A Novel Diagnosis Scheme against Collusive False Data Injection Attack

Abstract

The collusive false data injection attack (CFDIA) is a false data injection attack (FIDA), in which false data are injected in a coordinated manner into some adjacent pairs of captured nodes of an attacked wireless sensor network (WSN). As a result, the defense of WSN against a CFDIA is much more difficult than defense against ordinary FDIA. This paper is devoted to identifying the compromised sensors of a well-behaved WSN under a CFDIA. By establishing a model for predicting the reading of a sensor and employing the principal component analysis (PCA) technique, we establish a criterion for judging whether an adjacent pair of sensors are consistent in terms of their readings. Inspired by the system-level fault diagnosis, we introduce a set of watchdogs into a WSN as comparators between adjacent pairs of sensors of the WSN, and we propose an algorithm for diagnosing the WSN based on the collection of the consistency outcomes. Simulation results show that the proposed diagnosis scheme achieves a higher probability of correct diagnosis.

1. Introduction

Wireless sensor networks (WSNs) are networks of wirelessly interconnected sensor nodes that collect data about the surrounding environment [1]. With the rapid popularization of Internet of Things (IoT) applications, WSNs have penetrated nearly all aspects of human life, ranging from industry and transportation to healthcare and military affairs [2]. Typically, sensors have limited energy, limited memory storage, and limited computing/communication capabilities, and are deployed in unattended and abominable environments. As a result, WSNs are vulnerable to a variety of cyber attacks. Consequently, the security of WSNs has received considerable attention from the network security community [3,4,5,6].

1.1. Problem Formulation

False data injection attacks (FDIAs) are cyber attacks on WSNs where false data are stealthily injected into the physically captured sensors [7,8]. FDIAs would render the compromised sensors to deliver wrong data to the base station. As a result, the decision-maker at the base station would make an incorrect decision, leading to serious consequences.

An attacker can obtain key information from a compromised sensor to gain control over it, which leads to a chance that proactive security mechanisms are useless in detecting FDIAs. Therefore, the best way to counteract FDIAs is detection by analyzing the measurements themselves. The spatiotemporal correlation of inter-measurements is a solution used in many studies to detect FDIAs [9,10,11]. Due to the continuity of physical phenomena, the measurements of each sensor are temporally correlative in time. Due to the high-density network topology of WSNs, the inter-measurements of adjacent sensors are spatially correlative. When compromised and genuine sensors coexist, the inconsistency of measurements will lead to correlation failure.

However, attackers aim to minimize the risk of being detected by employing resourceful and sophisticated strategies. Most previous works on FDIA detection have been focused on situations where independent false data are injected into different captured sensors [10,12,13,14,15,16]. In this paper, we consider FDIAs in which the readings of some adjacent pairs of compromised sensors are modified in a coordinated manner so that the false readings still look spatially–temporally correlated. We refer to such FDIAs as collusive FDIAs or simply CFDIAs. As a result, the conventional methods for detecting an ordinary FDIA fail when used to detect a CFDIA. Consequently, it is crucial to investigate the following problem:

CFDIA diagnosis problem: Identify the compromised sensor nodes under a CFDIA in a WSN with no natural anomalies.

Inspired by the system-level fault diagnosis, a solution based on hybrid detection will be created for the CFDIA diagnosis problem. To our knowledge, this is the first time such an attempt has been made.

1.2. Main Contributions

Our main contributions are sketched below.

• We define a new kind of false data injection attack to WSNs, i.e., a conclusive false data injection attack (CFDIA), and we propose a new problem (i.e., the CFDIA diagnosis problem) aiming to identify the compromised sensors in a WSN under a CFDIA.
• We establish an autoregressive moving average (ARMA) model for predicting the current reading of a sensor using its historical readings. Based on the prediction model and by employing the principal component analysis (PCA) technique, we establish a model for judging if an adjacent pair of sensors are consistent in terms of their readings.
• Inspired by the system-level fault diagnosis, we introduce a set of watchdogs in the WSN under CFDIA as comparators between adjacent pairs of sensors within their respective communication range. These watchdogs deliver their respective collections of consistency outcomes to the base station. The base station collects all the received consistency outcomes to form a complete syndrome.
• We design an algorithm for identifying the abnormal sensors based on the complete syndrome. Through extensive simulation experiments, we conclude that the diagnosis algorithm achieves a higher probability of correct diagnosis.

