KR100906300B1 - Sensor network system and method for detecting attack thereof - Google Patents

Abstract

The present invention relates to a sensor network system and an attack detection method thereof. The sensor network system includes a plurality of arbitrarily arranged nodes, at least one of which is the number of hops of routing information included in a message transmitted between a source node and a destination node or a source node and an intermediate node when a routing path is generated. It has a detection mode for detecting the modulation of. As a result, the attacker node can be detected when the routing path is set up, thereby preventing the leakage or contamination of information through the attacker node, thereby improving security and preventing an increase in packet transmission delay time. have.

Sensor Network, Node, Attacker, Detection, Hop Count, Routing Path, RREQ, RREP

Description

Sensor network system and attack detection method {SENSOR NETWORK SYSTEM AND METHOD FOR DETECTING ATTACK THEREOF}

The present invention relates to a sensor network system and an attack detection method thereof. The present invention relates to a sensor network system that detects an internal attack of an attacker by observing a tampering of a hop number, thereby improving security and preventing an increase in packet transmission delay time. And an attack detection method thereof.

Sensor network is one of the foundation networks for ubiquitous computing implementation, and its importance is getting more and more important, and security technology is also recognized as important with the foundation technology.

The sensor network security technology that has been conducted up to now is mainly focused on the authentication structure and the key management structure that rely on encryption. However, sensor nodes can be easily captured, and even in environments using encryption technology, keys are likely to be exposed to the outside world. An attacker can use this to masquerade as a legitimate node and attack inside the sensor network. Such an internal attack can be exploited by an attacker by contaminating a node, and the damage is more severe than an external attack. Therefore, in order to ensure the security of the network, a feasible internal attack and its impact should be analyzed and a safe mechanism for internal attack should be developed.

On the other hand, AODV (Ad-hoc On-Demand Distance Vector) protocol is a typical routing protocol, "On-Demand Routing Protocol" that performs the process of finding a route when obtaining routing information.

When the source node wants to send a data packet to the destination node, the AODV protocol broadcasts a Route Request (RREQ) message to the neighbor node if there is no routing information for the destination node in the source node's routing table. If there is no routing information for the destination node in the neighbor's routing table, the neighbor node forwards the RREQ message to its neighbor node. When the RREQ message reaches the destination node or reaches the node with routing information for the destination node, the node forwards a Route Reply (RREP) message to the source node.

To see the impact of an internal attack on a sensor network using this AODV protocol, for each of the cases where there is an attacker node created by one of the nodes being contaminated by the internal attack, and the case where no attacker node exists, The routing path configuration, the number of packets passing through each node, and the packet transmission delay time of each node will be described.

1 is a configuration diagram of a sensor network displaying a routing path set in a normal environment in which an attacker node does not exist.

This sensor network is based on the NS-2 and consists of a simulation using AODV module developed by Monarch Group of Carnegie Mellon University. In this sensor network, the number of nodes, simulation space, simulation time, radio transmission range, radio propagation model, packet transmission rate, PHY layer and MAC layer are used as parameters, and the value of each parameter is 25 nodes and simulation space 70m * 70m, simulation time 100s, radio transmission range 15m, radio propagation model Two-Ray, packet rate 5 pkt / sec, PHY layer and MAC layer, WPAN developed for IEEE 802.15.4 by Samsung Advanced Institute of Technology and New York City University The module was used.

The 25 nodes of the sensor network are named 0 through 24, and each node is arranged to be arranged in five rows and columns. Here, node 24 is a sink node, and nodes 23 in node 0 transmit CBR traffic to the sink node every 5 seconds. And any node of node 23 from node 0 except the sink node can be an attacker node.

1 illustrates a state in which a source node is node 0 and a destination node is node 24, that is, a routing path from node 0 to node 24 is established. This is because, due to the nature of the AODV mechanism, routing paths to the same destination node are affected by the routing path first established, and node 0 generates the first CBR traffic to see how this property affects the attacker node. .

