authentication process, the multinode joint confirmation method is used to ensure the security of the control message. Instead of simply relying on the authentication result of one node, it comprehensively judges the authentication results oftnx,sx nodes (where t represents the number of joint authentication nodes). Only when tmx,mx′ nodes agree that a control message is unreliable, the node discards the control message. Therefore, the appropriate t value should be selected in the specific application process.
(6)1−mnx−ny−1x,pxkk−1−1−pk−1xy−kk−x=k,tmx,mx′>tmx,mx′>tnx,sx′>x′.The value oftx is generally determined during the network initialization phase. The t nodes that are in contact with each other authenticate the received control messages, respectively, send the authentication results to each other in time, and determine whether to discard the control messages according to the result of the joint authentication twait. Also, in order to prevent individual compromised nodes from damaging the network, joint authentication is also recommended to ensure the reliability Ainner of control messages.
(7)tx1−tx=2twait−ton−Nx∗tnxtx,Ai,j=maxAinnerBinnertkey,minkeyi−keyj.Since the monitoring alarm message may be forged by the compromised node, it is unreliable to judge a cluster head as an attacker only based on the monitoring alarm message of a monitoring node. Therefore, when at leastX monitoring nodes have monitored the abnormal behavior of the same cluster head, the monitoring alarm message is credible. In addition, since the sensor nodes are relatively fixed after the arrangement, the removal information should be limited to this cluster. Once the abnormal cluster head is removed from the cluster by the monitoring node, it cannot communicate with other sensor nodes. The removal process of an abnormal cluster head is described in Table 1.Table 1
Description of genetic algorithm.
Genetic algorithm codesDescription words#include <ctime>The cluster head is responsible#include <eigen/dense>In the clustertkeyUsing namespace eigen;Since the monitoringkeyiMatrix<double, iters, p_num> f_test;Binner be forgedMatrix<double, iters, p_num> pos_mat;Monitoring all member nodesStatic std::uniform_real_distribution<double>;A monitoring nodeAinnerFor (int i =0; i < p_num; ++i)Judge a cluster headΔfyFor (int step =1; step < iters; ++step)It is unreliable tovi,vjPos.push_back(distribution1(rng));Monitoring alarm message oftmx,mx′Spd.push_back(distribution2(rng));Alarm messagetwaitF_test(0, i) = temp;By the compromised nodePos_mat(0, i) = pos[i];Based on theΔfy−xP_best.push_back(pos[i]);As an attackerNx∗tnxIn the cluster routing protocol, the cluster head and member nodes have different roles. Therefore, this scheme adopts two different monitoring methods for cluster heads and member nodes, respectively. In the proposed energy-saving intrusion detection scheme, several member nodes cooperate to monitor a cluster head, and the cluster head is responsible for monitoring all member nodes in the cluster. As the network scale increases, the increased energy consumption of the cluster head will show a downward trend. When the network is attacked, the energy consumption of message authentication will increase compared with that under safe conditions, but it is worthwhile to resist the attack of some malicious nodes, inject illegal data, and even destroy the entire network.


## 3.3. Node Distribution of Wireless Sensor Networks

In a clustered wireless sensor network, all keys are generally protected by a master key. However, in the sensor network model of the plane structure, since there is no central management node, the network is formed by the self-organizing collaborative algorithm, and the networking algorithm is more complicated. In this scheme, it is very important to determine the appropriate threshold value to realize the security of the network. This paper uses the relationship between the node failure probability and the number of nodes and the threshold value to determine the threshold value. Once it becomes a representative node, it will immediately send a broadcast message to inform its relevant neighbor nodes. According to the theory of radio wave propagation, the effective range of broadcast information representing a node is a circular area with itself as the center. Therefore, the transmit power of the representative node can be adjusted so that its related neighbors can receive the broadcast message.The data in Figure2 still uses the representative corrected dataset as the experimental dataset. In the experiment, the dataset is divided into two categories: normal and attack; that is, all different attack behaviors are marked as attack. 60 records were randomly selected for feature selection, and 120 records were randomly selected for the evaluation of intrusion detection performance of feature subsets, 50% of which were used as the training set for classification and the remaining 50% were used as the test set.Figure 2
Wireless sensor network node data test.The code running in each sensor node occupies 16874 bytes of ROM (Read Only Memory) after compilation (the ROM of the Mica2 node is 128 k bytes in total), and it occupies 2795 bytes of RAM (Random Access Memory) (the RAM of the Mica2 node is 4 k bytes in total). In addition to the code, the node only needs to store 3 keys, which is quite affordable for sensor nodes. It can be seen that the detection rate matrix is an important index to evaluate the cluster head intrusion detection system. It can be seen from the formula that the detection rate matrix is also an important parameter that directly affects the prior probability, thus indirectly affecting the posterior probability. This experiment examines the influence of the detection rate on the posterior probability by selecting different detection rate matrices.


