Quentin Monnet
email: quentin.monnet@lacl.fr

Youcef Hammal
email: hammal@lsi-usthb.dz

Lynda Mokdad
email: lynda.mokdad@u-pec.fr

Jalel Ben-Othman

Fair Election of Monitoring Nodes in WSNs

Keywords: Wireless sensor networks, Reliability, availability, and serviceability, Energy-aware systems

In this era of big data, of quantified self and of smart cities, wireless sensor networks are meant to be used every day, for all sort of applications. Made of tiny sensors, they collect data and communicate through wireless technologies. Because they may take part in sensitive or military applications, security is an essential matter in such networks. Confidentiality and authenticity can be ensured by the use of dedicated mechanisms. Focusing on availability, we propose here a new practical approach to protect the network against denial of service attacks thanks to the use of traffic monitoring agents called cNodes. The approach uses a fair election process of cNodes in accordance with classical criteria related to residual energies and the presence of compromised nodes which may have greedy or jamming behaviors. Results obtained from simulations show that this method is effective both in terms of detection and of energy conservation.

I. INTRODUCTION

A wireless sensor network (WSN) is a self-organizing and multi-hop network consisting of low-cost and small wireless devices (sensor nodes) that are disseminated over a geographical area for gathering data on some physical phenomena. Delivery of sensory data for process and analysis to a base station is based on a collaborative work of the nodes in a multi-hop fashion.

WSNs may be deployed in hostile or inaccessible environments raising many challenges to ensure that sensors work effectively and survive long enough to fulfil their assignments. Actually, WSN nodes are battery powered and are often required to operate for long periods. Once its battery is exhausted, a node is out of service and network performance is degraded. Wireless transmission and reception make significant demands on available energy in addition to the need to process data, sense the environment et caetera. Thus energy efficiency is an important concern in protocol design for multihop networks like WSNs and it has strong influence on the design of protocols (to a lesser extent, required computational capabilities and memory are also issues to consider, because both are restricted for sensors that must embed cheap and lowconsuming hardware).

Therefore, communications in a WSN shall abide to strict time-constrained rules, as specified by the protocol stack used in the network (such as IEEE 802.15.4 TM for instance [1]). When correctly applied, the protocol for the medium access control (MAC) sublayer reduces collisions and improves the transmission rate. However, its correct operating mode is based upon a distributed algorithm that is executed locally on each node to determine the periods of access to the channel. In other terms, it is assumed that all WSN components will abide to the given specifications. Unfortunately, such networks may be implemented in untrusted environments where misbehaving parties can deviate from the protocol specification and achieve better performances at the expense of honest participants, or use jamming techniques which prevent legitimate peers to achieve their communications. Denial of service (DoS) attacks precisely use such changes in these protocol parameters and in the operating mode of some nodes, thereby leading to harmful effects on the overall network performance.

In a previous work [START_REF] Hammal | Timed automata based modeling and verification of denial of service attacks in wireless sensor networks[END_REF] an approach to deal with such risks was given. It relies on the use of monitoring nodes (called "cNodes") to protect a clustered wireless sensor network against various denial of service attacks. Clustering algorithms are commonly used in an attempt to ease deployment and managing and to better scale wireless sensor networks. They create partitions (clusters) inside the network (see example on Figure 1), each having a cluster head acting as a proxy between the other nodes inside the cluster and the rest of the network. cNodes are responsible for listening to the traffic around them and for signaling misbehaving nodes to their cluster heads. They have to remain in listening state all the time they endorse this role. Hence the way they are selected among the nodes can be decisive in regard to detection efficiency as well as load repartition inside clusters. So as to improve this load balancing, retained selection process of those control nodes is based on the residual energies of sensors. But as compromised nodes can make false statements about their residual energies, they can easily become cNodes, thereby decreasing the odds of being detected. This issue was addressed by introducing a second role of surveillance ("vNodes") responsible for watching over the cNodes and for matching their announced consumption according to a mathematical model.

However, such a proposal raises a recurrent problem since such vNodes themselves have to be selected by the cluster heads according to some criteria that can be faked by compromised nodes. Obviously, it seems inefficient to introduce again a new kind of control role over vNodes and to continue with the same problem over and over.