Looking at the process of setting up a routing path using the AODV protocol, first, node 0 sends its RREQ (Route Request) message including its ID, destination ID, hop number, and serial number to nodes 1 and 5, which are neighboring nodes. To pass. Nodes 1 and 5 determine whether the destination ID included in the RREQ message matches their own, and if not, compares the serial number of their routing table with the serial number of the RREQ message to determine the serial number of the RREQ message. It increases the number of hops only if it is larger than its own serial number and delivers the RREQ message to its neighbor nodes. If the serial numbers are the same, it sends the RREQ message to its neighbor nodes only when the number of hops is small. Neighbors that receive the RREQ message also pass the RREQ message to their neighbors through the same process performed by nodes 1 and 5, and this flooding process is repeated so that the RREQ message is returned to node 24. Delivered until. Here, intermediate nodes between nodes 0 and 24 store reverse routes between node 0 and their node in the routing table.

When node 24 receives the RREQ message from node 0, node 24 stores the reverse path between node 0 and node 24 in the routing table and sends a RREP (Route Reply) message to node 0. At this time, the RREP message is delivered in a unicast manner. Node 0, receiving the RREP message, sends a RREP-ACK message to node 24 indicating that it has received the RREP message.

As shown in FIG. 1, node 0 (source node) → node 5 → node 6 → node 7 → node 12 → node 17 → node 18 → 23 A routing path is established from node 0 to node 24 from node → node 24 (destination node).

Similarly, the routing path from node 20 to node 24 is set to node 20 (source node) → node 21 → node 22 → node 23 → node 24 (destination node). .

When the routing path is configured in this way, nodes belonging to the routing path use the preset routing path when transmitting CBR traffic.

2 is a configuration diagram of a sensor network indicating a routing path established when an attacker node exists.

In general, when an attacker node intrudes into the sensor network, the routing path is changed by the attacker node. Attacker nodes can attack the sensor network with various types of attacks. Attack types include Bogus routing information, Selective forwarding, Wormholes, Shinkholes, HELLO Floods, Sybil Attacks, and Denial of Service (DoS) attacks. . In the case of a routing information tampering attack, the routing information is modified so that other nodes perceive the attacker node as providing the shortest routing path to the destination node, thereby placing the attacker node on the routing path to the destination node. Placing the attacker node on the routing path in this way can increase the amount of traffic affected by the attacker node on the sensor network, making it easy to apply other attack types.

The attacker node of the present embodiment reduces the number of hops in the routing information and forwards it to other nodes, so that other nodes recognize that the routing path through the attacker node is the shortest routing path. That is, when the attacker node receives the RREQ message from the neighboring node, the attacker node reduces the number of hops included in the RREQ message by one or more and delivers it to the next node.

For example, if the attacker node is node 16, if the attacker node receives the RREQ message from one of the neighbor nodes, node 16 decreases the hop count of the RREQ message by 1 or more, and then node 15, the neighboring node, It transmits the modulated RREQ message to node 17, node 21, and node 11. Then, the neighboring nodes increase the number of hops by 1 in the modulated RREQ message and forward them to their neighboring nodes. Through this process, the path including node 16, which is an attacker node, may have fewer hops to reach the destination node than other paths.

Accordingly, as shown in FIG. 2, when an attacker node exists, the routing path for transmitting CBR traffic from node 0 to node 24 is node 0 (source node) → node 5 → node 10 → node 15 → node 16 (attacker node) → node 17 → node 18 → node 19 → node 24 (destination node).

The routing path thus configured will later affect other routing paths. Accordingly, when nodes 6, 7, and 20 are starting nodes and transmit CBR traffic to node 24, a routing path including an attacker node is established. If this routing path is established, the amount of CBR traffic passing through the attacker node is increased, and the routing path through other nodes is lengthened.

For example, in case of node 20, if there is no attacker node, CBR traffic is transmitted to node 24 through node 21, 22 and 23, so node 20 in 4 hops. CBR traffic from the node is forwarded to node 24. However, if there is an attacker node, CBR traffic is transmitted to node 24 through node 15, node 16, node 17, node 18, node 19, and so the number of hops increases. This change of routing path not only allows attacker nodes to attack the sensor network more widely, but also increases the CBR traffic transmission time of each node.

3 is a graph showing the number of packets passing through each node when each node is a normal node and an attacker node.

FIG. 3 compares the number of packets passing through each node when node 23 is normal with the number of packets passing through each node when node 23 is an attacker node when node 23 is normal. As shown, it can be seen that the number of packets passing through each node is normal and the attacker node is significantly different.

However, in the case of node 4, node 9, node 19, node 20, node 21, and node 23, the number of packets passing through in the normal state and the attacker node is the same.

