基于流量预测的WSN入侵检测技术  

WSN INTRUSION DETECTION TECHNOLOGY BASED ON TRAFFIC PREDICTION

作　　者：彭军[1] 余强[1] 何明星[1] 

机构地区：[1]西华大学数学与计算机学院,四川成都610039

出　　处：《计算机应用与软件》2016年第2期310-313,共4页Computer Applications and Software

基　　金：四川省国际合作项目(2009HH0009);国家科技部支撑计划项目(2011BAH26B00);四川省信息安全创新团队建设项目(13TD0005);面向物联网的入侵检测关键技术研究项目(szjj2013-018)

摘　　要：在无线传感器网络(WSN),针对内部攻击严重威胁网络的安全和正常运行,如造成网络拥塞、能量的大量消耗等问题,提出基于流量预测的入侵检测技术。该技术首先利用自回归滑动平均模型ARMA(Autoregressive Moving Average)为节点建立ARMA(2,1)流量预测模型,然后利用预测的流量值来得到通过节点的流量接收率范围,最后通过比较实际流量接收率是否超出预测范围来达到检测的效果。实验结果表明,和单独使用ARMA模型相比,在相同报文重放率条件下,采用该技术有更高的检测率和更低的误报警率,同时减少了网络节点的能量消耗。In wireless sensor networks, in view of that the internal attacks impose serious threats on network security and normal operation, such as causing the network congestion and huge energy consumption and so on, we proposed a traffic prediction-based intrusion detection techn^l~gy＂ First the technology uses autoregressive moving average model （ARMA） to build the ARMA （2,1） traffic forecasting model for nodes, then it uses the predicted traffic value to get the range of packet reception rate passing through the nodes, finally, it achieves the effect of detection by comparing whether the actual packet reception rate exceeds the forecasting range. Experimental results showed that under the same message playback rate condition, compared with single ARMA model, to use this technology had higher detection rate and lower false alarm rate, and meanwhile reduced the energy consumption of network nodes.

关 键 词：无线传感器网络 内部攻击 入侵检测 自回归滑动模型 流量接收率 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]