Analysis of the Deployment Quality for Intrusion Detection in Wireless Sensor Networks

The intrusion detection application in a homogeneous wireless sensor network is defined as a mechanism to detect unauthorized intrusions or anomalous moving attackers in a field of interest. The quality of deterministic sensor nodes deployment can be determined sufficiently by a rigorous analysis before the deployment. However, when random deployment is required, determining the deployment quality becomes challenging. An area may require that multiple nodes monitor each point from the sensing area; this constraint is known as k-coverage where k is the number of nodes. The deployment quality of sensor nodes depends directly on node density and sensing range; mainly a random sensor nodes deployment is required. The major question is centred around the problem of network coverage, how can we guarantee that each point of the sensing area is covered by the required number of sensor nodes and what a sufficient condition to guarantee the network coverage? To deal with this, probabilistic intrusion detection models are adopted, called single/multi-sensing detection, and the deployment quality issue is surveyed and analysed in terms of coverage.We evaluate the capability of our probabilistic model in homogeneous wireless sensor network, in terms of sensing range, node density, and intrusion distance.


Introduction
Advances in technological developments at the microapplication, the radio communication, and the integration of microprocessors have made it possible to develop a new range of small low-cost electronic devices, called sensor nodes.The latter may be deployed in large numbers to form an intelligent and autonomous wireless sensor network (WSN) which can be used for a wide variety of applications dealing with monitoring, control, and surveillance.Each sensor node senses the environment field of interest, which seems the most time inaccessible and communicates the collected data to the sink, where the end-user can access them [1].In this paper, we focus on the surveillance wireless sensors network applications, such as detecting an unauthorized or unusual moving intruder in a field of interest.These critical applications require characterizing the WSN parameters that do not exist in traditional ad hoc networks.Intrusion detection model in a homogeneous wireless sensor network introduce parameters, sensing range, and node density, for each point of a field of interest must be within the sensing range of at least one sensor node.In a sensing covered field, the WSN must be able to adapt to changing network topology and environment conditions.An intruder may be detected by single-sensor node or multi sensor nodes that are modeled by single-sensing detection and multi-sensing detection in homogeneous wireless sensor network.Some works are targeted at particular applications, but the central idea is still centered around a coverage issue.The problem of coverage network is described by several authors in [2,3], how well an area is monitored or tracked by sensor nodes, and authors in [4,5] also derived analytical expressions to quantify the coverage enhancing the deployment quality because the network coverage concept is a measure of the quality of service.Efficient distributed algorithms are proposed in [6,7] to solve the coverage network problem with optimally reduced energy consumption in WSNs.

Motivations and Problem
Statement.These issues are motivated by the following simple reasons including random network topology where all sensor nodes are randomly deployed in a region; this implies the efficient deployment of the required coverage.Specifically, given a monitoring region, how can we guarantee that each point of the region is covered by the required number of sensor nodes?In other words, we need to recognize which areas are covered by enough sensors in order to enhance the probability of intrusion detection and an intruder does not exceed the threshold distance.In addition, the energy conservation is a critical challenge in WSNs due to the limitations of wireless sensors on the energy supply, the available storage space, and the computational capacity.This implies that the network must have self-organizing capabilities.It is important to place or select the effective number of sensor nodes in coverage network; sensor power can be put on/off periodically in order to extend the whole WSN lifetime.

Contributions and Organization.
The major contributions of this paper can be summarized as follows: developing a probabilistic approach by deriving analytical expressions to characterize the topological properties of network coverage, designing and analysing the intrusion detection probability in a homogeneous wireless sensor network, and taking into account the various parameters such as sensing range, node density, node availability, and intrusion distance.This is to enhance the quality of sensor nodes deployment.We investigate our model for intrusion detection in WSNs to single-sensing and multi-sensing detection.
The remainder of the paper is organized as follows.In Section 2, some preliminaries and models are presented and then intrusion detection and network topology are reviewed.Next we analytically evaluate the intrusion detection model in a homogeneous wireless sensor network in Section 3 while, in Section 4, we present the simulation results and their analysis.Finally, conclusions are drawn in Section 5.

Intrusion Detection Model and Network Topology
For more comprehensive review on intrusion detection model in WSNs, we describe in this section some key definitions and describe the network topology and degrees and coverage and communication model.