Since node 19 and node 23 are one hop away from node 24 as a destination node, node 19 and node 23 must pass through node 19 and node 23 in order to deliver a packet to the destination node. Therefore, the number of packets passing through is the same regardless of whether or not it is an attacker.

For the remaining nodes, nodes 4 and 9 are located in the lower right corner of the sensor network, and nodes 20 and 21 are located in the upper left corner of the sensor network, so that they are farther apart from the diagonal connecting node 0 and 24. It is. In general, according to the AODV mechanism, nodes receiving an RREQ message transmit an RREP message if they know the routing path to the destination node even if they are not the destination node. Therefore, in the case of a network in which multiple nodes transmit packets to the same destination node, the routing path first determined is greatly affected. That is, since CBR traffic is transmitted from node 0 to node 24, nodes 4, 9, 20, and 21 are spaced apart from the diagonal line connecting node 0 and node 24. In addition, since the number of packets passing through is small and the number of neighboring nodes is small, the attacker node does not have a great effect.

4 is a graph showing the ratio of the number of packets passing through each node when each node of FIG. 3 is a normal node and an attacker node.

When each node is changed to an attacker node, the number of packets passing through each node and the packet transmission time increase. For example, in the case of node 11, 40 packets pass through node 11 when the node is a normal node, but when the node is changed to an attacker node, the number of packets passing through increases to 120. That is, three times as many packets pass through node 11.

As a result, the number of packets passing through each node is increased up to 142 packets, an average of 55 packets, and accordingly, the increase rate of the packets is up to 8.1 times and an average of 2.56 times. The maximum packet transmission delay time is 0.017 seconds and averages 0.0089 seconds.

On the other hand, the nodes showing a three times increase rate are nodes 1, 8, 10, 11, 15, 16, and 22. These nodes are all nodes located in the vicinity of the routing path established between node 0 and node 24 when the normal node.

As a result, when the nodes adjacent to the configured routing path become attacker nodes in the case of the normal node, the number of packets passing through is sharply increased compared to when the nodes are not attacker nodes, thereby increasing the amount of traffic. This means that if the attacker node is located adjacent to the routing path formed when the attacker node is a normal node, a more lethal attack may be applied to the sensor network.

5 is a graph illustrating packet transmission delay time of neighboring nodes when node 11 is an attacker node.

When node 11 becomes the attacker node, the routing path between node 0 and node 24 is node 0 including node 11 → node 5 → node 10 → node 11 → node 16 → node 17 Node → node 18 → node 19 → node 24.

FIG. 5 shows packet transmission delay times for nodes 0, 11, 6, 7, 12, and 15 that are not included in the routing path. It is divided into normal node and node 11 as attacker node.

It can be seen that the packet transmission delay time is increased when node 11 becomes an attacker node than node 11 is a normal node in most peripheral nodes. Especially, in case of node 7 and node 12, if node 11 is attacker node, packet transmission delay time is longer than other nodes. This is because in the case of nodes 7 and 12, the routing path from node 11 to node 24 is not the shortest routing path.

On the other hand, it can be seen that the packet transmission delay time is increased in the case of a node whose routing path from node 11 to node 24 is the shortest routing path, for example, node 6. This is because the packet transmission delay time of nodes passing through node 11 increases as the traffic volume of node 11 increases.

In the sensor network described above, since the number of nodes is 25 and the sensor network is small and there is not a lot of traffic, the difference in packet transmission delay time between the normal node and the attacker is not large. In the network, if there is an attacker, the difference in packet transmission latency is expected to be large.

As such, if an attacker node exists inside the sensor network, the attacker node modulates the routing information such that a significant portion of the routing paths within the sensor network pass through the attacker node. As a result, the information is easily leaked through the attacker node, and the security is fatally compromised. In addition, as the number of packets passing through the attacker node increases, not only the packet transmission delay time of the attacker node increases, but also the packet transmission delay time of peripheral nodes disposed adjacent to the attacker node.

Accordingly, there is a need to find a way to detect an attacker node so that a routing path through the attacker node is not created.

An object of the present invention is to detect an attacker node so that a routing path through the attacker node is not generated, thereby improving the security of the information and preventing the increase in the packet transmission delay time of the sensor network. And an attack detection method thereof.