The subsequent materials are organized in this fashion: In Section 2, the related works are reviewed. In Section 3, some terms, notations, and assumptions are introduced. The diagnosis scheme is described in detail in Section 4, and the effectiveness of the diagnosis scheme is corroborated through simulation experiments in Section 5. Finally, this work is summarized by Section 6.

2. Related Work

In this section, we make comments on the previous work that is related to the present paper, aiming to highlight the novelty of our work.

2.1. System-Level Fault Diagnosis

The system-level fault diagnosis aims to identify faulty units in a computer system based on a collection of test/comparison outcomes between adjacent units [17,18]. There are two different system-level diagnosis approaches: the test-based diagnosis and comparison-based diagnosis [17].

In the test-based diagnosis, for each adjacent pair of units, one unit serves as the tester and the other as the testee; the tester assigns a computational job to the testee, the testee performs the computation and returns the computational result to the tester, and the tester compares the result with its own result and judges the testee to be fault-free or faulty according to whether the two results are identical or not. Finally, a diagnosis algorithm is performed based on the collection of test outcomes [17,19].

In the comparison-based diagnosis, each adjacent pair of units perform the same computation, and the computational results are compared. That the two results are identical implies that the two units are either both fault-free or faulty. On the contrary, that the two results are not identical implies that at least one of the two units is faulty. Finally, a diagnosis algorithm is performed based on the collection of comparison outcomes [18,20].

The system-level fault diagnosis has been applied to the detection of faulty sensors in WSNs [21,22,23,24]. Inspired by the system-level fault diagnosis, an algorithm for diagnosing the abnormal sensors in the WSN under a CFDIA based on the collection of the consistency outcomes is proposed without considering the existence of natural anomalies, and validates the effectiveness of the diagnosis algorithm through simulation experiments. To our knowledge, however, the system-level fault diagnosis has not been applied to the identification of compromised sensor nodes in WSNs under an FDIA, let alone the identification of captured sensors under a CFDIA.

2.2. FDIAs Detection of WSNs

FDIAs are known for their severe impact and are one of the widely studied cyber-attacks in smart grids, power systems, and WSNs [10,14]. In the research area of the FDIAs detection problem of WSNs, many studies focus on exploring techniques from the sensor measurements.

Ref. [25] proposed a generalized distributed anomaly detection scheme based on the spatio-temporal correlation of physical processes against FDIAs in WSNs. Ref. [26] presented a method combining a measurement check and authentication strategies to detect FDIAs in WSNs. Ref. [27] exploited the sensor data correlation in time and space to identify the falsified data in the industrial Internet-of-Things. Ref. [28] utilized the observed spatio-temporal and multivariate-attribute sensor correlations to detect FDIAs in WSNs. Ref. [29] addressed the issue of detecting FDIAs based on spatial correlation to dynamic WSNs. Ref. [30] suggested a method using temporal, spatial, and event-based correlations to prevent FDIAs in WSNs.

Few works cover detecting CFDIAs in WSNs. Ref. [31] revealed that wireless nodes usually have some correlation patterns in communication metrics, which can be used to defend against CFDIAs in WSNs. Ref. [32] proposed a wavelet transform method based on wavelet transform to detect CFDIAs. Ref. [33] exploited the spatio-temporal correlation of heterogeneous sensor data to detect CFDIAs in low-density WSNs. Since the detection of CFDIAs requires comparing measurements over a broader set of sensors, these efforts are based on a centralized detection scheme to provide a global view. However, a compromised node not only injects false data into itself, but it may also inject false data into routed packets, potentially leading to a higher false positive rate.

In this paper, we propose a hybrid detection scheme. We define watchdog as a kind of expensive dedicated hardware device that is deployed in the area monitored by the WSN in concern, is within the communication range of the base station serving the WSN, and can acquire the readings of the sensors that are within the communication range of the device. A set of watchdogs are deployed in the area for judging the consistency of adjacent pairs of sensors in terms of the spatial–temporal correlation of their readings. All the consistency outcomes are delivered directly to the base station. To our knowledge, a hybrid detection scheme has not yet been applied to the CFDIA diagnosis problem.

