基于流量预测的 WSN 入侵检测技术

摘要

In wireless sensor networks,in view of that the internal attacks impose serious threats on network security and normal operation, such as causing the network congestion and huge energy consumption and so on,we proposed a traffic prediction-based intrusion detection technology.First the technology uses autoregressive moving average model (ARMA)to build the ARMA (2,1)traffic forecasting model for nodes,then it uses the predicted traffic value to get the range of packet reception rate passing through the nodes,finally,it achieves the effect of detection by comparing whether the actual packet reception rate exceeds the forecasting range.Experimental results showed that under the same message playback rate condition,compared with single ARMA model,to use this technology had higher detection rate and lower false alarm rate,and meanwhile reduced the energy consumption of network nodes.%在无线传感器网络（WSN），针对内部攻击严重威胁网络的安全和正常运行，如造成网络拥塞、能量的大量消耗等问题，提出基于流量预测的入侵检测技术。该技术首先利用自回归滑动平均模型 ARMA（Autoregressive Moving Average）为节点建立 AR-MA（2，1）流量预测模型，然后利用预测的流量值来得到通过节点的流量接收率范围，最后通过比较实际流量接收率是否超出预测范围来达到检测的效果。实验结果表明，和单独使用 ARMA 模型相比，在相同报文重放率条件下，采用该技术有更高的检测率和更低的误报警率，同时减少了网络节点的能量消耗。