A novel two-stage Multi-crieteria evaluation for internal attack in WSN

Wireless sensor networks (WSNs) are an emerging technology for collecting data about the natural or built environment. They consist of low-cost and multifunctional resources and autonomous nodes comprising the appropriate sensors along with computational devices that transmit and receive data wirelessly. The nodes work independently to function on environmental conditions. Normally each node cooperates with its neighbours to wirelessly transmit their readings via a deployed network. A wireless sensor network can be used for many different applications range from a military implementation in the battlefield, an environmental monitoring, playing an function in health sector as well as emergency response of surveillance. With its nature and application scenario WSN had drawn a great attention to the increasing applications. In order to ensure its functionality especially in malicious environments, security mechanisms become essential. Internal attacks have gained prominence and pose most challenging threats to all WSNs. Althougḩ a number of works has been done to secure a WSN but internal attacks have gained little attention. The conventional cryptographic technique does not give the appropriate security to save the network from internal attack that cause by abnormally behaved legitimate nodes. In this paper, we have proposed a new approach for detecting internal attack in two stages with multi-criteria evaluation. A prior to the stage of implementation we have checked whether the targeted node is in transmission range or not then in the current stage, we will make a misbehavior judgment with Abnormal Behavior Identification Mechanism (ABIM) by using cosine similarity for abnormality. Secondly, we combined the multiple pieces of evidences made by the internal attacker or the abnormally behaved nodes evidenced by information sources and then using the Dempester-Shafer Theory (DST) to make final decision. The advantage of this method is that it does not need the knowledge about the normal or malicious node in advance