3. Preliminary Knowledge

3.1. WSNs with Watchdogs

Consider a WSN used for gathering a kind of environmental data within a specific area. Let $R_1$ denote the communication radius of the base station serving the WSN. Let $R_2$ denote the common communication radius of the sensors in the WSN. Let the undirected graph $G=(V,E)$ denote the topological structure of the WSN, i.e., $V=\{v_1,\cdots ,v_N\}$ stands for the set of sensors in the WSN, and $\{v_i,v_j\}\in E$ if and only if $v_i$ is within the communication range of $v_j$. Let $r_i\left(t\right)$ denote the measurement reading of the node $v_i$ at time t.

Define watchdog as a kind of expensive dedicated hardware device that is deployed in the area monitored by the WSN, is within the communication range of the base station, and can acquire the readings of the sensors that are within the communication range of the device. Suppose a set of watchdogs are deployed within the monitored area. Let $R_3$ denote the common communication radius of the watchdogs. Suppose $R_2<R_3<R_1$. Let $W=\{w_1,\cdots ,w_M\}$ denote the set of the watchdogs. Suppose the watchdogs are used for periodically acquiring the measurement readings of the sensors within their respective communication ranges. Let $S=\{1,2,\cdots ,K\}$ denote the set of time points at which the readings of the sensors are acquired by their respective neighboring watchdogs.

3.2. Collusive False Data Injection Attack

A collusive false data injection attack (CFDIA) is a false data injection attack in which the readings of some adjacent pairs of compromised sensors are modified in a coordinated manner so that the changed readings are still spatially–temporally correlated. Owing to the attacker’s limited budget, assume (i) the compromised nodes are less than normal nodes, and (ii) the compromised sensors are concentrated in a small area. Figure 1 illustrates a CFDIA to a toy WSN of seven nodes.

3.3. Autoregressive Moving Average Models

An autoregressive model builds on the assumption that there is a linear relationship between the current value of a variable and its own historical values. A moving average model assumes that the current value of a variable depends not only on the current information but also on previous information. The model obtained by combining an autoregressive model with a moving average model is referred to as an autoregressive moving average (ARMA) model [34]. An ARMA model of order $(p,q)$ is formulated as follows.

$$r\left(t\right)=\mu +\sum _{l=1}^p{\varphi }_{l}r(t-l)+\sum _{l=1}^q{\psi }_lϵ(t-l)+ϵ\left(t\right).$$

(1)

Here, $r\left(t\right)$ stands for the value of the variable r at time t; $\mu$, ${\varphi }_l$, and ${\psi }_l$ are model parameters; and $ϵ\left(t\right)$ stands for the value of the independent error at time t, which follows a Gaussian distribution with zero mean.

3.4. Principal Component Analysis

The principal component analysis (PCA) is a commonly used technique for reducing the dimensionality of large datasets and increasing data interpretability. The PCA creates new uncorrelated variables (the principal components) by solving an eigenvalue/eigenvector problem [35]. The PCA has been applied to FDIA detection [36,37].

4. A Diagnosis Scheme against CFDIA

In this section, we propose a diagnosis scheme against a CFDIA. The scheme consists of two phases: the syndrome generation phase and the CFDIA diagnosis phase, which are stated as follows.

• Phase I: Syndrome generation. In this phase, each watchdog collects a set of readings of the sensors monitored by the watchdog and conducts a spatio-temporal correlation analysis between each adjacent pair of sensors, forming a partial syndrome. All the watchdogs deliver their own partial syndromes directly to the base station. A (complete) syndrome is generated by merging the partial syndromes.
• Phase II: CFDIA Diagnosis. Taking the syndrome as input, perform an algorithm for diagnosing a CFDIA. As a result, the compromised nodes are identified.

Next, let us discuss the two phases in detail.

4.1. Syndrome Generation

4.1.1. Consistency Criterion

The syndrome on a WSN under a CFDIA refers to the collection of the consistency outcomes between adjacent pairs of nodes of the WSN. The syndrome is the basis of CFDIA diagnosis. The key to generating the syndrome is to establish a consistency criterion. For this purpose, we need to discuss temporal correlation and spatial correlation between adjacent pairs of nodes, respectively.