The object is that in a sensor network system having a plurality of nodes arranged arbitrarily, at least one of the nodes is a routing included in a message transmitted between a source node and a destination node or a source node and an intermediate node in the generation of a routing path. It can be achieved by the sensor network system characterized in that it comprises a detection mode for detecting the modulation of the hop number of information.

The node having the detection mode includes a hop count calculation mode that calculates the shortest hop number on the shortest routing path between the source node that generated the RREQ message and the node that delivered the RREQ message to the node having the detection mode. desirable.

The node having the detection mode preferably has a hop count calculation mode that calculates the shortest hop number on the shortest routing path between the source node that generated the RREQ message and the node that generated the RREP message for the RREQ message.

In the hop counting mode, the shortest hop count can be calculated using the ID of the source node and the ID of the node that has delivered the RREQ message or RREP message to the node having the detection mode.

In the detection mode, when the number of hops included in the RREQ message or the RREP message is smaller than the shortest number of hops calculated in the hop count mode, the node passing the RREQ message or the RREP message to the node having the detection mode is determined as an attacker node. can do.

When a detection message is provided from the node having the detection mode that the node that has delivered the RREQ message or the RREP message to the node having the detection mode is an attacker node, the information about the attacker node is provided to the plurality of nodes. The method may further include a management node that blocks the establishment of a routing path via an attacker node.

The management node may ignore the detection message from the node having the detection mode when the node determined as the attacker node is a new node or a failed node is replaced.

On the other hand, the object of the attack detection method of a sensor network system having a plurality of randomly arranged node, comprising: receiving a message transmitted between the source node and the destination node, or the source node and the intermediate node when the routing path is generated; And it can be achieved by the attack detection method of the sensor network system, characterized in that it comprises the step of detecting the modulation of the hop number of the routing information included in the message.

And calculating the shortest hop count on the shortest routing path with the node that forwarded the RREQ message to a node having a source node that generated the RREQ message and a detection mode that detects the variation in the number of hops.

And calculating the shortest hop count on the shortest routing path between the source node that generated the RREQ message and the node that generated the RREP message for the RREQ message.

The calculating of the shortest hop number may include calculating the shortest hop number using an ID of the source node and an ID of a node that has delivered an RREQ message or an RREP message to a node having the detection mode.

Detecting the tampering of the hop number, if the number of hops included in the RREQ message or RREP message is less than the shortest hop number, determining the node that forwarded the RREQ message or RREP message to the node having the detection mode as an attacker node It may be a step.

The method may further include transmitting to the plurality of nodes that the node having delivered the RREQ message or the RREP message to the node having the detection mode is the attacker node, thereby blocking the establishment of a routing path via the attacker node.

If the node determined to be the attacker node corresponds to a new node or a failed node is replaced, the method may further include ignoring information on the detected attacker node from the node having the detection mode.

According to the sensor network system and the attack detection method of the present invention, it is possible to detect the attacker node when the routing path is set up, thereby preventing the leakage or contamination of information through the attacker node to improve the security, It is possible to prevent the packet transmission delay time from increasing.

The sensor network system and the attack detection method according to the present invention enable the attacker node to detect the change of the routing information when the routing path is set up, thereby identifying the attacker node.

In general, in order for the attacker node to believe that the routing path that contains the attacker node is the shortest routing path, the fields that the attacker can change in the routing information are: RREQ ID increase, hop count decrease, sequence number for the destination node, source node There is an increase in the sequence number for.

Among these, the RREQ ID is information for identifying the RREQ message along with the source node IP address. The attacker node may modify the RREQ ID and forward it to other nodes. However, an increase in RREQ ID is possible only if the attacker node is within one hop of the source node. Otherwise, the RREQ message with the changed RREQ ID is delivered to the node that sent the RREQ message to the attacker node, and because the node updates its routing table, a routing loop occurs and the path is broken.

On the other hand, in the case of the sequence number, the attacker node transmits the sequence number for the destination node and the sequence number for the source node by a multiple of 2. If the sequence number is an odd number, the attacker node determines that the information is invalid, and transmits the packet. Because it is thrown away. When the sequence number is increased to a multiple of 2 and transmitted to neighboring nodes, the RREQ message with the increased sequence number is also provided to the node that delivered the RREQ message to the attacker node. At this time, the node updates its routing table since the sequence number of the RREQ message provided from the attacker node is greater than the sequence number stored in its routing table. In other words, a routing loop is created between the attacker node and the node that delivered the RREQ message to the attacker node, so that the attacker node is easily detected by the AODV algorithm.