Preliminaries and
We can note that each point located in  ol can be covered by both   and   nodes.An example of  ol and  col surface areas and communication between sensor nodes   and   are represented in Figure 1.
Definition 5 (neighbouring nodes).The neighbouring information of each node   from a graph  is defined as where

Degrees and Coverage.
The goal of monitoring an area of interest is to have each location in the sensing area within the sensing range of at least one sensor node.Depending on the application scenarios, several coverage models have been proposed in the literature.An area may require that multiple sensor nodes monitor each point in the sensing area [8].The constraint is known as -coverage where  represents the number of nodes.We can define any convex region  of R 2 with a coverage degree , where every point of the considered region is covered by at least  nodes [9].Given the surface area  and specified by the application (either before or after deployment) as illustrated in Figure 2, what would be the required value of the sensing range  SENS to achieve a specified coverage degree ,  > 0? In practice, a network with a higher degree of coverage can achieve higher sensing accuracy and be more robust against sensing failure.An example of -coverage is illustrated in Figure 1: the middle picture (b) shows an example of redundant node, where the monitored area by the node   is totally overlapped by nodes  1 ,  2 , and  3 .Therefore, it is important to place or select the effective number of sensor nodes to cover the same monitored area as much as possible without diminishing the overall field coverage and specified coverage degree ,  > 0. The authors in [10] extend the problem to connected -coverage which they define as the minimum number of sensors that must stay active, so that each point in the field is -covered and every one of these sensors must be connected to each other.Data accuracy depends on the size of the connected component that contains the sink.It reaches the highest value when the sink belongs to the largest connected component of the network.Thus, high-quality coverage requires that all source sensors be connected to the sink.One of the most interesting questions regarding the connectivity of random WSNs concerns finding limiting regimes for which the connectivity becomes almost sure to occur.Typically these regimes involve the number of nodes and transmitting range becoming large [8,11].In other words, connectivity of WSNs should be so defined as to take into consideration the inherent structure of this type of network.
In this paper, we assume that any two nodes   and   can directly communicate with each other if their Euclidean distance is less than the transmitting range  TRANS (i.e., |  −   | ≤  TRANS ) as shown in the last picture (c) from Figure 1.A point  is covered by a node   if the Euclidean distance between the point  and the node   is less than the sensing range  SENS of the node   .
Given a coverage region  and a nodes coverage degree , the goal of an integrated coverage and connectivity configuration is maximizing the number of nodes that are scheduled to sleep under the constraint that the remaining nodes must guarantee:  is at least -covered and all active nodes are connected.

Intrusion Detection Model in a Homogeneous Wireless Sensor Network
Intrusion detection in wireless sensor networks is defined as a mechanism to detect unauthorized intrusions or anomalous moving attackers.The quality of deterministic nodes deployment can be determined sufficiently by analysis before the deployment.However, when random deployment is required, determining the deployment quality becomes challenging [10].To assess the deployment quality of sensor nodes, appropriate measures can be employed that reveal the weaknesses in the coverage of WSNs, with respect to the success ratio and intrusion detection probability.For this purpose, it is a fundamental issue to characterize WSN parameters such as node density and sensing range in terms of high detection probability.In this section, several probabilistic intrusion detection models are adopted and deployment quality issue is surveyed and analysed in terms of coverage.

Sensing Model Probability.
We consider a random network topology as discussed in Section 2.2 where all nodes are randomly deployed in field of interest.The deployment quality increases with the increase in the detection probability.The sensing model probability is generally closely coupled with the specific sensor application and the type of sensor device used [12,13].We adopt a sensing model probability where a sensor node can detect any events located in the sensing area.All sensor nodes are assumed to be homogeneous, and they have the same sensing range.For a uniformly distributed sensor network of node density , we denote the number of sensor node, which deployed in the surface area  area , by .For each sensor node, the probability of each sensor node, within the sensing range  SENS distance of a point, is a Bernoulli trial, where the probability of success is Hence, the number of sensor nodes, within distance  SENS of a point, forms a Binomial distribution.Moreover, for large  and small , this Binomial distribution can be represented by a Poisson process.Then, the mean value of the equivalent Poisson process is The sensing model probability that an intruder is detected by  sensor nodes follows the Poisson distribution; it is given by the following formula: where  is the area swept by intruder following a trajectory .We assume that the intruder starts from a random point in the sensing area and moves in a random fashion as illustrated in Figure 3: Hence, the previous probability can further be represented by Intrusion Distance .As a result of random movement of the intruder, the intrusion distance  can be derived as an arc length of a parametric curve that is formulated by the following equation: Proof.A parametric curve  can be thought of as trajectory of a point that moves through the plane with coordinates (, ) = ((), ()), where  and  belong to  1 class functions of the parameter .For each value of  from the interval [, ], we get a point  = ((), ()) of the curve and we divide the curve denoted  into  points: The corresponding points in the arc have the coordinates ((  ), (  )) where  ≤   ≤ , so two consecutive points are separated by a distance equal to More generally, we approximate the length of the arc  by inscribing a polygonal arc (i.e., made up of straight line segments) and adding up the lengths of the segments.
where  is the Riemann sum of the function √  () 2 +   () 2 from the point (, ()) to a point (, ()).This formula can also be expressed in the following way: Node Density .Density of nodes is a crucial parameter sensor nodes deployment to require the intrusion detection quality of WSN applications.The deployment quality depends directly on node density; mainly a random nodes deployment is required [14,15].The network connectivity probability becomes higher as the density of nodes increases, even though the degree of coverage also increases.To improve the accuracy of node density, we take into account the partial density as shown in the following formula: where  is the sum of the partial densities.The number of active nodes remains steady with respect to node density for the same requested coverage degree.