First, there is a temporal correlation of each node in terms of their readings. Let ${\tilde{r}}_i\left(t\right)$ denote the predicted value of $r_i\left(t\right)$. We assume that for $i=1,\cdots ,n$ and for all t, ${\tilde{r}}_i\left(t\right)$ obeys the following ARMA model of order $(p,q)$:

$${\tilde{r}}_i\left(t\right)={\mu }_i+\sum _{l=1}^p{\varphi }_l^i{r}_i(t-l)+\sum _{l=1}^q{\psi }_l^i{ϵ}_i(t-l)+{ϵ}_i\left(t\right).$$

(2)

The parameters in the model can be estimated using the historical data.

Remark 1. 

ARMA is used to model linear relationships, which is suitable for stationary stochastic processes. However, the presence of seasonality and trends in the time-series sensor readings may introduce nonlinear non-stationary sequences. Therefore, the time-series sensor readings need to be pre-processed before extracting the spatio-temporal correlation of adjacent nodes. There is a need for stationary identification. If the time-series sensor readings are not stationary, we can employ the differencing method on the time-series sensor readings to remove seasonality and trends.

Second, there is a spatial correlation between each adjacent pair of nodes in terms of their readings. We use the PCA to reveal the spatial correlation. Let ${\overline{r}}_i$(resp. ${\overline{r}}_j$) denote the mean of historical readings of $v_i$(resp. $v_j$). The correlation coefficient of the predicted readings of an adjacent pair of nodes, $v_i$ and $v_j$, is calculated as follows.

$${\delta }_{ij}=\frac{{\sum }_{t=1}^K({\tilde{r}}_i\left(t\right)-{\overline{r}}_i)({\tilde{r}}_j\left(t\right)-{\overline{r}}_j)}{K-1}.$$

(3)

The covariance matrix of the predicted readings of $v_i$ and $v_j$ reads

$${\Lambda }_{ij}=\left[\begin{array}{cc}{\delta }_{ii}& {\delta }_{ij}\\ {\delta }_{ji}& {\delta }_{jj}\end{array}\right].$$

(4)

Let ${\lambda }_{ij}^1$ (resp. ${\lambda }_{ij}^2$) denote the largest (resp. second largest) eigenvalue of the matrix ${\Lambda }_{ij}$. Let ${\overrightarrow{\mu }}_{ij}^1$ (resp. ${\overrightarrow{\mu }}_{ij}^2$) denote the unit eigenvector of ${\Lambda }_{ij}$ associated with ${\lambda }_{ij}^1$ (resp. ${\lambda }_{ij}^2$).

$${\Lambda }_{ij}{\overrightarrow{\mu }}_{ij}^1={\lambda }_{ij}^1{\overrightarrow{\mu }}_{ij}^1,{\Lambda }_{ij}{\overrightarrow{\mu }}_{ij}^2={\lambda }_{ij}^2{\overrightarrow{\mu }}_{ij}^2.$$

(5)

Assume ${\overrightarrow{\mu }}_{ij}^1$ and ${\overrightarrow{\mu }}_{ij}^2$ are linearly independent. Then, ${\overrightarrow{\mu }}_{ij}^1$ is orthogonal to ${\overrightarrow{\mu }}_{ij}^2$.

The consistency ellipse at time t with the confidence degree $1-\theta$ (here, $\theta \le 0.1$), denoted as ${\Gamma }_{ij}^{1-\theta }\left(t\right)$, can be calculated by taking $({\tilde{r}}_i\left(t\right),{\tilde{r}}_j\left(t\right))$ as its center, taking ${\overrightarrow{\mu }}_{ij}^1$ (resp. ${\overrightarrow{\mu }}_{ij}^2$) as the direction of its major axis (resp. minor axis), taking ${\lambda }_{ij}^1$ (resp. ${\lambda }_{ij}^2$) as the ratio of its long radius (resp. its short radius), and choosing the confidence degree $1-\theta$. Let ${\overline{\Gamma }}_{ij}^{1-\theta }\left(t\right)$ denote the closed region surrounded by ${\Gamma }_{ij}^{1-\theta }\left(t\right)$. Then, ${\overline{\Gamma }}_{ij}^{1-\theta }\left(t\right)$ is the confidence region with the confidence degree $1-\theta$. Consequently, we present the following:

Consistency criterion: An adjacent pair of nodes, $v_i$ and $v_j$, are consistent at time t with the confidence degree $1-\theta$ if $({\tilde{r}}_i\left(t\right),{\tilde{r}}_j\left(t\right))\in {\overline{\Gamma }}_{ij}^{1-\theta }\left(t\right)$. Otherwise, they are inconsistent with the confidence degree $1-\theta$.