## 3.4. Network Security Module Coupling

System behavior can include system information such as network security module utilization, file verification, as well as behavior data such as the time and times of normal user slamming, and the number of operation failures.The process of sample learning is relatively slow. The learning process is to change the connection weights between neurons in order to store the information about the intrusion behavior in the neural network. In order to describe normal behavior patterns, anomaly detection methods usually need to analyze and organize a large number of system event records. In the early stage of system design, we use key preset processing for each node in the WS network; that is, each node shares a master key and uses a symmetric cryptosystem for data encryption and decryption. In this way, the expansion of the system is more convenient, such as adding a new node, as long as the node is preinstalled with the master key.In order to better reflect the performance of the network, this paper also designs the network model in Figure3 for comparison. In the simulation process, the network simulation is carried out according to several performance indicators such as the failure probability p of the node, the threshold value, the successful transmission rate of the network, and the error correction rate. It can be seen that with the increase of the threshold value and the probability of node failure, the transmission rate of the network is continuously reduced, because with the increase of the threshold value, the council nodes in the domain need more nodes to restore key nodes, to ensure the effective transmission of the network.Figure 3
Network security module architecture.In the case where the number of nodes in the domain in Figure4 is 80, with the increase of the failure probability of the node and the constant change of the threshold in the domain, the comparison of the error correction rates between networks with different threshold values and the correction with the parallel structure are obtained. Compared with the error rate, it can be seen from the comparison that with the increase of the threshold value, the error correction ability of the network is getting lower and lower. From the perspective of security and the comparison with the parallel structure, it can be seen from the figure that the network error correction rates of (3, 6) and (4, 6) are optimal. In the absence of network attacks, the Low-Power Adaptive Clustering Hierarchy Protocol (LEACH) routing algorithm has the highest efficiency and the longest network life cycle because it does not need to implement any security mechanism.Figure 4
Distribution of coupling thresholds of network security modules.Although the proposed security mechanism is not significantly better than the “LEACH+IPD” case without being attacked, the proposed intrusion protection and detection scheme can significantly extend the network life cycle after being attacked and alleviate the network thrashing caused by an attack.


## 3.5. Analysis of Situational Awareness Factors

The data source of the network-based situational awareness detection system is the data packets transmitted in the network, and the goal is to protect the operation of the network. It is built on the basis of line interception and captures data packets in the network for analysis. It is composed of a security control center and multiple intrusion detection engines. The detection engine is mainly responsible for collecting data, analyzing data, and reporting events. The security control center is responsible for issuing policies, accepting time, recording and analyzing logs, and maintaining feature information databases. Such systems are typically deployed on the subnet where important servers are located and monitor connections in that subnet. It mainly lists the storage overhead of original sensing data nodes and other shared data nodes, including the storage space of sensing data, keys, and vector values. Although neural networks have been used in the field of intrusion detection, before using neural networks for intrusion recognition, a large number of intrusion samples should be used for recognition training, so the system has the ability to effectively classify intrusion behaviors, so as to correctly identify intrusions activity. The provisioning mechanism has roughly equivalent storage overhead.In the fault-tolerant simulation, we analyze the network performance of Figure5 from two aspects, the successful data transmission rate, and the error correction rate. The successful data transmission rate refers to the probability that data is successfully transmitted from the sending node to the receiving node. The error correction rate refers to the probability that data is transmitted from other paths to the receiving node when one path is blocked. In both aspects, we study the performance of the network based on the failure probability of nodes. We further measure the communication overhead required by the implementation of each round of data safe storage during the operation of this scheme. It can be known the size of the communication volume during the operation of the whole scheme, and it can be seen that the communication volume of this mechanism is not large in the stages of data sharing, integrity detection and data recovery. The data survival rate is improved, and each node undertakes the sending task in the data recovery phase, so the energy consumption of a single node is also reduced. Compared with the proposed scheme, since it adopts a signature-based dynamic integrity protection mechanism, its communication overhead is relatively large, which is not suitable for the actual operating environment.Figure 5
Situational awareness network performance.


