Protocols for Secure Communication in Wireless Sensor Networks

3.3. Adversary Characteristics 83
probability is likely to decrease, while the exact progression of f depends on
the adversary’s capabilities. As a very simple approximation, we consider a
maximum radius r and a linearly decreasing success probability:
f (d) = p0 1 − d
r
for 0 ≤ d ≤ r and f (d) = 0 for d > r. This means that up to a distance r, the
success probability of the attacker decreases linearly. Beyond that distance, the
attacker is inactive.
We may consider different f -functions applied at the starting point. These
could vary the radius r, or the success probability might depend on the direction
from the starting position or other parameters such as the environmental
conditions of the deployment area.
Hitpoints Distribution
We can use multiple starting points to model an adversary that becomes active
in several locations. A number of these “hitpoints” throughout the network are
selected according to a certain (random) distribution. The nodes in the hitpoint
areas could be targeted sequentially or in parallel. When we refer to this attack
type, we use the same f -function for all hitpoints.
Partitioning Distribution
This attack mode has the goal of partitioning the network, leading to control
over the message flow between the parts of the network. This is achieved by
subverting nodes along a path that partitions the network. Depending on the
topology of the network and the objectives of the adversary, certain areas are
more vulnerable to this attack. A “bottleneck” in the topology of the network
would provide a good location for mounting such an attack, as the number
of nodes required for a partition is very small. In most cases, the attack path
is probably determined by the objectives of the adversary. For example, the
adversary may attempt to separate a certain area from the rest of the network in
order to be able to perform certain actions in this area undetected.
If the attacker blocks the message flow out of some part of the network completely,
this may be detected due to the lack of reports from that area. However,
it may give the attacker enough time to perform his activities. When the block is
canceled afterwards, new reports from that area are again unsuspicious. However,
if there are end-to-end security mechanisms between some nodes within
the blocked area and outside of it, this attack may still be detectable. We will
present such a mechanism in chapter 6.