Therefore, we propose in this article a new efficient approach based on a fair election principle. Its purpose is to provide a secure way to designate cNodes (i.e. to prevent compromised nodes to be selected) while consuming as little energy as possible, and to efficiently balance the load between all nodes of the cluster. Our approach uses an iterative process to always select one kind of control nodes which report to their cluster heads the communications undertaken by their neighboring sensors. In order to detect suspicious and compromised nodes, the cluster heads compute the consumed energy of each node from declared residual energies and then compare it with that assessed according to reported communications from its related cNodes. Furthermore, in the first iteration of the process, all nodes are considered as cNodes and used for controlling each other in order to eliminate suspicious nodes as much as possible. Each cNode is selected henceforth among sane nodes in such a way that each node is controlled by at least two cNodes. During next iterations, cNodes act as control nodes monitoring surrounding simple sensors as well as other neighboring cNodes (in other words they also endorse the role of vNodes from formerly proposed approach), thus increasing the likelihood to detect suspicious nodes even though they were selected before as cNodes.

The remainder of this paper is organized as follows: Section II presents some related work about discussed topics. We expose our model in Section III, and then the simulation results obtained with the ns-2 tool in Section IV. At last Section V sums up our contribution and brings perspectives for future work.

II. RELATED WORK

This section is divided into three parts: security in wireless sensor networks, denial of service specific mechanisms, and clustering algorithms and energy preservation.

A. Security in WSNs

Denial of service is not the only type of attacks a WSN should resist to. Security in general in sensor networks has attracted quite a lot of interest during the last years. Hence it has been the subject of many studies in literature, as well as several state-of-the-art articles [START_REF] Dak | A literature survey on security challenges in VANETs[END_REF], [START_REF] Alam | Analysis of security threats in wireless sensor network[END_REF].

Confidentiality and integrity must be ensured to prevent attackers to access to, or to tamper sensitive data. A number of solutions have been proposed [START_REF] Ozdemir | Secure data aggregation in wireless sensor networks: a comprehensive overview[END_REF], many of them involving strong [START_REF] Simplicio | Comparison of authenticatedencryption schemes in wireless sensor networks[END_REF] and/or homomorphic [START_REF] Ben Othman | Confidentiality and integrity for data aggregation in WSN using homomorphic encryption[END_REF] cryptography, some relying on other mechanisms such as multi-path based fragmentation of the packets [START_REF] Monnet | Data protection in multipaths WSNs[END_REF] or game theory [START_REF] Shi | Game theory for wireless sensor networks: a survey[END_REF].

Authentication brings to participants the guarantee that the peer they are communicating with truly is what it claims to be; that is another important point. It has been deeply investigated as well [START_REF] Guo | Authentication mechanism on wireless sensor networks: A survey[END_REF]. Many lightweight proposals for key management in WSNs have been suggested [START_REF] Guo | Construction of trusted wireless sensor networks with lightweight bilateral authentication[END_REF], [START_REF] Bawa | An efficient novel key management scheme for enhancing user authentication in a WSN[END_REF].

Apart from those, there have been a variety of proposals to secure some other elements, considering that any information about any aspect of the network might be valuable to an attacker. Hence there are approaches, for instance, to secure the geographical location of the nodes through epidemical information dissemination [START_REF] Kazatzopoulos | WSN location privacy scheme enhancement through epidemical information dissemination[END_REF] as well as through more conventional mechanisms [START_REF] George | Cluster based location privacy in wireless sensor networks against a universal adversary[END_REF].

B. DoS-specific mechanisms

Denial of service attacks embraces many different attacks, which can target all layers of the network [START_REF] Varshovi | Ontological classification of network denial of service attacks: basis for a unified detection framework[END_REF]. Jamming the radio frequencies as well as disturbing the routing protocols are just a few examples of ways to degrade the network. In reaction to these, a number of solutions have been proposed [START_REF] Singh | A survey on network security and attack defense mechanism for wireless sensor networks[END_REF].

As stated in the introduction, we focus in this paper on inside attackers attempting to bend the MAC protocol parameters to their needs, be it to achieve better performances for themselves (greedy attacks) or to generally harm the network (jamming attacks or sleep deprivation). To detect such attackers, many solutions rely on trust models [START_REF] Momani | Survey of trust models in different network domains[END_REF]. We base our own work on Lai's and Chen's approach [START_REF] Lai | Detecting denial of service attacks in sensor networks[END_REF], which consists in assigning monitoring nodes in the network. Those monitoring nodes, also called cNodes in this article, apply a set of rules [START_REF] Rohbanian | Watchdog-LEACH: a new method based on LEACH protocol to secure clustered wireless sensor networks[END_REF] to overheard traffic so as to detect misbehaving nodes. On multiple rule breaks, they report the suspicious node to the cluster head. To prevent false positive detection, the CH waits for several reports about a given node before considering it as compromised. After that, it virtually excludes the misbehaving node from the cluster by broadcasting a warning to all sensors. We have observed in previous studies that renewing periodically the selection process of those monitoring nodes (cNodes) helps saving energy in the network [START_REF] Ballarini | Modeling tools for detecting DoS attacks in WSNs[END_REF], and we have tried ever since to find an optimal selection algorithm to obtain a good equilibrium between security, attack detection and energy preservation [START_REF] Monnet | Energy-balancing method to detect denial of service attacks in wireless sensor networks[END_REF].