## 4. Application and Analysis of Network Security Situational Awareness Model Based on Genetic Algorithm in Wireless Sensor Networks

### 4.1. Feature Extraction of Wireless Sensor Network

The intrusion protection and detection scheme proposed in this paper is combined with the cluster-based sensor network routing algorithm LEACH, and an experimental platform is built on the LEACH CAD Tool1721 based on the network simulation tool Network Simulator-2(NS2)11711. In addition, in the experimental environment, this paper assumes that 10% of the nodes in the sensor network have been captured by the attacker and consume their energy by sending abnormal sensing data (large data packets, redundant data packets) to the cluster head node. In this simulation experiment, we stipulate that the network life cycle refers to the operation from the completion of the network deployment until the last node’s energy is exhausted. This will cause a very large amount of data, affect the efficiency of detection, and cause a lag in intrusion response. Therefore, part of the characteristic data packets of each complete network connection or specific fields in the data packets are usually extracted, and the original data packets are processed in the form of features.During the experiment, the input parameters of the feature selection method are set as follows: the maximum number of iterations is 350, the initial node size is 100, the learning factors c1 and c2 and the inertia warrant coefficientw change with the number of iterations, and the kernel parameters of the support vector machine are s=0.6250 and penalty parameter c=0.7850. The design of the above parameters is based on experiments or prior knowledge, with random components. In order to improve the results of the experiment, the above parameters can be modified during the experiment.The experimental environment is Intel(R) Core(TlV0 i3 CPU 2.93GHz, 4GB memory, Windows XP system), and the feature selection algorithm is implemented in Java. In the process of routing request, the transmission of routing information between the source node and the base station has to go through many. Each hop needs to perform encryption, decryption, and authentication processing, but the delay is very small relative to the key synchronization period.From the perspective of the network model, the network nodes in Figure6 are divided into clusters according to their geographic locations, which can significantly improve the flexibility of the network and save energy. In addition, the layered network architecture facilitates the application of distributed algorithms in large-scale deployed sensor networks. Selecting a cluster head node to be responsible for forwarding the sensing data in the cluster to the sink node becomes the primary problem to be solved by the nodes in the cluster. The nodes in the cluster generally become the cluster head nodes by rotation to balance the energy consumption of each node. The characteristic of this type of application is that it can obtain the topology of the wireless sensor network; the other type of application is characterized by a harsh deployment environment and less services and usually cannot obtain the topology information of the wireless sensor network.Figure 6
Feature distribution of wireless sensor network.


### 4.2. Network Security Situational Awareness Simulation

In the network security situational awareness detection process, mainly for external threats, some nonspecific data are taken from the massive data from different data sources as behavior data, and these data are mainly used for feature extraction. First, perform the data dimension on the extracted data; when it is indeed severely invaded and the alarm conditions are met, the alarm system is activated. As the probability increases, in the member node hybrid strategy, the ratio of choosing a level 1 attack and a level 2 attack decreases. As the probability increases, in the cluster head hybrid strategy, the ratio of choosing level 1 defense and level 2 defense decreases. Since the average detection rate of the cluster head intrusion detection system is an inherent property of the intrusion detection system, once the system is started, it will not change. The more unfavorable this is to malicious nodes, the more inclined they are to reduce attacks, and the more cooperative strategies they will choose.The cluster head node in Figure7 is the manager of a cluster, and the sensing data sent by each member node is forwarded to the sink node through it, so the cluster head node has the ability to find abnormal member nodes in the cluster. When the cluster head node finds an abnormal member node, it can block the member node by broadcasting an alarm message. Since both perception data packets and control data packets are based on the one-time signature algorithm, the cluster head node can easily confirm the location and identity of the compromised node. Node localization can be achieved by letting the mobile anchor node traverse the minimum access cover node set. Since the mobility anchor node only has the topology information of the network, the nodes in the minimum connected access coverage node set must be connected, so that the mobility anchor node can traverse normally.Figure 7
Network security situational awareness topology.However, for the current intrusion detection system, when any node finds abnormal behavior through monitoring and broadcasts an alarm, those malicious nodes can also pretend to be legitimate nodes to issue alarm information to other member nodes and even destroy the trust of the cluster head node. The authenticity of such alarm information packets needs to be strictly verified. The main idea is that multiple member nodes cooperate to monitor the network behavior of the cluster head node. If an abnormality is found, the monitoring node needs to broadcast a signed security short message to the monitoring group. After that, when the amount of alarm messages reaches the threshold, the alarm information that has been signed by the group is broadcast to all member nodes in the cluster.


