Zigbee-Based Intrusion Detection System for Wormhole Attack in Internet of Things

Internet of Things (IoT) has grown rapidly in recent years, making it possible to integrate a wireless network of sensors into existing infrastructures through internet access. The majority of researchers in this field estimate that there will be over 30 billion connected devices by 2025. IoT is used in many demanding applications like smart homes, smart cities, smart healthcare, smart agriculture and smart grids [1, 2].

IoT networks consist of multiple devices with different security features. Hence maintaining information security is challenging, resulting in a larger security gap. In addition, it is difficult to implement security measures, such as strong cryptographic algorithms, because IoT devices have restricted processing power and memory due to their resource-constrained nature. While numerous research studies have demonstrated vulnerabilities and security threats associated with IoT network, the potentially damaging effect is on the integrity, availability, and confidentiality of the information [3]. Many security attacks are inserted in IoT network to cause unwanted behaviours in IoT elements. Due to its importance for national security, e-commerce and data protection, securing the network infrastructure has become a high priority [4, 5].

In IoT, the network layer is a target of some of these threats like sinkhole attack, selective forwarding attack and wormhole attack. Sinkhole and selective forwarding attacks modify the data and intercepts the network in real-time. A wormhole attack disrupts routing processes by inserting fake routing information and incorrect routing paths into legitimate nodes [6-8]. Among all wormhole attack is one of the most dangerous attacks taking place at the network layer. In order to protect end users' privacy and data from wormhole attacks, we need to address and reduce these security gaps. In this paper, we have developed a system that detects the presence of wormhole attack in the IoT network [9, 10]. The proposed system IoT network uses 6LoWPAN [11, 12], RPL [13-15] and AODV protocol for communication [16-18].

This research paper demonstrates the detection of wormhole attack with physical implementation using hardware components. As network attacks become more complex and sophisticated, stronger and more effective solutions are required. There has been a noticeable decline in the performance of security software in recent years because of the increased amount of data that needs to be processed. In order to overcome this performance gap, hardware units can be used to accelerate security task realization. This research paper describes the hardware implementation of wormhole attack detection.

For hardware implementation, we have used temperature sensors LM35 [19], Zigbee modules [20] as communication standard, Arduino-nano and Arduino-mega boards as controllers that run the attack detection algorithms [21, 22]. In IoT, a wormhole attack is detected by considering the symptoms like an abrupt increase in transmitted packets and frequent changes in the routing table. When the attack is inserted in the network, attacker nodes misguide the legitimate nodes to send data packets through them which may cover long distances. The presence of attack ultimately reduces the strength of the signal by lowering the Received Signal Strength Indicator (RSSI) value to the threshold value. If the RSSI values are below -60 dBm then the attack is confirmed. The Arduino processor declares the existence of the wormhole attack along with the attacker node ID. Once attacker nodes are identified then they are removed from the network.

A range-based localization is an easy and cost-effective localization technique that measures RSSI to estimate distance. It is mostly used from 0 to -120 dBm. When the RSSI value is closer to 0, it indicates the good quality of the received signal [23-27]. Each sensor node has a radio that measures the signal strength, so when the data is transferred between nodes, the RSSI values can also be shared. As it does not require any extra hardware, the existing network will not be modified and the size will remain the same. Eq. (1) gives the distance of transmitter and receiver nodes where the strength of the signal is used to calculate it. If the signal is weakened, the distance estimation changes through which we can understand the presence of a wormhole attack. In this case, the RSSI value represents received power, and N represents constant, based on the environmental factor between 2 to 4. In current experimentation, it is considered as ‘2’.

Distance $=10\left(\frac{\text { Transmitted Power-Received Power }}{10 * \mathrm{~N}}\right)$           (1)

1.1 Wormhole attack

In the presence of a wormhole attack, a tunnel between two distant nodes is formed to pretend they are closer to each other and only one hop away. When a packet is transmitted, attacker nodes attract the traffic by advertising less hop count and when packets come at either of the nodes, they involve intermediate legitimate nodes for packet transmission. Despite not being part of the communication, these legitimate nodes get involved in transmission due to the wormhole attack and drain their batteries which is not good for resource-constrained nodes in IoT. It is difficult to detect this attack at an early stage. Its presence is identified after a significant loss. The key to preventing wormhole attacks is to design strong IDS systems that detect the attack and the attacker nodes as soon as possible [28-30]. In this paper, a wormhole attack detection system using hardware is discussed which detects wormhole attack efficiently and gives a good True Positive Detection Rate and optimum False Positive Detection Rate. Furthermore, it gives a very good result when we calculate accuracy, Mathew's coefficient of correlation, and F1-score.

