Sensor Network Anomaly Detection Model by cascading Inverse Weight Clustering and C5.0 Decision Tree

Abstract

Wireless Sensor Network is a network of integrated sensors responsible for environmental sensing, data processing and communication with other sensors and the base station while consuming low power. At the same time WSNs are vulnerable to security breaches, attacks and information leakage. Anomaly detection techniques are used to detect such activities over the network that does not conform to the normal behavior of the network communication. Anomaly detection in wireless sensor network using Inverse Weighted Clustering and C5.0 Decision tree, a method for classifying anomalous and normal activities have been proposed. The IWC clustering method is first used to partition the training instances into k clusters using Euclidean distance similarity. On each cluster, representing a density region of normal or anomaly instances, decision trees are built using C5.0 decision tree algorithm. The decision tree on each cluster refined the decision boundaries by learning the subgroups within the cluster. The experiment was carried out on three datasets (University of North Carolina Greensboro (UNCG), Intel Berkeley Research Lab (IBRL) and Bharatpur Airport WSN). The results show that proposed method achieved detection rate of 98.9% at false alarm-rate of 0.31% on IBRL; detection rate of 99.57 % at false alarm-rate of 0.35% on Bharatpur Airport.