### 4.3. Example Application and Analysis

The wireless sensor network security data collection includes the methods for the target system to collect all kinds of data, including network traffic information, operating system logs, application logs, and finally extracting behavior data from massive data to complete data collection. The generation of the detection model is more reflected in the formation of classification rules in this process. The description of this stage is to preprocess the data collected in the data collection stage, and then extract and reduce the features of the data. A feature database is formed based on classification rules, and a detection model is formed after manual correction and weight optimization of the feature database.Based on the clustering protocol, Table2 divides the sensor network into one domain. All domains cover the entire network. In this way, the entire network system is divided into a series of adjacent domain units with equal status of internal members. By replacing the function of the cluster head by the cluster council, it is beneficial to balance energy in the domain, reduce the load such as communication, and weaken the role and influence of a single node. Considering the cost of the system and the efficiency of the positioning algorithm, the mobile anchor node should find a shortest path to visit. The optimal traversal connected access to cover node set problem can be regarded as a simplified wireless sensor network undirected graph given a known distance and topology between nodes and an optimal traversal algorithm to solve the graph.Table 2
Wireless sensor network security data.
Network layerTest numberDetection numberAlarm rateDetection rateError rate106875580.550.950.05208232950.210.400.02304894110.740.060.10408856730.340.070.04505214280.090.850.04In the wireless sensor network dynamic defense model, when the historical behavior sequence length is 6, after roughly 21 games, the posterior probability converges to 1; that is, after 21 games, the cluster head has confirmed that the member node is a malicious node. When the length of the historical behavior sequence is 4, it takes roughly 32 games, and the posterior probability converges to 1; when the length of the historical behavior sequence is 2, it takes roughly 52 games, and the posterior probability converges to 1. Compared with the curve, the longer the historical behavior sequence, the faster the posterior probability converges to 1. However, the longer the historical behavior sequence length is, the more historical information the cluster head needs to store, the more space resources it occupies, and the more energy resources it consumes during computation. Therefore, although the historical behavior sequence is as long as possible, in practical applications, it should not be too long to avoid waste of resources.It can be seen from the running results in Figure8 that both algorithms have strong convergence ability and can achieve convergence in a limited number of times. It can be seen that when the node size is 100, the convergence results of the two algorithms are relatively close. However, as the value of this parameter decreases, the convergence result of the IGA algorithm becomes more and more unsatisfactory. It can be seen that when the node size is 10, the IGA has not converged, but the BPSO-GA algorithm still converges. The GA algorithm is more sensitive; the running time of the algorithm is directly related to the number of iterations of the algorithm. In terms of the performance of the fitness value curve, the curve of the feature selection algorithm based on the binary genetic algorithm in the BPSO-GA chapter is relatively steep, and the curve of the IGA is relatively flat. The BPSO-GA algorithm generally moves towards the historical optimal position of the node itself and the optimal position of the group due to the movement of the nodes, but the movement of the nodes in a small range is discrete and random. The node will move closer to this position. On the fitness value curve, it appears to be relatively steep, and there are many mutation points. However, each generation of the IGA algorithm selects the parent with better fitness value for inheritance, and gradually approaches the optimal fitness value, so it appears flat on the fitness value curve.Figure 8
Wireless sensor network security routing convergence capability.