Accordingly, since the increase in the RREQ ID and the increase in the sequence number are not used because the attacker node can be easily detected, in the sensor network system of the present invention, when the attacker node changes the routing information by reducing the number of hops, Consider only. That is, in the sensor network system of the present invention, when the number of hops decreases, a mechanism for detecting the same applies.

6 is a diagram illustrating a process of detecting hop number modulation of an RREQ message in a sensor network system including a detection node according to the present invention.

The sensor network system includes a detection node that detects a change in routing information of an attacker node, a sink node, and a management node (not shown) that determines whether or not an attacker takes a predetermined action.

In the sensor network system according to the present embodiment shown in FIG. 6, the detection node and the sink node are configured in a form in which five nodes are arranged along a row and a column, and each node is 0 to 24 times. It is named. Here, node 24 is a sink node, nodes 0 to 23 are detection nodes, and detection nodes transmit CBR traffic to the sink node every 5 seconds.

Each detection node has a routing table and can perform a hop counting mode and a detection mode.

The hop counting mode is a function of calculating the hop count of the shortest routing path formed between any two nodes, and the detection node can calculate the shortest hop count between two nodes once the ID of any two nodes is known. In the present invention, the method for implementing the hop count mode is not described in detail, but since the hop count calculation has been studied a lot in the field of routing protocol related to the location-based technology, it is a technology that can be sufficiently implemented.

In the operation of the hop count mode, when each detection node receives an RREQ message or RREP message from another node, the ID of the source node that generated the RREQ message or RREP message and the previous node that delivered the RREQ message to the corresponding detection mode. The ID is used to calculate the shortest hop count between the source node and the previous node. The calculated shortest hop count is used to determine whether the previous node is the attacker node in the detection mode.

Detection mode is a function that can detect the change in the number of hops of the routing information by the attacker node. When the number of hops included in the RREQ message and the RREP message is changed, each detection node reports the changed node to the attacker node. Providing a detection message to the management node that the attacker node has been detected.

In performing the detection mode, if the detection node is provided with the shortest hop count between the source node and the previous node calculated by the hop count mode, the shortest hop count calculated by the hop count mode and the RREQ message or RREP delivered from the previous node. Compare the number of hops contained in the message.

As a result of the comparison, if the hop count included in the RREQ message or RREP message is smaller than the calculated shortest hop count, it is determined that the previous node is the attacker node. This is because the attacker node reduces the number of hops included in the RREQ message or the RREP message so that the routing path through the attacker node is recognized as the shortest routing path to other nodes. That is, the number of hops included in the RREQ message or the RREP message whose hop number is modulated at the attacker node is smaller than the calculated shortest hop number. If the previous node is determined to be an attacker node, the detection node forwards information about the attacker node to the management node.

The management node receives information about the attacker node provided from the detection node, re-determines whether the node is an attacker node, and if it is determined to be an attacker node, passes the information about the attacker node to each detection node and the sink node to inform the attacker node. Do not create a routing route through it.

At this time, the reason for determining again whether the management node is an attacker node is as follows.

In general, when a sensor network system fails, a new node can be introduced or the failed node can be replaced. Due to the introduction of these new nodes or replacement of failed nodes, shorter routing paths may be created than previously established routing paths. If the detection node does not have this information, the detection node may attack the newly created short routing path. This can be judged by an attack by a node.

The management node may notify of a new node or replacement of a failed node in advance to prevent erroneous detection by the detection node, or determine from the detection node when an attacker node is detected by a new node or replacement of a failed node. By ignoring information about attacker nodes that have been attacked, the damage caused by false detections can be reduced.

On the other hand, in a sensor network including a central management node such as a base station or a cluster head, the central management node can be used as the management node.

In FIG. 6, a process of detecting an attacker node is illustrated, for example, when node 16 is an attacker node.

In order to establish a routing path from node 0 to node 24, when node 0 transmits an RREQ message, node 15 sends an RREQ message to neighbor nodes including node 16. The RREQ message delivered by node 15 to node 16 includes the ID of the source node (Ori.), The ID of the destination node (Dst.), And the number of hops.The ID of the start node is 0 and the ID of the destination node. Is 24, and the hop count is 4.

