Mobile ad hoc networks and wireless sensor networks have promise a large variety of applications. They are often deployed in potentially adverse or even hostile environments. Intrusion detection systems make available a necessary layer of in-depth fortification for wired networks. However, relatively little research has been performed about intrusion detection in the areas of mobile ad hoc networks and wireless sensor networks. Energy efficiency in wireless sensor network [WSN] is the highly important role for the researchers. Clustering is the important factors for real time applications We present the challenge of constructing intrusion detection systems for mobile ad hoc networks and wireless sensor networks, survey the existing intrusion detection techniques, and indicate important future research directions.
I. INTRODUCTION
A wireless sensor node (WSN) is a one type of sensor technology to monitor physical or conservational needs, such as pressure, sound, vibration, temperature, motion and to transmit the data to a sink (base station) through the network. Currently most of the latest networks are bi-directional, enabling to cope up with the activity of the sensors. Military applications like battle field reconnaissance is the main inspiration for wireless sensor networks development, recently this type of distributed networks a read opted in most of remote monitoring applications and industrial measurements application like machine condition monitoring, industrial process monitoring, structural health monitoring, and indoor monitoring.Sensors nodes are characteristically proficient of wireless communication and are considerably obliged in the amount of existing resources such as energy (power), storage (memory) and computation. These obligate make the deployment and operation of WSN significantly distinct from existing wireless networks, and demand the development of resource aware protocols and supervision techniques.
II. CLUSTERING APPROACH
Clustering is considered as an effective approach to reduce network overhead and improve scalability. Since sensor networks are based on the dense deployment of disposable and low-cost sensor nodes, destruction of some nodes by hostile action does not affect a military operation as much as the destruction of a traditional sensor, which makes the sensor network concept a better approach for battlefields. The transmission between the two nodes will minimize the other nodes to show the improve throughput and greater than spatial reuse than wireless networks to lack the power controls. Adaptive Transmission Power technique to improve the Network Life Time in Wireless Sensor Networks.
Once the clustering procedure , each node in the network is associated with a cluster head. Two clusters in a neighbor node have high enough contact probability (≥γ ), a pair of gateway nodes are identified to bridge them. Consider Node i, which intends to send a data message to Node j. Node i looks up its cluster table to find the cluster ID of Node j, i.e., Ωij [4] . According to Ωij , three types are considered: intra and inter cluster routing, one-hop and also multihop inter-cluster routing.
The Clustering Technique using the minimum spanning tree[MST] to detect the shortest path in wireless sensor networks. The data from near by the cluster heads will be directly transmitted to the sink node. The data from sink nodes to calculate the distance whereas the cluster head will be transmitted through the shortest multihop path.The distance between the cluster head and sink node. The shortest path between each cluster head to the sink node. To find the Predominant node[Maximum number of path].Transmission power techniques is to improve the performance of the network in several aspects. Transmission range in the wireless networks should be change the ranges in each link. The traffic capacity decreases when more nodes are added to increases the interference. Routing graph theory to multiple paths from data sources to a neighbors node. A Novel approach Adaptive state based clustering, which demonstrate the directed acyclic graphs from each node to gateways between any given cluster head. We have the local level distance from the edge from the nearest connected to the neighboring nodes
In the cluster-based approach sensor nodes in particular WSN are permitted to transmit sensed data towards the base station. In this allows sensor nodes to sense and transmit the sensed information to the cluster-heads directly, instead of routing through its immediate neighbors. When a cluster node fails because of energy depletion we need to choose alternative cluster for that particular region. In periodical time each sensor node in the cluster should possess the next cluster head re-election based on energy to avoid node failure. Unlike previous algorithms, cluster formation precedes before cluster head selection. The spanning tree is 'minimal' to the cluster of each node when the total length of the edges is the minimum necessary to connect all the vertices in the clustering head.
In the newly formed clusters, the each node with the highest energy level is selected as the cluster head and the next higher energy level node is selected as the next CH node.