## 4.1. Feature Extraction of Wireless Sensor Network

The intrusion protection and detection scheme proposed in this paper is combined with the cluster-based sensor network routing algorithm LEACH, and an experimental platform is built on the LEACH CAD Tool1721 based on the network simulation tool Network Simulator-2(NS2)11711. In addition, in the experimental environment, this paper assumes that 10% of the nodes in the sensor network have been captured by the attacker and consume their energy by sending abnormal sensing data (large data packets, redundant data packets) to the cluster head node. In this simulation experiment, we stipulate that the network life cycle refers to the operation from the completion of the network deployment until the last node’s energy is exhausted. This will cause a very large amount of data, affect the efficiency of detection, and cause a lag in intrusion response. Therefore, part of the characteristic data packets of each complete network connection or specific fields in the data packets are usually extracted, and the original data packets are processed in the form of features.During the experiment, the input parameters of the feature selection method are set as follows: the maximum number of iterations is 350, the initial node size is 100, the learning factors c1 and c2 and the inertia warrant coefficientw change with the number of iterations, and the kernel parameters of the support vector machine are s=0.6250 and penalty parameter c=0.7850. The design of the above parameters is based on experiments or prior knowledge, with random components. In order to improve the results of the experiment, the above parameters can be modified during the experiment.The experimental environment is Intel(R) Core(TlV0 i3 CPU 2.93GHz, 4GB memory, Windows XP system), and the feature selection algorithm is implemented in Java. In the process of routing request, the transmission of routing information between the source node and the base station has to go through many. Each hop needs to perform encryption, decryption, and authentication processing, but the delay is very small relative to the key synchronization period.From the perspective of the network model, the network nodes in Figure6 are divided into clusters according to their geographic locations, which can significantly improve the flexibility of the network and save energy. In addition, the layered network architecture facilitates the application of distributed algorithms in large-scale deployed sensor networks. Selecting a cluster head node to be responsible for forwarding the sensing data in the cluster to the sink node becomes the primary problem to be solved by the nodes in the cluster. The nodes in the cluster generally become the cluster head nodes by rotation to balance the energy consumption of each node. The characteristic of this type of application is that it can obtain the topology of the wireless sensor network; the other type of application is characterized by a harsh deployment environment and less services and usually cannot obtain the topology information of the wireless sensor network.Figure 6
Feature distribution of wireless sensor network.


## 4.2. Network Security Situational Awareness Simulation

In the network security situational awareness detection process, mainly for external threats, some nonspecific data are taken from the massive data from different data sources as behavior data, and these data are mainly used for feature extraction. First, perform the data dimension on the extracted data; when it is indeed severely invaded and the alarm conditions are met, the alarm system is activated. As the probability increases, in the member node hybrid strategy, the ratio of choosing a level 1 attack and a level 2 attack decreases. As the probability increases, in the cluster head hybrid strategy, the ratio of choosing level 1 defense and level 2 defense decreases. Since the average detection rate of the cluster head intrusion detection system is an inherent property of the intrusion detection system, once the system is started, it will not change. The more unfavorable this is to malicious nodes, the more inclined they are to reduce attacks, and the more cooperative strategies they will choose.The cluster head node in Figure7 is the manager of a cluster, and the sensing data sent by each member node is forwarded to the sink node through it, so the cluster head node has the ability to find abnormal member nodes in the cluster. When the cluster head node finds an abnormal member node, it can block the member node by broadcasting an alarm message. Since both perception data packets and control data packets are based on the one-time signature algorithm, the cluster head node can easily confirm the location and identity of the compromised node. Node localization can be achieved by letting the mobile anchor node traverse the minimum access cover node set. Since the mobility anchor node only has the topology information of the network, the nodes in the minimum connected access coverage node set must be connected, so that the mobility anchor node can traverse normally.Figure 7
Network security situational awareness topology.However, for the current intrusion detection system, when any node finds abnormal behavior through monitoring and broadcasts an alarm, those malicious nodes can also pretend to be legitimate nodes to issue alarm information to other member nodes and even destroy the trust of the cluster head node. The authenticity of such alarm information packets needs to be strictly verified. The main idea is that multiple member nodes cooperate to monitor the network behavior of the cluster head node. If an abnormality is found, the monitoring node needs to broadcast a signed security short message to the monitoring group. After that, when the amount of alarm messages reaches the threshold, the alarm information that has been signed by the group is broadcast to all member nodes in the cluster.


