Protocols for Secure Communication in Wireless Sensor Networks

82 Chapter 3. A Security Model for Wireless Sensor Networks
Random Spread Distribution
This model assumes that the adversary picks arbitrary nodes randomly from
the network and takes control over them. This is probably a very unrealistic
model if applied to an already deployed network. It requires that the adversary
breaks into a single sensor node and then randomly moves to another node.
If there are measures to track such movements, this attack bears a high risk
of detection. Considering the large number of nodes in a sensor network, a
single node is only of very limited value to the attacker. This value is probably
exceeded by the cost of moving from one node to the next, which makes the
attack uneconomical.
However, the following scenario may be more realistic. Assume that the
adversary gains access to a set of nodes before deployment and manages to
replace the program code on these nodes with his own. The nodes will then
be randomly deployed on the network area, and the adversary ends up with a
number of randomly distributed nodes he has control over.
The advantage of this attack is that the adversary has access to nodes distributed
throughout the whole network area, which allows him to monitor a
large portion of the message traffic with relatively few nodes. In this regard,
the attack is efficient for eavesdropping and monitoring purposes. However,
active attacks are not very effective, as the amount of data that can be injected
by a few randomly distributed nodes is small compared to the total amount of
data in the network. Also, a single compromised node surrounded by legitimate
nodes is more likely to be expelled when showing abnormal behaviour or
reporting data with a high divergence from its neighbours.
Concentrated Distribution
When an already deployed sensor network is being attacked, the attacker might
start at a certain position and try to subvert as many nodes around that position
as possible. This would allow him to control all message traffic that is going
into or out of that area. The cost for moving around (and the involved risk of
detection) is amortized over a larger number of compromised nodes, thus this
attack mode is more efficient than randomly moving around and picking out
single nodes.
As a simple formal model of this type of attacks, we assume a starting position
and a function f that describes the probability with which a node in a
certain distance from the starting position is being compromised. At the starting
position itself, this probability is equal to a success probability p0 with
0 ≤ p0 ≤ 1, i.e. f (0) = p0. With increasing distance from the center, this