Single-Sensing Detection.
The probability that no sensor in a sensing area can detect an event is  =  − .The complement of  is the probability that there is at least one sensor node which detects an event.This sensing model probability can be represented as According to the intrusion scenario, the intruder starts from a random point in the sensing area and moves in a random fashion as illustrated in Figure 3.The probability that an intruder does not exceed the threshold distance  THR is An Intrusion Detection Probability with Distance Threshold  THR = 0 in a Homogeneous WSN.We consider  nodes randomly distributed over a square region  of edge length  in the set R 2 following a uniform distribution.We consider also that all sensors are static once the homogeneous WSN has been deployed.If we want to be sure that any intruder can be immediately detected, we use the following formula: where  threshold sensing is a threshold probability.We must set the sensing range of all sensor nodes as follows:

Multi-Sensing Detection.
In the WSN applications, the number of required sensors depends on the coverage quality; it can be determined sufficiently in advance by analysis of nodes deployment.To achieve a specified coverage degree  ( > 0), we derive the probability  that an intruder can be detected within the threshold intrusion distance  THR , by the multi-sensing detection model in the following formula: is the surface swept by intruder following a trajectory : is the sum of the partial densities: While increasing the sensing range and the number of nodes per unit, the intrusion detection probability in singlesensing and multi-sensing increases.All events that happen in the network will be covered.According to the formulas discussed above, the optimal values of sensing range and node density can be determined in advance to totally cover a sensing area.

Node Availability.
In a dense network, sensing areas of different nodes may be similar to their neighbor nodes, so they will transmit redundant information and the WSN total energy consumption will increase.Therefore, it is important to place or select the effective number of sensor nodes, to cover the same monitored area as much as possible without diminishing the overall field coverage.Thus, we must identify the redundant nodes in a dense network and change their operating mode between sleep and active modes.We can express the efficient number of nodes which can be deployed to cover the sensing area by node availability rate  as a variable in event detection probability .We can efficiently reduce the energy consumption in most of the WSN applications and extend the whole network lifetime, when sensor power can be put on/off periodically.Thus, it is appropriate to take into account the node availability rate  in our analysis.Each sensor node can decide whether to become active with probability  or to move to the sleep mode with probability 1 −  which means to be off in every sensing period.Thus, the sensing model probability that exactly  sensor nodes detect an intruder is given by the formula where  is the surface swept by intruder following a trajectory  and  = ∑  =1 (  /  ) is the sum of the partial densities.Consider The intrusion distance  can be derived as an arc length of a parametric curve: In the single-sensing, the probability that an intruder can be detected without exceeding the threshold distance  THR in homogeneous WSNs of node density , sensing range  SENS , and node availability  is determined by In the multi-sensing, the probability  that an intruder can be detected within threshold intrusion distance  THR in -sensing in homogeneous WSNs of node density , sensing range  SENS , and node availability  is determined by