As a result of wormhole attacks, path delay between networks increases and hop count decreases abruptly. In presence of wormhole attack, data packets are received from faraway nodes and the number of neighbor requests is increased. Additionally, some links are more frequently utilized than others. During the development of the IDS for detecting wormhole attacks, these symptoms are taken into consideration. In our system, we have considered the RSSI value of the received packet. As this value changes when the above symptoms are present in the network. The strength of the signal is checked when there is no attack. It is compared with the strength of the received packet when a wormhole attack is present. When there is a change in the RSSI value beyond the threshold value, the presence of wormhole attack is marked.

The organization of the rest of the paper is as follows: Section 2 discusses hardware implementation of the wormhole attack detection. In section 3, we discuss about the simulation of nodes in the ‘Zigbee simulation’ window. Section 4, ‘Wormhole attack activation and detection algorithm’ explains the algorithms for the activation and detection of wormhole attack. In section 5, ‘Experimental set-up’, the hardware interfacing is discussed. Section 6 contains a brief conclusion of the final part of the paper.

Figure 2 shows the connection diagram of the nodes in the ZigBee simulation window. It shows one coordinator node and other normal nodes having physically connected. If any connection problem is present, then this window helps to identify it.

3.1 RSSI values variations without and with attack

Figure 3(a), shows the response of RSSI values without and with the attack. In Figure 3(a), when there is no attack, RSSI values are higher than -60 dBm and no loss of packets is observed with 100% efficiency.

2222.png

Figure 2. Connection diagram of the nodes in ZigBee simulation window

3a.jpg

Figure 3(a). RSSI Values when no attack

Once the attack is launched, the response is observed as shown in Figure 3(b) where RSSI values reduce and give the output lower than -80 dBm with packet loss and efficiency as 77%.

3b.jpg

Figure 3(b). RSSI values in presence of attack

In the absence of an attack, temperature from the sensors with their node ID and RSSI values is observed. A coordinator node monitors the activity of all other nodes in the network. These nodes are identified with their unique hardware ID. The coordinator node and other nodes share the same PAN ID as they are part of a single network. Attacker nodes use the same PAN ID to enter the network. When they become part of the system, they advertise that they are closer to the coordinator node and other nodes can transmit the data through them. When the RSSI of the packets are sent through the attacker nodes, the RSSI value reduces which is an indication of the longer route than the original route.

Figure 4 shows the connection of legitimate nodes, the border router and the attacker node. When the attacker node is inserted in the network, it gets immediately detected. In the set-up, ten nodes act as legitimate nodes, two attacker nodes and one border router node are used. When the RSSI value reduces than -70 dBm, the presence of attack is declared. With the help of the hardware address of the attacker node, attacker nodes are identified.

tu_pian_4.png

Figure 4. Attack detection with hardware implementation

5.1 Results and observations

To check the effectiveness of the proposed system, we have checked the Attack Detection Rate and Security Evaluation Metrics. We have taken the base of the Confusion Matrix to calculate these values. It is discussed in the next section.

5.1.1 Confusion matrix

We have used a confusion matrix to check the performance of the implemented IDS. The confusion matrix is shown in Figure 5.

tu_pian_5.png

Figure 5. Confusion matrix

As shown in the matrix there are two classes: Actual and predicted. Based on the outcome we get four outputs. Those are,

• TP: True Positive: Predicted values correctly predicted as actual positive
• FP: Predicted values incorrectly predicted an actual positive. i.e., Negative values predicted as positive
• FN: False Negative: Positive values predicted as negative
• TN: True Negative: Predicted values correctly predicted as an actual negative

These values are used to calculate the Accuracy, F1-score and Mathews Coefficient of Correlation (MCC) of the implemented IDS as discussed in the next section.