C. Clustering algorithms and energy preservation

A lot of approaches intended to bring security in a WSN are cluster-based [START_REF] Ghosal | A lightweight security scheme for query processing in clustered wireless sensor networks[END_REF]. But the main purpose of clustering a sensor network usually resides in scaling possibilities, improved nodes management and energy savings brought by partitioning. Several clustering algorithms have been proposed [START_REF] Abbasi | A survey on clustering algorithms for wireless sensor networks[END_REF]. They generally aim at determining which nodes in the network will be the cluster heads, often basing the choice on energetic considerations. Basically, choosing a cluster head in a network is not so different than selecting cNodes in a cluster. But in the latter case we have some additional constraints on security.

One of the easiest clustering algorithm to implement, and probably one of the most used is the LEACH algorithm [START_REF] Handy | Low energy adaptive clustering hierarchy with deterministic cluster-head selection[END_REF]. LEACH makes each node draw a pseudo-random number and matches it with a threshold which was computed from the number of desired cluster heads in the network and from the last iteration when the sensor was selected as a CH. There is a number of proposals derived from LEACH, to improve either its efficiency [START_REF] Reddy | A modifiedclustering for LEACH algorithm in WSN[END_REF], [START_REF] Chawla | Algorithm for optimizing first node die (FND) time in LEACH protocol[END_REF] or its security [START_REF] Oliveira | SecLEACH -on the security of clustered sensor networks[END_REF]. Other example clustering algorithms include HEED [START_REF] Younis | HEED: a Hybrid, Energy-Efficient Distributed clustering approach for ad-hoc sensor networks[END_REF] or FFUCA [START_REF] Fouchal | A new clustering algorithm for wireless sensor networks[END_REF].

Aside from clustering, the importance of energetic issues in WSNs have led to the proposals of several mechanisms to cut down its consumption [START_REF] Anastasi | Energy conservation in wireless sensor networks: a survey[END_REF], based for example on packets priority [START_REF] Sivakumar | Power conservation and security enhancement in wireless sensor networks: A priority based approach[END_REF].

III. PROCEDURE OF FAIR ELECTION OF CNODES

Our selection process of cNodes is iterative so that new cNodes are continually elected and others are discarded because they have already taken this role before or have been declared as suspicious.

Let the symbol N denote the set of all nodes in the cluster and CN denote the set of cNodes. i is the index ranging over N . Let RE k be an array of residual energies of nodes reported by cNodes to the cluster head at the k th iteration. The symbol Obs k [j] denotes an array containing observations made by cNode j on communications of its neighbors.

The election process starts with an initialization phase and then enters a loop block which is iteratively performed as long as the network is running.

A. Initialization phase

At the start of the process, the following actions are undertaken:

• Each node i of the cluster sends to the cluster head the value of its residual energy, which is stored into a related array RE 0 [i].

• Each node acts as a cNode and starts controlling its neighbors. It keeps sensing and forwarding data (otherwise there would be no traffic to observe). Since the set of cNodes contains all nodes of the cluster, each node starts recording the packets sent by its neighbors. • The cluster head sets the counter of iterations k to 1.

B. Loop block

At each iteration k, the election process executes the following steps:

1) The duration of this surveillance step at any iteration k is random to prevent compromised nodes to simulate the behavior of sane nodes as long as possible. During step 1, each cNode controls the neighboring nodes (including other cNodes) by recording and adding up sizes of all packets sent or received by these nodes. 2) At the end of iteration k, the cluster head (CH) asks each node i to send its residual energy value RE k [i] and asks each cNode j to send the array Obs k [j] containing its observations over transmission rates of its neighbors. 3) For each node i, the cluster head performs an analysis work as follows: If SSN [i] ≥ threshold then the node is declared as compromised and put into a quarantine list. On the other hand, if a suspicious node has continually been declared as sane (more than some number of times) then it could be removed from SSN and put again into SEN . 4) Once step 3 is finished, the CH selects cNodes from the set SEN of eligible nodes in such a way that every node is controlled by at least two cNodes. Hence, as a cNode will be controlled by other cNodes, its misbehavior would be reported to the CH. For further iterations, such a rule helps detect and discard compromised nodes which have been chosen as cNode because they normally behaved in the past iterations and made false statement about their residual energies, unless they continue to undertake normal communications. 5) The process increments the number k of iterations and continues its iterative execution by going back to step 1.