Discussions Results
In this section, we evaluate our intrusion detection model probability in a homogeneous wireless sensor network by using MATLAB software.According to the intrusion scenario as described in Section 2, we evaluate our model probability in single-sensing and multi-sensing intrusion detection in terms of sensing range, node density, and intrusion distance.We consider a random wireless sensor network composed of  static sensor nodes, which are independent and distributed uniformly in a square field.The results illustrated in Figure 4 show the intrusion detection probability  and that there is at least one sensor node, which detects an intruder in surface area :  = 100 × 100 m 2 versus  = 200 × 200 m 2 ; it is determined by the node number  and the sensing range  SENS .Intrusion detection may need a large sensing range or a high node number, thus increasing the WSN deployment cost.We can note that if we increase the node number  or the sensing range  SENS , the probability to cover an intrusion which happens in the network increases too.This is because the increase of sensing range or node number significantly enhances the network coverage.However, increasing more  or  SENS the probability attend 1 and remains constant, will not affect the robustness of detection.Consequently, for a given value of sensing range  SENS , we can find the optimal node number which can be deployed to cover efficiently the controlled region.This node number and sensing range will be the optimal values, which must be used to totally cover an area of interest.Figure 5 shows the curves of intrusion detection probability model as a function of the intrusion distance for different values of node availability rate .It is obvious that if the intrusion distance  increases, the detection probability  increases too.In the normal cycle, the node availability  is usually less than 1.0; it is considered to be satisfied to monitor an area as much as possible without diminishing the overall field coverage.If an intruder is detected by a node, an alarming message is broadcasting over the entire network, to improve the detection efficiency by assuring the network connectivity; it is illustrated by node availability rate  = 1.0.
We plot in Figure 6 the detection probability in multisensing detection as a function of intrusion distance.The detection probability increases with the increase of the intrusion distance.At the same time, the single-sensing detection probability ( = 1) is higher than that of multi-sensing  detection ( = 2 and  = 3).This is because the multi-sensing detection imposes a more strict requirement on detecting an intruder in the network; at least  = 2 ( = 3) sensors are required.

Conclusion
In this paper, we have investigated the fundamental characteristics for a random deployment of sensor nodes on the surveillance WSN applications, such as detecting an unauthorized intruder in a field of interest.Intrusion detection model is proposed to address the problem of network coverage and enhance the deployment quality.Therefore, each point of the sensor network is within the sensing range of at least one sensor node.We developed a probabilistic model, by deriving analytical expressions to characterize the topological properties of network coverage, designing and analysing the intrusion detection probability in a homogeneous wireless sensor network, and taking into account the various parameters such as sensing range, node density, node availability, and intrusion distance.We investigate our model for intrusion detection in WSNs to single/multi-sensing detection.Our results enable us to design and analyse the homogeneous WSNs and help us to select the critical parameters of network in order to meet the WSN application requirements.

Figure 3 :
Figure 3: A simple intrusion scenario: an intruder starts from a random point in the WSN and moves in a random fashion and sweeps the surface area  following a trajectory .

Figure 4 :Figure 5 :
Figure 4: Intrusion detection probability that there is at least one node which detects an intruder, as a function of node number  and sensing range  SENS in surface area :  = 100 × 100 m 2 versus  = 200 × 200 m 2 .
ModelsDefinition 1 (sensing range).The sensing range of a node   is a disk of radius  SENS , centred at   and defined byDisk  ( SENS ) = {  ∈ R 2 :        −        ≤  SENS } ,(1)where| −   | stands for the Euclidean distance between   and   .Definition 2 (transmission range).The transmission range of a node   is a disk of radius  TRANS , centred at   and defined by Disk  ( TRANS ) = {  ∈ R 2 :        −        ≤  TRANS } .(2) Definition 3 (collaborating sensors).Consider two nodes   and   located at   and   , respectively.Let us note that   is the distance between   and   .The collaborating set of   and   is defined as the union between    and    .Besides,   and   are said to be collaborating if and only if   = |  −  | ≤ 2 SENS , where  SENS is the sensing range.In general, the collaborating sensor set   is  col (  ) = ⋃ {  :|  −  |≤2 SENS } Definition 4 (overlapped area).The overlapped area  ol of nodes   and   is defined as the intersection region between    and    areas that is formulated by the following equation: −  | is the Euclidean distance between nodes   and   .N  represents the set of indexes of the nodes which send information to node   .Throughout this paper, we consider  nodes randomly distributed over a square region  of edge length  in set R 2 following a uniform distribution; we assume that any two nodes (  ,   ) are directly connected if the Euclidean distance   is smaller than or equal to the transmission range  TRANS (i.e.,   = |  − | ≤  TRANS ); only bidirectional links are considered.A region  is said to be covered, if every point in  is at distance at most  SENS from at least one sensor node.In homogeneous WSNs, we assume that every node has the same sensing range  SENS and the same transmission  TRANS .The resulting graph is called the covering-reachability graph and is denoted by (,  SENS ,  TRANS ) where  is a set of nodes indexed with  = {1, . . ., }.