Node 16, the attacker node receiving the RREQ message, modulates the number of hops contained in the RREQ message by 1 by decreasing the number of hops by one. Then, it transmits the modulated RREP message to nodes 15, 11, 17 and 21, which are neighbor nodes. Each neighbor node has a hop counting mode and a detection mode as the detection node, so that the attacker node can be detected.

The detection process performed at node 17 is as follows.

When node 17 receives the RREQ message from node 16, it operates the hop count mode to calculate the shortest hop number (| 0 to 16 |) between node 0, which is the starting node, and node 16, which is the previous node. At this time, the shortest hop number is four. Then, node 17 compares the shortest hop count calculated by operating the detection function with the 16's RREQ hop included in the RREQ message from node 16. As a result of the comparison, when the calculated shortest hop number is larger than the hop number included in the RREQ message from node 16, node 17 determines that node 16 is an attacker node. Here, since the calculated shortest hop number is 4 and the number of hops included in the RREQ message from node 16 is 3, node 17 determines node 16 as an attacker node.

Node 17 transmits the detection result to the management node, and the management node determines whether node 16 is a new node or a failed node is replaced. If node 16 is not a new node or a replacement of a failed node, the management node determines node 16 as an attacker. Then, the management node informs each detection node that node 16 is the attacker node, so that no routing path through node 16 is created.

7 is a diagram illustrating a process of detecting hop number modulation of an RREP message in a sensor network system including a detection node according to the present invention.

FIG. 7 illustrates a case in which a routing path from node 0 to node 24 is set in the sensor network system in which node 16 is an attacker node, and the routing path from node 0 to node 24 is node 0 ( Source node) → node 5 → node 10 → node 15 → node 16 (attack node) → node 17 → node 18 → node 19 → node 24 (destination node).

In this state, when node 12 wants to transmit CBR traffic to node 24, node 12 broadcasts an RREQ message to nodes 7, 13, 11, and 17, which are neighbor nodes. Here, node 17 located on the routing path to node 24 has information about the routing path to node 24, so when node 17 receives the RREQ message, it writes a RREP message directly without broadcasting to the neighbor node. To node 12. Since nodes 7 and 13 do not have information about the routing path to node 24, they are excluded from the process of detecting node 16, which is an attacker node.

On the other hand, node 11 neighboring node 16 increases the number of hops of the RREQ message received from node 12 and delivers it to node 16. Since the attacker node, node 16, is located on the routing path to node 24, the routing path to node 24 is stored in the routing table of node 16. Therefore, node 16 creates an RREP message and forwards it to node 11. At this time, since node 16 is an attacker node, the number of hops in the RREP message is reduced by 1 and then transferred to node 11.

Node 11 detects whether node 16 is an attacker node by operating hop count mode and detection mode before delivering RREP message received from node 16 to node 12. First, according to the operation of the absorption calculation mode, node 11 calculates the shortest hop number between node 16 and node 12 that delivered the RREP message, and calculates the number of hops included in the RREP message from node 16 and the calculated shortest hop number. Compare. In this case, the calculated shortest hop count is 2, and the hop count included in the RREP message from node 16 is 1. Accordingly, since the number of hops included in the RREP message from node 16 is smaller than the calculated shortest hop number, node 11 determines that node 16 is an attacker node.

Then, node 11 informs the management node that node 16 is the attacker node, and the management node determines that node 16 is the true attacker node. As a result of the determination, when node 16 is an attacker node, the management node informs each detection node that node 16 is an attacker node so that a routing path including node 16 is not generated.

Meanwhile, in the above-described embodiment, the process of detecting the attacker node only in the detection node neighboring the attacker node has been described, but it is a matter of course that other detection nodes can detect whether the attacker node is the attacker node. For example, in the embodiment illustrated in FIG. 7, if node 11 detects node 16 as an attacker node and then provides node 12 with a hop number modulated RREP message, node 12 once again calculates the number of hops. And detection mode can be used to determine whether node 16 is an attacker node. In this case, node 12 will determine that node 16 is the attacker node and deliver information about it to the management mode. Then, the management mode may determine once more whether node 16 is an attacker node based on the information provided from nodes 11 and 12. When the same information is provided from multiple detection nodes, the management mode can determine the attacker mode more accurately and quickly.

