An Integrated Rule-Based and Machine Learning Technique for Efficient DoS Attack Detection in WSN

Wireless Sensor Networks (WSNs) are highly distributed, lightweight nodes, deployed in large numbers to monitor systems. Because of the nature of wireless, there are various challenges for security and threats. An effective anomaly detection system is required to find out these attacks, especially Denial of Service (DoS) attacks. These attacks are the major threat to any system connected to the internet. To identify the DoS attacks in WSN, Machine Learning (ML) algorithms helps to increase the security measures and prevent attacks; however, makes the system computationally slower. An integrated rule-based and ML technique is proposed to quickly identify the DoS attacks. Rule-based technique is used to differentiate between normal flow and attack, particularly DoS attacks. If any flow is an ‘attack’ then ML models are used to detect types of DoS attack patterns such as TDMA, Blackhole, Grayhole, and Flooding. We have used a decision tree (DT) and support vector machine (SVM) classifier with WSN-DS dataset to train the proposed model. Analysis of the classifiers shows that DT outperforms with a high accuracy to detect the types of DoS attack. The proposed method is fast and efficient, since it avoids the use of ML model if flow is ‘normal’.