See Figure 2a for a schematic explanation of the consistency criterion. For brevity, we remove “at time t” and “with confidence degree $1-\theta$” in the criterion.

4.1.2. Syndrome and Partial Syndrome

Let $\sigma (u,v)=0$ (resp. 1) denote that the adjacent pair of nodes, u and v, are consistent (resp. inconsistent). We refer to the collection

$$\sigma =\left\{\sigma \right(u,v):\{u,v\}\in E\}$$

(6)

as the syndrome on the WSN. For each adjacent pair of nodes, u and v, we make the following reasonable assumptions:

• If u and v are both normal, then $\sigma (u,v)=0$ with probability $1-\theta$.
• If one of u and v is normal and the other is abnormal, then $\sigma (u,v)=1$ with probability $1-\theta$.
• If u and v are both abnormal, then $\sigma (u,v)=0$ or 1.

For each watchdog $w_m$, let $V_m$ denote the set of nodes that are monitored by $w_m$. We refer to the collection

$${\sigma }_m=\{\sigma (u,v):u,v\in V_m,\{u,v\}\in E\}$$

(7)

as the partial syndrome associated with $w_m$.

Each watchdog can acquire the partial syndrome associated with it. All partial syndromes can be delivered by the watchdogs to the base station. Finally, the syndrome can be generated at the base station by merging the received partial syndromes.

4.2. CFDIA Diagnosis

We intend to identify all the abnormal nodes of a WSN by interpreting the syndrome. For this purpose, we need to introduce the following terms and notations.

Definition 1. 

Let p be the a priori probability of a node of WSN being compromised.

Definition 2. 

Let σ be a syndrome on the WSN $G=(V,E)$, $e\in E$. The edge e is referred to as a 0-edge or a 1-edge according to $\sigma \left(e\right)$ = 0 or 1.

Definition 3. 

Let σ be a syndrome on the WSN $G=(V,E)$. The 0-subgraph of G is defined as a subgraph of G, denoted $G_0=(V,E_0)$, such that $E_0$ is the set of 0-edges of G.

Definition 4. 

Let σ be a syndrome on the WSN $G=(V,E)$, $G_0=(V,E_0)$ the 0-subgraph of G. Let $\mathcal{H}=\{H_i=(U_i,E_i):1\le i\le r\}$ be the collection of connected components of $G_0$. The 1-condensed graph of G is defined as a graph $G^{*}=(U^{*},E^{*})$ such that (i) $U^{*}=\{u_1^{*},\cdots ,u_r^{*}\}$, (ii) $\{u_i^{*},u_j^{*}\}\in E^{*}$ if and only if there is a 1-edge of G that connects a node in $U_i$ with a node in $U_j$.

Based on the previously introduced assumptions about the relationship between the states of two adjacent nodes and their consistency, we have the following results.

Theorem 1. 

Let σ be a syndrome on the WSN $G=(V,E)$, $e=\{u,v\}\in E$. If $p<<0.5$, the following assertions hold true:

1. 

$\sigma (u,v)=0$ implies u and v are either both normal with a higher probability (w.h.p.) or both abnormal w.h.p.

2. 

$\sigma (u,v)=1$ implies at least one of u and v is abnormal w.h.p.

The following theorem is a direct consequence of this theorem.

Theorem 2. 

Let σ be a syndrome on the WSN $G=(V,E)$. Let $G_0=(V,E_0)$ be the 0-subgraph of G. Let $\mathcal{H}=\{H_i=(U_i,E_i):1\le i\le r\}$ be the set of connected components of $G_0$. If $p<<0.5$, the following assertions hold true:

1. 

For $1\le i\le r$, either (i) the nodes in $U_i$ are all normal w.h.p., or (ii) the nodes in $U_i$ are all abnormal w.h.p.

2. 

If there is a 1-edge connecting $U_i$ with $U_j$, then either (i) the nodes in $U_i$ are all normal and the nodes in $U_j$ are all abnormal w.h.p, or (ii) the nodes in $U_j$ are all abnormal and the nodes in $U_j$ are all normal w.h.p.

Based on the theorem, we present an algorithm (i.e., the CFDIA algorithm given in Algorithm 1) for identifying the abnormal nodes in a WSN under a CFDIA. The correctness of the algorithm is guaranteed by the following observation.

