IEEE - Aerospace and Electronic Systems - February 2020 - 9

O'Mahony et al.
6) Node ability: WSN nodes must be self-organizing,
react to node/link failures and only authorized nodes
should be allowed to operate and share information
in a WSN.
Evidently, no WSN will be 100% secure and it is
extremely difficult to design a WSN where attackers cannot find some way in [23]. Timely mitigation strategies
are required to combat attacks that exploit the WSN vulnerabilities. This provides a need for security measures
which are either preventive, reactive, or detective solutions [15]. Preventive measures include cryptography,
spreading codes, frequency hopping, frame check sequences, etc. [9]. An IDS identifies the presence of intruders,
so mitigation (or reactive) strategies can be implemented.
The fundamentals of intrusions and intrusion detection
were defined by James Anderson in 1980 and are; risk,
threat, attack, vulnerability, and penetration [33]. Additionally, an IDS includes the delicate balance between
detection and false-alarm rates, which can be particularly
challenging in environments where many different physical layers occupy the same spectrum. Intrusion detection
can be achieved using different methods [22], [30].
Misuse detection compares the action or behavior of
transmitting/receiving nodes to well known attack
patterns. These attack signatures form the knowledge base of the IDS.
Anomaly detection defines the characteristics of
normal operation and activities and transmissions
are compared against this normal operation. The
IDS classifiers outliers, which are activities different
from normal, as intruders.
Hybrid or specification-based detection includes
IDSs which do not conform to anomaly or misuse.
Normal behavior is manually defined by human perception. The focus is to determine deviations from
this normal behavior, when it is not defined by training data or machine learning algorithms. Certain
hybrid approaches can combine both anomaly and
misuse detection.
The above discussion highlights the fact that security
plays a major role in WSNs, is integral for any successful
WSN-based critical application and, typically, four pillars
of WSN security exist; vulnerabilities, requirements,
attacks, and defenses [34]. Typically, networks have
defined requirements, e.g., confidentiality, and employ
specific defense strategies (encryption) to ensure each
requirement is met. Networks, especially WSNs, have vulnerabilities and attacks can use these vulnerabilities to,
potentially, increase attack efficiency. A notable example
is the finite energy supply and, thus, attackers can focus
on this vulnerable point. Therefore, this implies that
the identified four pillars suit WSN security analysis. Furthermore, given the three-dimensional model for reliability
FEBRUARY 2020

Figure 3.
A functional simplified model for visualizing different security
options in WSNs.

provided in [35], a similar approach can be taken for security, as provided in Figure 3, which establishes a functional
model for security using certain parameters. This model
provides a simplified visual representation of some available security setups for WSNs. The specified model analyses whether a preventive, reactive, or detection approach is
used as the security mechanism, is a hop-by-hop or end-toend basis applied and is security event-triggered or on each
individual packet. Here, hop-by-hop refers to maintaining
security across each and every link and end-to-end refers to
only the source and destination maintaining security. Furthermore, typically, reliability provides bit loss recovery
whilst security specifies bit loss prevention. Therefore, the
topics can be linked in terms of packet loss and the model
in [35] readily adapts to security.

ATTACKS ON WSNS
Attacking a WSN involves either unauthorized access to
data, data manipulation, or denial of system services.
These WSN attacks can be categorized into either passive
or active attacks [13]. Passive attack styles do not modify
information or messages but, instead, aim to learn the
transmitted confidential data. Initially, this does not appear
to have severe consequences, especially if data is
encrypted. However, over time and given enough captured
data, reverse engineering can provide the protocol in use
and grant network access or packet decryption, which
results in multiple network security consequences. In contrast, active attacks aim to modify/remove streams of data,
cause a DoS, disturb functionality or disguise an attack as
a legitimate node. For convenience, a selection of known
attacks on WSNs are categorized and described, where the
focus is placed on PHY and MAC layer attacks, including
jamming and congestion style intrusions. Generally, it is
envisaged that external attacks, for example, jamming,
will be implemented using an SDR approach. This hardware provides the necessary ability to receive, analyze,
and transmit. The internal attacks, for example, sinkhole,
will, typically, use a WSN device that has been captured
or identified. Attack effectiveness and/or affected area,

IEEE A&E SYSTEMS MAGAZINE

IEEE - Aerospace and Electronic Systems - February 2020

Table of Contents for the Digital Edition of IEEE - Aerospace and Electronic Systems - February 2020