Base Station
Nodes
Clusters
Cluster Head
Figure 1 : Network Structure
III. ROUTING PROTOCOL
DTN is fundamentally an opportunistic communication system, where communication links only exist temporarily, rendering it impossible to establish end-to-end connections for data delivery. In such networks, routing is largely based on nodal contact probabilities . The key design issue is how to efficiently maintain, update, and utilize such probabilities. Clustering is considered as an effective approach to reduce network overhead and improve scalability. Various clustering algorithms have been investigated in the context of mobile ad hoc networks. However, none of them can be applied directly to DTN, because they are designed for well-connected networks and require timely information sharing among nodes.A node in real-life tends to visit some locations more frequently than others. If two nodes share the same home location, they have high chance to meet each other. Thus real-life mobility patterns naturally group mobile devices into clusters.
In wireless networks, data packets find their paths through routers or in general gateways. Each time a packet is passed to the next router a "hop" occurs. The function of intermediate hops is to relay data from one hop to the next one. Therefore in a wireless network, single-hop means that there is only one hop between source station and destined host. Wireless stations are connected to wireless access points (WAPs) which connects to router via a wired network. In other words, host connects to base station (i.e. wireless access point such as WiFi, WiMAX, cellular) which connects to larger network (e.g. Internet).
The nodes in a cluster can then interchangeably share their resources for overhead reduction and load balancing, aiming to achieve efficient and scalable routing in DTMN. Due to the lack of continuous communications, it becomes challenging to acquire necessary information to form clusters and ensure their convergence and stability. In this protocol, an exponentially weighted moving average (EWMA) scheme is employed for on-line updating nodal contact probability, with its mean proven to converge to the true contact probability
Due to possible errors in the estimation of contact probabilities and unpredictable sequence of the meetings among mobile nodes, many unexpected small size clusters may be formed. To deal with this problem, we employ a merging process that allows a node to join a "better" cluster, where the node has a higher stability as to be discussed in the next section. The merging process is effective to avoid fractional clusters.
IV. LOAD BALANCING
Load balancing is an effective enhancement to the proposed routing protocol. The basic idea is to share traffic load among cluster members in order to reduce the dropping probability due to queue overflow at some nodes. Sharing traffic inside a cluster is reasonable, because nodes in the same cluster have similar mobility pattern, and thus similar ability to deliver data messages. Whenever the queue length of a node exceeds a threshold, denoted by Λ, it starts to perform load balancing. More specifically, it randomly transmits as many messages as possible to any node it meets, until their queues are equally long or the latter's queue becomes longer than Λ.
In communication networks, throughput or network throughput is the average rate of successful message delivery over a communication channel. This data may be delivered over a physical or logical link, or pass through a certain network node. The throughput is usually measured in bits per second (bit/s or bps), and sometimes in data packets per second or data packets per time slot. The throughput can be analyzed mathematically by means of queuing theory, where the load in packets per time unit is denoted arrival rate λ, and the throughput in packets per time unit is denoted departure rate μ.
V. EFFIECIENT ALGORITHM
We start from the conventional protocols such as direct transmission protocol that sensor node sends data directly to a distant base station and consumes its energy rapidly. That leads to Minimum-transmission-energy (MTE) routing protocol that reduces distance for transmitting packet to BS by routing a data packet through multiple intermediate nodes. LEACH introduces clustering based protocol, where sensor nodes are grouped in several clusters and have randomized rotation of cluster-heads that will transmit a data to BS. PEGASIS is a chain-based protocol built on top of idea from LEACH, which nodes communicate only to its neighbor and takes turn to be leader to send data back to the BS.
5.1 LEACH (Low-Energy Adaptive Clustering Hierarchy)
LEACH is a cluster-based wireless sensor networking protocol. LEACH adapts the clustering concept to distribute the energy among the sensor nodes in the network. LEACH improves the energy-efficiency of wireless sensor networking beyond the normal clustering architecture. In LEACH protocol, wireless sensor networking nodes divide themselves to be many local clusters. In each local cluster, there is one node that acts as the base station (or we can call it "cluster-head"). Hence, every node in that local cluster will send the data to the cluster-head in each local cluster. The important technique that makes LEACH be different from the normal cluster architecture (the drain the nodes battery very quickly) is that LEACH uses the randomize technique to select the cluster-head depending on the energy left of the node.