Algorithm 1 CFDIA-DIAG.

Input: A WSN $G=(V,E)$ under CFDIA, a syndrome $\sigma$ on G.

Output: A subset $V_a\subseteq V$ that is diagnosed to be the set of abnormal nodes.

1: Find the 0-subgraph of G, denoted $G_0=(V,E_0)$; 2: Find all the connected components of $G_0$, denoted $H_i=(U_i,E_i)$, $i=1,\cdots ,r$; 3: Find the 1-condensed graph of G, denoted $G^{*}=(U^{*},E^{*})$, where $U^{*}=\{u_1^{*},\cdots ,u_r^{*}\}$; 4: // label all nodes of $G^{*}$ with Z; // 5: for each $u^{*}\in U^{*}$ do 6:   $l\left(u^{*}\right)\leftarrow Z$; 7: // label all nodes of $G^{*}$ with X or Y through depth-first search; // 8: Let Q be an empty queue; 9: Choose a node $u^{*}$ with maximum degree from $U^{*}$; 10: $l\left(u^{*}\right)\leftarrow X$; $Q\leftarrow Q+u^{*}$; 11: while $G^{*}$ has a node with label Z do 12:   fetch node $u^{*}$ with the most nodes from Q; $Q\leftarrow Q-u^{*}$; 13:   for each $v^{*}\in U^{*}$ that is adjacent to $u^{*}$ do 14:     if  $l\left(v^{*}\right)=Z$  then 15:       $Q\leftarrow Q+v^{*}$; 16:       if  $l\left(u^{*}\right)=X$  then 17:        $l\left(v^{*}\right)\leftarrow Y$; 18:       else 19:        $l\left(v^{*}\right)\leftarrow X$; 20: // determine $V_a$; // 21: if  $|{\bigcup }_{l\left(u_i^{*}\right)=X}{U}_i|\le |{\bigcup }_{l\left(u_i^{*}\right)=Y}{U}_i|$  then 22:   $V_a\leftarrow {\bigcup }_{l\left(u_i^{*}\right)=X}{U}_i$; 23: else 24:   $V_a\leftarrow {\bigcup }_{l\left(u_i^{*}\right)=Y}{U}_i$;    return $V_a$.

Theorem 3. 

Consider a connected WSN under a CFDIA. If $p<<0.5$, then the CFDIA algorithm identifies the abnormal nodes correctly w.h.p.

As the time overhead of the CFDIA-DIAG algorithm is dominated by the $O\left(\right|V|+|E\left|\right)$ time needed to perform the search-first search in the algorithm, we obtain that the worst-case time complexity of the diagnosis algorithm is $O\left(\right|V|+|E\left|\right)$. Additionally, the space complexity of the diagnosis algorithm is $O\left(\right|V|+|E\left|\right)$ as well.

5. Effectiveness of the Proposed Diagnosis Algorithm

This section is devoted to investigating the effectiveness of the CFDIA-DIAG algorithm through simulation experiments.

5.1. Metrics of Effectiveness of a Diagnosis Algorithm

In order to measure the effectiveness of the CFDIA algorithm, below let us introduce a pair of metrics of effectiveness of a diagnosis algorithm.

Definition 5. 

Let $G=(V,E)$ be a WSN under a CFDIA, A be the set of abnormal nodes of G, and σ be a syndrome produced by A. Let $DIAG$ be a diagnosis algorithm. Let B be the set of nodes that are diagnosed to be abnormal by running $DIAG$ on $(G,\sigma )$.

1. 

The diagnosis accuracy of $DIAG$ with respect to (w.r.t.) $(G,A,\sigma )$ is defined as

$$D{A}_{DIAG}(G,A,\sigma )=\frac{\left|B\right|}{\left|A\right|}.$$

(8)

2. 

The false positive rate of $DIAG$ w.r.t. $(G,A,\sigma )$ is defined as

$$FP{R}_{DIAG}(G,A,\sigma )=\frac{|B\bigcap (V-A\left)\right|}{|V-A|}.$$

(9)

3. 