## 4.3. Example Application and Analysis

The wireless sensor network security data collection includes the methods for the target system to collect all kinds of data, including network traffic information, operating system logs, application logs, and finally extracting behavior data from massive data to complete data collection. The generation of the detection model is more reflected in the formation of classification rules in this process. The description of this stage is to preprocess the data collected in the data collection stage, and then extract and reduce the features of the data. A feature database is formed based on classification rules, and a detection model is formed after manual correction and weight optimization of the feature database.Based on the clustering protocol, Table2 divides the sensor network into one domain. All domains cover the entire network. In this way, the entire network system is divided into a series of adjacent domain units with equal status of internal members. By replacing the function of the cluster head by the cluster council, it is beneficial to balance energy in the domain, reduce the load such as communication, and weaken the role and influence of a single node. Considering the cost of the system and the efficiency of the positioning algorithm, the mobile anchor node should find a shortest path to visit. The optimal traversal connected access to cover node set problem can be regarded as a simplified wireless sensor network undirected graph given a known distance and topology between nodes and an optimal traversal algorithm to solve the graph.Table 2
Wireless sensor network security data.
Network layerTest numberDetection numberAlarm rateDetection rateError rate106875580.550.950.05208232950.210.400.02304894110.740.060.10408856730.340.070.04505214280.090.850.04In the wireless sensor network dynamic defense model, when the historical behavior sequence length is 6, after roughly 21 games, the posterior probability converges to 1; that is, after 21 games, the cluster head has confirmed that the member node is a malicious node. When the length of the historical behavior sequence is 4, it takes roughly 32 games, and the posterior probability converges to 1; when the length of the historical behavior sequence is 2, it takes roughly 52 games, and the posterior probability converges to 1. Compared with the curve, the longer the historical behavior sequence, the faster the posterior probability converges to 1. However, the longer the historical behavior sequence length is, the more historical information the cluster head needs to store, the more space resources it occupies, and the more energy resources it consumes during computation. Therefore, although the historical behavior sequence is as long as possible, in practical applications, it should not be too long to avoid waste of resources.It can be seen from the running results in Figure8 that both algorithms have strong convergence ability and can achieve convergence in a limited number of times. It can be seen that when the node size is 100, the convergence results of the two algorithms are relatively close. However, as the value of this parameter decreases, the convergence result of the IGA algorithm becomes more and more unsatisfactory. It can be seen that when the node size is 10, the IGA has not converged, but the BPSO-GA algorithm still converges. The GA algorithm is more sensitive; the running time of the algorithm is directly related to the number of iterations of the algorithm. In terms of the performance of the fitness value curve, the curve of the feature selection algorithm based on the binary genetic algorithm in the BPSO-GA chapter is relatively steep, and the curve of the IGA is relatively flat. The BPSO-GA algorithm generally moves towards the historical optimal position of the node itself and the optimal position of the group due to the movement of the nodes, but the movement of the nodes in a small range is discrete and random. The node will move closer to this position. On the fitness value curve, it appears to be relatively steep, and there are many mutation points. However, each generation of the IGA algorithm selects the parent with better fitness value for inheritance, and gradually approaches the optimal fitness value, so it appears flat on the fitness value curve.Figure 8
Wireless sensor network security routing convergence capability.


## 5. Conclusion

This paper mainly studies the secure routing protocol of wireless sensor network based on genetic algorithm. First, the classification, characteristics, and performance indicators of wireless sensor network routing protocols are introduced, and the attack methods against routing protocols, the security requirements of routing protocols, and the On-Demand Distance Vector (AODV) routing protocol that can be applied to the 802.15.4 standard are analyzed. This protocol obtains good energy consumption balance and energy saving by adding an energy balance module to the AODV protocol and deleting the mechanism; by using a preshared key model to establish a key, using a hash function, a single-key digital signature, and a symmetric encryption algorithm, which implements encryption and authentication of routing messages. Therefore, the processing object encrypted with the public key is the key used for the symmetric encryption algorithm. Since the key length is relatively short (in our algorithm, a 128-bit random number is used to generate the key), even if the public key with relatively low algorithm efficiency is used. The key encryption and decryption algorithms will not have much impact on the overall algorithm efficiency of the network, but the benefits are the convenience of key management and the nonrepudiation of node authentication. Finally, the NS2 simulation software is used to simulate the normal nodes and malicious nodes of the protocol. The results show that the protocol has better packet delivery rate, delay, energy consumption balance, and security.



---

*Source: 8292920-2022-08-18.xml*