After cluster-head is selected with some probability, the cluster-heads in each local cluster will broadcast their status to the sensor nodes in their local range by using CSMA MAC protocol. Each sensor node will choose a cluster-head that is closest to itself to join that cluster because each sensor node will try to spend the minimum communication energy with it cluster head.
After the clustering phase is set up, each cluster-head will make a schedule for the nodes in its clusterCluster-heads will collect the data from the nodes in its cluster, and compresses that data before transmits the data to the base station. the base station will get the data from all sensor nodes that we are interested, and ready for the end-user to access the data.
Although LEACH balances the energy cost, by clustering, sensor still needs relative large energy to transmit data to its cluster head. The main idea of PEGASIS is that nodes are formed into a chain where each node receive from and transmit to closest neighbor only. The distance between sender and receiver is reduced as well as decreasing the amount of transmission energy. To construct a chain, PEGASIS Error: Reference source not found uses a greedy algorithm that starts from the farthest node from the base station.
For transmitting a packet in each round, a token is used that passing from the one end of the chain to the other end of the chain. Only node that has a token can transmit a data packet to its intermediate node in the chain. When intermediate node receives data from one neighbor along with a token, it fuses the data packet with its own data and transmits a new data packet to the next node in the chain.
VI CATEGORIES OF SENSOR NODES
(i) Passive, Omni Directional Sensors: passive sensor nodes sense the environment without manipulating it by active probing. In this case, the energy is needed only to amplify their analog signals. There is no notion of "direction" in measuring the environment.
(ii) Passive, narrow-beam sensors: these sensors are passive and they are concerned about the direction when sensing the environment.
(iii) Active Sensors: these sensors actively probe the environment.
Since a sensor node has limited sensing and computation capacities, communication performance and power, a large number of sensor devices are distributed over an area of interest for collecting information (temperature, humidity, motion detection, etc.). These nodes can communicate with each other for sending or getting information either directly or through other intermediate nodes and thus form a network, so each node in a sensor network acts as a router inside the network. In direct communication routing protocols (single hop), each sensor node communicates directly with a control center called Base Station (BS) and sends gathered information. The base station is fixed and located far away from the sensors. Base station(s) can communicate with the end user either directly or through some existing wired network. The topology of the sensor network changes very frequently. Nodes may not have global identification. Since the distance between the sensor nodes and base station in case of direct communication is large, they consume energy quickly.
In another approach (multi hop), data is routed via intermediate nodes to the base station and thus saves sending node energy. A routing protocol is a protocol that specifies how routers (sensor nodes) communicate with each other, disseminating information that enables them to select routes between any two nodes on the network, the choice of the route being done by routing algorithms. Each router has a priori knowledge only of the networks attached to it directly. A routing protocol shares this information first among immediate neighbors, and then throughout the network. This way, routers gain knowledge of the topology of the network. There are mainly two types of routing process: one is static routing and the other is dynamic routing.
Dynamic routing performs the same function as static routing except it is more robust. Static routing allows routing tables in specific routers to be set up in a static manner so network routes for packets are set. If a router on the route goes down, the destination may become unreachable. Dynamic routing allows routing tables in routers to change as the possible routes change. In case of wireless sensor networks dynamic routing is employed because nodes may frequently change their position and die at any moment.