The false negative rate of $DIAG$ w.r.t. $(G,A,\sigma )$ is defined as

$$FN{R}_{DIAG}(G,A,\sigma )=\frac{|A\bigcap (V-B\left)\right|}{\left|A\right|}.$$

(10)

5.2. Experiment Preparation

First, consider two additional diagnosis algorithms. The first one is almost the same as the CFDIA-DIAG algorithm, with the only exception of the sentence in line 10 of the CFDIA-DIAG algorithm being replaced with the sentence “arbitrarily choose a node $u^{*}$ from $U^{*}$”. We refer to this diagnosis algorithm as the Random-Search algorithm. The second is based on the Correlation-Voting solution proposed in Ref. [33].

Second, consider two different kinds of FDIAs: the simple FDIA (SFDIA) and the CFDIA. For the former, the readings of the compromised sensors are all enhanced by a larger fraction. For the latter, the readings of each adjacent pair of compromised sensors are changed in a coordinated manner.

Third, consider three synthetic WSNs, denoted $G_1$, $G_2$, and $G_3$, of sensor nodes that are with a communication radius of 20 m and are placed randomly in a square region of size $120\times 120$ m², $G_1$; $G_2$, and $G_3$ have 50 nodes, 100 nodes, and 150 nodes, respectively. For each normal node $v_i$ and any time t, assume $r_i\left(t\right)$ follows the Gaussian distribution $G({\mu }_i,{\sigma }^2)$, where ${\mu }_i\in \{10,15,20\}$, ${\sigma }^2=1$, and the correlation coefficient of the readings of each adjacent pair of sensors is 0.9. Suppose a set of nine watchdogs with a communication radius of 40 m are deployed regularly in the region. See Figure 3 for the distribution of $V_1$ and nine watchdogs.

Fourth, consider a real-world WSN, $G_4$, of 45 effective sensors used for gathering the environmental PM2.5 data, which is located in Krakow, Poland [38]. Here, the common sensing rate of the sensors is one reading per hour, and the average degree of the WSN is 21.16.

5.3. Experiments and Analysis of Experimental Results

Experiment 1. 

Consider the WSN $G_2$. Let $p\in \mathcal{P}=\{0.03,0.06,\cdots ,0.3\}$. Let $A_p$ be a set of abnormal nodes randomly produced based on p. Let ${\sigma }_p^c$ be the syndrome produced by $A_p$ under the CFDIA that the readings of each of the compromised nodes are enhanced or reduced by 10%, and ${\sigma }_p^s$ the syndrome produced by $A_p$ under the SFDIA that the readings of all compromised are enhanced by 40%.

1. 

For each $p\in \mathcal{P}$, running CFDIA-DIAG, Random-Search, and Correlation-Voting on $(G_2,{\sigma }_p^c)$, we obtain their $DA$, $FPR$, and $FNR$, which are shown in Figure 4a–c. It is seen that (i) the diagnosis accuracy of CFDIA-DIAG is higher than those of the other two algorithms, and (ii) the false positive rate and false negative rate of CFDIA-DIAG is lower than those of the other two algorithms. Hence, we conclude that CFDIA-DIAG is more effective than the other two algorithms in the CFDIA situation.

2. 

For each $p\in \mathcal{P}$, running CFDIA-DIAG, Random-Search, and Correlation-Voting on $(G_2,{\sigma }_p^s)$, we obtain their $DA$, $FPR$, and $FNR$, which are shown in Figure 4d–f. It is seen that (i) the diagnosis accuracy of CFDIA-DIAG is higher than those of the other two algorithms, and (ii) the false positive rate and false negative rate of CFDIA-DIAG is lower than those of the other two algorithms. Hence, we conclude that CFDIA-DIAG is more effective than the other two algorithms in the SFDIA situation.

Experiment 2. 

Consider the three WSNs: $G_1$, $G_2$, and $G_3$. Let $p\in \mathcal{P}=\{0.03,0.06,\cdots ,0.3\}$. Let $A_{p,i}$ be a set of abnormal nodes of $G_i$ randomly produced based on p. Let ${\sigma }_{p,i}^c$ be the syndrome on $G_i$ produced by $A_{p,i}$ under the CFDIA that the readings of each of the compromised nodes are enhanced or reduced by 10%; ${\sigma }_{p,i}^s$ the syndrome on $G_i$ produced by $A_{p,i}$ under the SFDIA that the readings of all the compromised are enhanced by 40%.

1. 

