Multimetric Online Intrusion Detection in Software-Defined Wireless Sensor Networks

Software-defined wireless sensor networks have attracted considerable attention in recent years as they simplify the network management and provide the framework to automate infrastructure sharing. On the other hand, the centralization and planes' separation can turn SDNs vulnerable to new types of denial of service attacks. Existing intrusion detection approaches are not in general suitable for restricted networks or do not achieve optimal detection rates. This work aims at fulfilling both requirements by using a new lightweight, multimetric, online change point detector to monitor performance metrics that are impacted when the network is under attack. There are two major novelties in the proposed detector referring to previous works: first, we move to a purely online detector, secondly, we monitor in parallel multiple metrics, increasing the detection vector space to different types of attack. Our tests show that intrusion detection monitoring control overhead and data packets delivery rate in a SDWSN results in enhanced detection rates over 96% in all topologies and levels of attacks. We finally show that with a high probability (exceeding 89% in all cases) it is possible to identify the “type” of the attack.