As described above, in the sensor network system, each node is provided with a detection mode that detects a modulation of routing information, thereby detecting an attacker node that modulates the number of hops when establishing a routing path. By detecting the attacker node, it is possible to prevent the establishment of a routing path via the attacker node and to prevent other attacks from being made through the routing path through the attacker node. Accordingly, not only the security can be improved by blocking the leakage or contamination of information through the attacker node, but also the increase in packet transmission delay time can be reduced.

1 is a configuration diagram of a sensor network showing a routing path established in a normal environment in which an attacker node does not exist.

2 is a configuration diagram of a sensor network showing a routing path established when an attacker node exists;

3 is a graph showing the number of packets passing through each node when each node is a normal node and an attacker node;

4 is a graph showing the ratio of the number of packets passing through each node when each node of FIG. 3 is a normal node and an attacker node;

5 is a graph illustrating packet transmission delay time of neighboring nodes when node 11 is an attacker node;

6 is a diagram illustrating a process of detecting hop number modulation of an RREQ message in a sensor network system including a detection node according to the present invention;

7 is a diagram illustrating a process of detecting hop number modulation of an RREP message in a sensor network system including a detection node according to the present invention.

Claims (14)

A sensor network system having a plurality of nodes arranged arbitrarily, At least one of the plurality of nodes is a detection node, The detection node, A hop count calculation mode for calculating a shortest hop count between the source node that generated the received message and the random node when a message is received from another node of the plurality of nodes; And And a detection mode for detecting whether the hop number included in the message is tampered with by comparing the shortest hop count calculated in the hop counting mode with the hop count included in the message received from the arbitrary node. Network system. The method of claim 1, The message received from any node is an RREQ message, The hop counting mode is, And calculating the shortest hop number on the shortest routing path between the source node that generated the RREQ message and the arbitrary node. The method of claim 1, The message received from any node is an RREP message, The hop counting mode is, And calculating the shortest hop number on the shortest routing path between the source node that generated the RREP message and the arbitrary node. The method according to claim 2 or 3, The hop count calculation mode is configured to calculate the shortest hop count using an ID of the source node and an ID of the arbitrary node. The method of claim 1, The detection mode is As a result of comparing the shortest hop count calculated in the hop count mode and the hop count included in the message transmitted from the arbitrary node, the hop count included in the message received from the random node is calculated in the hop count mode. And if smaller, determine the arbitrary node as an attacker node. The method of claim 5, At least one of the plurality of nodes is a management node The management node, Receive a detection message from the detection node that the node is an attacker node, determine again whether the node is an attacker node, and if it is determined that the node is an attacker node, obtain information about the node. The sensor network system, characterized in that for transmitting to other nodes belonging to the plurality of nodes. The method of claim 6, The management node, And the detection message from the detection node is ignored if the node is a new node or a failed node is replaced. An attack detection method of a sensor network system having a plurality of nodes randomly arranged Any one node of the plurality of nodes, Calculating a shortest hop count between the source node that generated the received message and the random node when the message is received from another node of the plurality of nodes; And Detecting whether the hop number included in the message is modulated by comparing the shortest hop count calculated in the step with the hop number included in the message received from the arbitrary node; Attack detection method. The method of claim 8, The message received from any node is an RREQ message, Computing the shortest hop number, And calculating the shortest hop count on the shortest routing path between the source node that generated the RREQ message and the arbitrary node. The method of claim 8, The message received from any node is an RREP message, Computing the shortest hop number, And calculating the shortest hop count on the shortest routing path between the source node that generated the RREP message and the arbitrary node. The method of claim 9 or 10, The calculating of the shortest hop count includes: calculating the shortest hop count using an ID of the source node and an ID of the arbitrary node. The method of claim 8, The detecting may include: comparing the shortest hop count calculated in the calculating of the shortest hop count with the hop count included in the message received from the arbitrary node, and the hop count included in the message received from the random node. And detecting the node as an attacker node when the number of the shortest hops is smaller than the shortest hop number calculated in the calculating of the shortest hops. The method of claim 12, In the plurality of nodes, And determining whether the node determined to be an attacker node corresponds to a new node or a case in which the failed node is replaced. The management node includes a management node. delete

Images