C. Mathematical model for energy consumption

A possible mathematical model that the cluster heads may use for computing the energy consumed by the nodes based on received observations is Rakhmatov and Vrudhula's diffusion model [START_REF] Rakhmatov | An analytical high-level battery model for use in energy management of portable electronic systems[END_REF]. It provides a pretty accurate approximation of real consumption, taking into account chemical processes internal to the battery such as rate capacity effect and recovery effect. Rakhmatov and Vrudhula's diffusion model refers to the chemical reaction happening inside the battery electrolyte, and is summarized by equation (1):

σ(t) = t 0 i(τ ) dτ l(t) + u(t) t 0 i(τ ) 2 ∞ m=1 exp -β 2 m 2 (t-r) dτ (1)
where:

• σ(t) is the apparent charge lost from the battery at t. • l(t) is the charge lost to the load ("useful" charge).

• u(t) is the unavailable charge ("lost in battery" charge).

• i(t) is the current at t.

• β = π √ D w
, where D is the diffusion constant and w the full width of the electrolyte of the battery. In practice, computing the first ten terms of the sum provides a good approximation.

D. Selecting cNodes among set SEN

At step 3 of the fair election process, cluster heads select the cNodes for the running iteration among the nodes inside SEN sets. Note that any selection criterion could be used at this point. For instance, cNodes could be randomly picked among elements of SEN until we have:

• enough cNodes (according to user's choice)

• and all nodes covered by at least two cNodes, as mentioned above. Some other selection criteria could include:

• residual energy of the nodes • connectivity index (number of direct neighbors)

• signal power • et caetera Several criteria can even be combined to obtain a weighted score, such as for instance in equation 2:

s k [i] = (α×RE k [i])+(γ ×ci k [i])+(δ ×sp k [i])+(ζ ×nsl k [i])
(2) where:

• s k [i] denotes the score for node i at iteration k.

• RE k [i] remains the residual energy for said node and iteration. • ci k [i] would be the connectivity index of i.

• sp k [i] is the average signal power as perceived by the neighbors of node i. • nsl k [i] is the maximum value between a predetermined integer value and the number of iterations before k since node i was last selected as a cNode. • α, γ, δ and ζ would be constants fixed by the user. This formula could be used to sort nodes in set SEN so that the cluster head can select the best possible cNodes in regard to retained criteria.

Setting the criteria and the weights for the formula is up to the user of the network. It should be adapted to the exact application and environment of the WSN. For instance it may be worth noting that for networks made of static nodes, the connectivity index and the signal power of the nodes are not expected to change much between two consecutive iterations. Therefore their weights should not be too high (in regard to the other weights in the formula) so as to avoid selecting the same cNodes at each iteration. In clustered networks, where all the nodes can reach their CH in a one-hop fashion, index connectivity or signal power might not even be relevant (once again, depending also on the deployed application). But even if we only work in clustered networks in this study -because they allow energy savings and a much better scaling -we should nevertheless consider other architectures in that respect, for not all WSNs are clustered. And many ones also work with mobile nodes. In such cases, evaluating the density of nodes or the quality of the links in the area where the candidate cNodes are located becomes more interesting because it generally has a higher impact on performances. Such observations remain valid for the chosen constraint stating that each node must be watched over by at least two cNodes. While it is a good thing in clusters where nodes are all gathered around their cluster head, it could be much harder to obtain in some other topologies. In a star-like network for instance, where most sensors would be on branches and only have two neighbors (one closer, one farther from the base station), it could result in all nodes being selected as cNodes.

IV. SIMULATION RESULTS

So as to compare our proposal with previous approaches, we have undertaken simulations using ns-2 software with parameters displayed in Table I. A star (*) denotes a value used only for compromised node. To play their role during the whole duration of the simulation, the compromised node as well as the cluster head were granted more energy than the normal sensors. The simulated cluster is a grid with ten sensors on each side, and the transmission range is such that the nodes in the corner can just reach until the cluster head, as displayed on Figure 2. We compared the fair election process with a (pseudo-)random selection such as in [START_REF] Ballarini | Modeling tools for detecting DoS attacks in WSNs[END_REF].