5.1.2 Attack detection rate

The set-up has run from 3 to 20 nodes to observe the True-Positive Detection Rate (TPR) and False-Positive Detection Rate (FPR). It is noted that in all cases system has detected wormhole attack with 100% accuracy. Thus a conclusion is made that the implemented system is solved the purpose of wormhole attack detection.

In a few cases, where number of nodes is more, the implemented system gives the indication for presence of the attack where in reality there is no attack is present. This increases the FPR [36].

For attack detection, various parameters are considered such as, TPR, FPR, Accuracy, F1-score, MCC. These terms are calculated as shown in below equations.

$\mathrm{TPR}=\frac{\mathrm{TP}}{\mathrm{TP}+\mathrm{FN}}$       (2)

where, TP is True positive which means attack is correctly identified. FN is False Negative that means though attack is present but it is not identified. Ideally TPR must be 100% or nearer to it.

where,

TP - Attack detected

FN - Attack not detected

FP - No attack still attack detected

TN - No attack no Detection

TPR - True-Positive Detection Rate

FPR - False Positive Detection Rate

$F P R=\frac{F P}{F P+T N}$        (3)

where, FP is False Positive that means the system predicts the presence of attack when there is no attack present. And TN is True Negative which means there is no attack and system has predicted the absentee of attack correctly. Ideally, TPR must be 0% or nearer to it.

For hardware implementation, the network is formed with legitimate nodes, attacker nodes and one coordinator node. For experimentation, the number of legitimate nodes is considered from 3 to 20 and the developed algorithm is applied on networked nodes. Table 1 gives the observations for said number of nodes. After experimentation, TPR and FPR are calculated as per Eqns. (2) and (3) respectively. It is observed and concluded that TPR in all cases is 100%. The graph shown in Figure 6 elaborates the attack detection rates. Here we can see that TPR is 100% (Which is ideal) for all the cases which indicates that for the number of nodes from 3 to 20, every time attack is present it is detected. However, FPR has increased slightly as nodes increased (Ideally it must be 0), indicating that as network size increases, falsely identified attackers are also increasing.

tu_pian_6.png

Figure 6. Detection rates for hardware implementation

• Security evaluation metrics

We have considered Accuracy, F1 score and Mathews Coefficient of Correlation (MCC) to evaluate the wormhole attack detection IDS under the Security Evaluation Technique [36-38].

i. Accuracy: Accuracy is how effectively wormhole attack is detected. It is given by Eq. (4).

Accuracy $=\frac{\mathrm{TP}+\mathrm{TN}}{\mathrm{TP}+\mathrm{TN}+\mathrm{FP}+\mathrm{FN}}$        (4)

ii. F1-Score: The harmonic mean of recall and precision is F1-score. When it is 1, precision and recall are perfect. Else when it is 0, they are worst. It is given by Eq. (5).

$\mathrm{F} 1$ Score $=\frac{2 * \mathrm{TP}}{2 * \mathrm{TP}+\mathrm{FP}+\mathrm{FN}}$             (5)

iii. MCC: MCC gives correlation between actual and predicted wormhole nodes which has range from -1 to 1. When MCC has value nearer to 1 it indicates better efficiency.

$\mathrm{MCC}=\frac{\mathrm{TP}+\mathrm{TN}+\mathrm{FP}+\mathrm{FN}}{\sqrt{(\mathrm{TP}+\mathrm{FP}) *(\mathrm{TP}+\mathrm{FN})+(\mathrm{TN}+\mathrm{FP}) *(\mathrm{TN}+\mathrm{FN})}}$           (6)

5.1.3 Security-based metrics

Accuracy, F1 score and Mathew’s correlation coefficient (MCC) are calculated using Eqns. (4), (5) and (6) respectively by referring the values from Table 1. The security-based metrics analysis is as shown in Figure 7.

tu_pian_7.png

Figure 7. Analysis of security-based metrics

The average value of Accuracy is 96%, whereas the average value of the F1 score and MCC is 96.16% and 92.71% respectively. In summary, these values indicate that the designed IDS works well at detecting the wormhole attack. Based on Figure 5 and Figure 6, we can conclude that the research carried out in this paper provides the most efficient means of detecting wormhole attack. In this example, we obtained optimum values for TPRs and FPRs. We also got very good results for accuracy, F1 score and MCC.