For each $p\in \mathcal{P}$ and each $i\in \{1,2,3\}$, running CFDIA-DIAG on $(G_i,{\sigma }_{p,i}^c)$, we obtain its $DA$, $FPR$, and $FNR$, which are shown in Figure 5a–c. It is seen that (i) the diagnosis accuracy of CFDIA-DIAG is higher when run on denser WSNs, and (ii) the false positive rate and false negative rate of CFDIA-DIAG is lower when run on denser WSNs. Hence, we conclude that in the CFDIA situation, CFDIA-DIAG is more effective when run on dense WSNs.

2. 

For each $p\in \mathcal{P}$ and each $i\in \{1,2,3\}$, running CFDIA-DIAG on $(G_i,{\sigma }_{p,i}^s)$, we obtain its $DA$, $FPR$, and $FNR$, which are shown in Figure 5d–f. It is seen that (i) the diagnosis accuracy of CFDIA-DIAG is higher when run on denser WSNs, and (ii) the false positive rate and false negative rate of CFDIA-DIAG is lower when run on denser WSNs. Hence, we conclude that in the SFDIA situation, CFDIA-DIAG is more effective when run on dense WSNs.

Experiment 3. 

Consider the WSN $G_4$. The real-world time-series sensor readings are stationary by first difference. Let $p\in \mathcal{P}=\{0.03,0.06,\cdots ,0.3\}$. Let $A_p$ be a set of abnormal nodes randomly produced based on p. Let ${\sigma }_p^c$ be the syndrome produced by $A_p$ under the CFDIA that the current reading of each of the compromised nodes is replaced with its largest reading in the past $K-1$ time points, and ${\sigma }_p^s$ the syndrome produced by $A_p$ under the SFDIA that the readings of all compromised are enhanced by 100%.

1. 

For each $p\in \mathcal{P}$, running CFDIA-DIAG, Random-Search, and Correlation-Voting on $(G_4,{\sigma }_p^c)$, we obtain their $DA$, $FPR$, and $FNR$, which are shown in Figure 6a–c. It is seen that (i) the diagnosis accuracy of CFDIA-DIAG is higher than those of the other two algorithms, and (ii) the false positive rate and false negative rate of CFDIA-DIAG is lower than those of the other two algorithms. Again, we conclude that CFDIA-DIAG is more effective than the other two algorithms in the CFDIA situation.

2. 

For each $p\in \mathcal{P}$, running CFDIA-DIAG, Random-Search, and Correlation-Voting on $(G_4,{\sigma }_p^s)$, we obtain their $DA$, $FPR$, and $FNR$, which are shown in Figure 6d–f. It is seen that (i) the diagnosis accuracy of CFDIA-DIAG is higher than those of the other two algorithms, and (ii) the false positive rate and false negative rate of CFDIA-DIAG is lower than those of the other two algorithms. Additionally, we conclude that CFDIA-DIAG is more effective than the other two algorithms in the SFDIA situation.

6. Conclusions and Future Work

A novel diagnosis scheme against a conclusive false data injection attack (CFDIA) has been proposed. First, a set of special watchdogs are deployed in a WSN under a CFDIA to collect consistency outcomes of adjacent pairs of sensor nodes and to deliver them to the base station, forming a syndrome. Second, inspired by the system-level fault diagnosis, a CFDIA diagnosis algorithm is presented. The effectiveness of the algorithm is corroborated through simulation experiments. By executing the diagnosis algorithm on the syndrome received by the base station, the set of compromised nodes is identified correctly with a higher probability.

According to the above three metrics of effectiveness, the method proposed in this paper is better than the compared method, but there are some limitations. Firstly, this paper considers only scenarios where attacks exist, and it is not yet designed to distinguish between malicious attacks and natural anomalies deviating from wide-sense stationary jointly Gaussian processes, including faults, disruptive events, and major disruptions. Secondly, the system-level fault diagnosis should be generalized to probabilistic system-level diagnoses to improve on the diagnosis accuracy and reduce the false positive rate and false negative rate of our proposed diagnosis algorithm [39]. Therefore, in future works, we should further optimize the method. Additionally, the proposed diagnosis algorithm should be extended to the diagnosis of mobile networks under a CFDIA [40,41]. Watchdogs can be made mobile to strike a balance between diagnosis accuracy and energy consumption, and the work can be done in the framework of game theory [42,43]. Finally, the methodology developed in the present paper may be applied to some other cybersecurity issues such as defense against advanced persistent threats [44,45].