A Cooperative Statistical Approach for Abnormal Node Detection with Adversary Resistance

Abstract

Distinguishing abnormal nodes from those with normal packet loss in clusters helps reduce the loss of clustered network resources. The detection performance of existing detection schemes is limited by the techniques to quantify node behaviors, and most schemes cannot avoid being misled by the falsified information. This paper presents a novel probabilistic abnormal node detection scheme CSD -- Cooperative Statistical Detection -- for accurate and efficient detection in the existence of falsified detection data in clustered networks. Specifically, employing the likelihood ratio test (LRT) based detection method to measure node forwarding behaviors, we propose a modified Z-score based falsification-resistant mechanism to filter out falsifications. We show that both the false alarm and missed detection probabilities can decrease exponentially if and only if the transmissions from the nodes falsifying the data are less than half of the total. Furthermore, the optimal threshold of the modified Z-score method is derived, which guarantees perfect detection of our CSD under any falsification strategy in the proposed detection model. Evaluation results validate the effectiveness, robustness, and superiority of our scheme compared to the state-of-the-art.