A. Detection rate

The number of cNodes which detected the compromised node at each iteration are reported on Figure 3. After 2,000 seconds, nearly all nodes in the cluster are dead. Before that, we can observe that the efficiency of the two methods, with 10 % of cNodes, is nearly the same. The random selection process can afford monitoring a little longer but with a lower detection rate; the fair election process ensures that all nodes are monitored by at least two cNodes, therefore the number of We tried to see what results would give another instance of the fair election process, but with only seven cNodes. In this case the average detection rate is slightly lower (since we have less cNodes), but the detection is still performed by at least one cNode after 2,200 seconds. With the random selection process, the use of seven cNodes only drops significantly the efficiency of the detection method. It was not displayed on the graph.

B. Energy

Figure 4 presents the time of death of the normal sensors in the cluster. As expected, the fair election process leads to a faster exhaustion of the battery. This is due in part to the initialization phase, when all nodes remain in a listening state all along; and also to the emission of the observations of the nodes to the cluster head at each iteration. The difference between the two methods is quite low: the initialization phase plays for most of it, and it would be softened over time with real batteries (remember that we worked with 10 J only).

The test involving seven cNodes gives better results than both methods using ten monitoring nodes. We can observe an early drop due to the increased consumption of the initial phase, but after 1,300 seconds there are more nodes alive than with the random selection process used to pick ten cNodes. The fewer cNodes the cluster have, the less indeed they consume energy.

C. Compromised cNodes

Using only seven nodes with the fair election process seems to be a good approach. The detection rate remains correct, while the energy consumption is lower than other methods using more monitoring nodes. But with fewer cNodes there is a risk that compromised nodes manage to monopolize the roles, and that nothing remains to detect them.

The observations submitted to the cluster head and the constraint we used to enforce that each node be monitored by at least two cNodes are useful here. With a random selection process (i.e. without applying those constraints) we had the compromised node elected as a cNode during 12 % of the simulation time on average (it is a little more than the theoretical 10 % expected with 10 % of cNodes in the cluster). The fair election process and its additional constraint were enough, within the conditions of our simulations, to prevent completely the compromised node to be selected as a cNode at any time.

V. CONCLUSION AND PERSPECTIVES

Monitoring nodes (cNodes) can be used in WSNs so as to detect compromised nodes and to virtually exclude them. This role consumes more energy than normal sensing, and for obvious security reasons it must not be assigned to rogue sensors. In this article we proposed a novel approach to select those cNodes based on an iterative fair election principle for clustered wireless sensor networks. After an initialization phase and for each cluster, the cluster head establishes a list of eligible nodes from the observations of the sensors relative to their neighbors, and then selects the cNodes using the best suited criteria for the application run in the network.

Experiments performed through the ns-2 simulator show that even if global consumption is slightly higher than for a selection process based on randomness, the detection rate is good, and the method can even afford to use less cNodes without loosing in efficiency. In addition to this, the risk of selecting a compromised node as cNode is drastically reduced.

Based on this work, we would like to push our experiments in further study so as to analyze the impact of our solution on networks with different topologies (for instance, non-clustered networks or networks with areas of different activity levels), and to observe the consequences of the different parameters used by the cluster head to proceed to the selection itself. Additional perspectives include improving the security of this approach by monitoring the cluster head, as well as formal modeling of the solution and validation through modelchecking tools.

Figure 1 .

 1 Figure 1. Scheme of an example clustered wireless sensor network

Figure 2 . 2 Figure 3 .

 223 Figure 2. Topology of simulated cluster; transmission range is (a √ 2)/2

Figure 4 .

 4 Figure 4. Time of death of the nodes

  • According to an adequate mathematical model, the CH assesses the energy consumption ECa related to the maximum of rates {Obs k [j][i]}| j∈CN observed by neighboring cNodes j during the current iteration k. • The CH also computes the value of the energy consumption ECd as the difference between residual energies declared in the two last steps (i.e. RE k [i] and RE k-1 [i]). • If |ECd-ECa| ≤ (where represents a tolerated error) then the node i is declared as sane and put into the set SEN of nodes eligible to take on a cNode functioning mode. Otherwise, it is removed from the set SEN of sane nodes (if it was there) and put into the pool SSN of suspicious nodes. • Let SSN [i] stand for the number of times it has declared as suspicious from the start of the process.