VII TRANSMITTED POWER
Wireless sensor networks (WSNs) provide a new class of computer systems and expand human ability to remotely interact with the physical world. Most of the sensors used so far are point sensors which have disc-shaped sensing and communication areas. Energy-efficient communication is discussed in WSNs. Saving energy is very important in WSNs because of the limited power supply of sensors and the inconvenience to recharge their batteries. Methods are proposed to reduce communication energy by minimizing the total sensor transmission power. That is, instead of transmitting using the maximum possible power, sensors can collaboratively determine and adjust their transmission power to reach minimum total transmission power and define the topology of the WSN by the neighbor relation under certain criteria. This is in contrast to the "traditional" network in which each node transmits using its maximum transmission power and the topology is built implicitly without considering the power issue. Choosing the right transmission power critically affects the system performance in several ways. First, it affects network spatial reuse and hence the traffic carrying capacity. Choosing too large a power level results in excessive interference, while choosing too small a power level results in a disconnected network. Second, it impacts on the contention for the medium. Collisions can be mitigated as much as possible by choosing the smallest transmission power subject to maintaining network connectivity. The goal is to find distributed methods to let each sensor decide its transmission power by communicating with other sensors to minimize total sensor transmission power while maintaining the connectivity of the network. It is pointed out that it can maintain the network connectivity, but may not minimize the total sensor transmission power. Then it is enhanced to DTCYC algorithm, where the basic idea is to let each sensor remove the largest edge in every cycle involving it as a vertex.
Power Efficiency in WSNs is generally accomplished in three ways:
Low duty cycle operation
Local/In network processing to reduce data volume ( and hence transmission time)
Multihop networking reduces the requirement for long range transmission since signal path loss is an inverse exponent with range of distance. Each node in the sensor network can act as a repeater, thereby reducing the link range coverage required and in turn the transmission power.
VIII. ADVANTAGES AND DISADVANTAGES
8.1 Advantages
Network setups can be done without fixed infrastructure.
Ideal for the non-reachable places such as across the sea, mountains, rural areas or deep forests.
Flexible if there is ad hoc situation when additional workstation is required.
Implementation cost is cheap.
8.2 Disadvantages:
Less secure because hackers can enter the access point and get all the information.
Lower speed compared to a wired network.
More complex to configure than a wired network.
IX. Overview of Sensor technology
Sensor Nodes are almost invariably constrained in energy supply and radio channel transmission bandwidth, these constraints, in conjunction with a typical deployment of large number of sensor nodes, have posed a plethora of challenges to the design and management of WSNs. Some of the key technologies and standards elements that are relevant to sensor networks are as follows:
Sensors
Intrinsic Functionality
Signal processing
Compression, forward error correction, encryption
Control/actuation
Clustering and in-network computation
Self assembly
Wireless Radio Technologies
Software defined radios
Transmission range
Transmission impairments
Modulation Techniques
Network Topologies
Standards
IEEE 802.1.1a/b/g together with ancillary security protocols
IEEE 802.15.1 PAN/Bluetooth
IEEE 802.15.3 Ultra wide band (UWB)
IEEE 802.15.4 ZIGBEE
IEEE 802.16 WIMAX
IEEE 1451.5 (Wireless Sensor Working Group)
Mobile IP
Software Applications
Operating Systems
Network Software
Direct database Connectivity software
Middleware software
Data Management Software
X. ISSUES OF WIRELESS SENSOR NETWORKS
10.1 Hardware and Operating System for WSN
Wireless sensor networks are composed of hundreds of thousands of tiny devices called nodes. A sensor node is often abbreviated as a node. A Sensor is a device which senses the information and passes the same on to a mote. Sensors are used to measure the changes to physical environment like pressure, humidity, sound, vibration and changes to the health of person like blood pressure, stress and heart beat. A Mote consists of processor, memory, battery, A/D converter for connecting to a sensor and a radio transmitter for forming an ad hoc network. A Mote and Sensor together form a Sensor Node. There can be different Sensors for different purposes mounted on a Mote. Motes are also sometimes referred to as Smart Dust. A Sensor Node forms a basic unit of the sensor network
10.2. Wireless Radio Communication Characteristics
Performance of wireless sensor networks depends on the quality of wireless communication. But wireless communication in sensor networks is known for its unpredictable nature. Main design issues for communication in WSNs are:
Low power consumption in sensor networks is needed to enable long operating lifetime by facilitating low duty cycle operation and local signal processing.
Distributed sensing effectively acts against various environmental obstacles and care should be taken that the signal strength, consequently the effective radio range is not reduced by various factors like reflection, scattering and dispersions.
