Toward an Optimal Anomaly Detection Pattern in Wireless Sensor Networks

Over the past years, various anomaly detection techniques for Wireless Sensor Networks (WSNs) have been proposed in the literature. These detectors are generally only effective against particular security threats and thus many detectors have to be executed to ensure high-level security in WSNs. Due to the hardware limitations, WSNs cannot execute all of these detectors simultaneously. Thus, WSNs have to appropriately schedule when to execute a particular detector and when to execute the others. This paper presents an optimized solution by providing a unified framework that combines the usage of a costly yet highly-accurate detector, called an oracle detector, and a low cost and less-accurate detector, called a partial detector. A detection pattern is created and optimized using a first-order approximation method. Simulation results show that combining several detectors into an optimized pattern is essential to provide low execution time overhead.