Multihop networking may be adapted among sensor nodes to reduce the range of communication link.
Long range communication is typically point to point and requires high transmission power, with the danger of being eavesdropped. So, short range transmission should be considered to minimize the possibility of being eavesdropped.
Communication systems should include error control subsystems to detect errors and to correct them.
10.3. Deployment
Deployment means setting up an operational sensor network in a real world environment. Deployment of sensor network is a labor intensive and cumbersome activity as it does not have influence over the quality of wireless communication and also the real world puts strains on sensor nodes by interfering during communications. Sensor nodes can be deployed either by placing one after another in a sensor field or by dropping it from a plane.
10.4 Localization
Sensor localization is a fundamental and crucial issue for network management and operation. In many of the real world scenarios, the sensors are deployed without knowing their positions in advance and also there is no supporting infrastructure available to locate and manage them once they are deployed. Determining the physical location of the sensors after they have been deployed is known as the problem of localization.
10.5 Synchronization
Clock synchronization is an important service in sensor networks. Time Synchronization in a sensor network aims to provide a common timescale for local clocks of nodes in the network. A global clock in a sensor system will help process and analyze the data correctly and predict future system behavior. Some applications that require global clock synchronization are environment monitoring, navigation guidance, vehicle tracking etc. A clock synchronization service for a sensor network has to meet challenges that are substantially different from those in infrastructure based networks.
10.6 Calibration
Calibration is the process of adjusting the raw sensor readings obtained from the sensors into corrected values by comparing it with some standard values. Manual calibration of sensors in a sensor network is a time consuming and difficult task due to failure of sensor nodes and random noise which makes manual calibration of sensors too expensive.
10.11 Network Layer Issues
Energy efficiency is a very important criterion. Different techniques need to be discovered to eliminate energy inefficiencies that may shorten the lifetime of the network. At the network layer, various methods need to be found out for discovering energy efficient routes and for relaying the data from the sensor nodes to the BS so that the lifetime of a network can be optimized. Routing Protocols should incorporate multi-path design technique. Multi-path is referred to those protocols which set up multiple paths so that a path among them can be used when the primary path fails. Path repair is desired in routing protocols when ever a path break is detected. Fault tolerance is another desirable property for routing protocols. Routing protocols should be able to find a new path at the network layer even if some nodes fail or blocked due to some environmental interference. Sensor networks collect information from the physical environment and are highly data centric. In the network layer in order to maximize energy savings a flexible platform need to be provided for performing routing and data management. The data traffic that is generated will have significant redundancy among individual sensor nodes since multiple sensors may generate same data within the vicinity of a phenomenon. The routing protocol should exploit such redundancy to improve energy and bandwidth utilization. As the nodes are scattered randomly resulting in an ad hoc routing infrastructure, a routing protocol should have the property of multiple wireless hops.
10.12 Quality of Service
Quality of service is the level of service provided by the sensor networks to its users. Quality of Service (QoS) for sensor networks as the optimum number of sensors sending information towards information-collecting sinks or a base station.
10.13 Security
Security in sensor networks is as much an important factor as performance and low energy consumption in many applications. Security in a sensor network is very challenging as WSN is not only being deployed in battlefield applications but also for surveillance, building monitoring, burglar alarms and in critical systems such as airports and hospitals. Since sensor networks are still a developing technology, researchers and developers agree that their efforts should be concentrated in developing and integrating security from the initial phases of sensor applications development; by doing so, they hope to provide a stronger and complete protection against illegal activities and maintain stability of the systems at the same time.
XI. ATTACKS ON WIRELESS SENSOR NETWORK
Many sensor network routing protocols are quite simple, and for this reason are sometimes even more susceptible to attacks against general ad-hoc routing protocols. Most network layer attacks against sensor networks fall into one of the following categories:
Spoofed, altered, or replayed routing information
Selective forwarding
Sinkhole attacks
Sybil attacks
Wormholes
HELLO flood attacks
Acknowledgement spoofing
11.1 Spoofed, altered, or replayed routing information
The most direct attack against a routing protocol is to target the routing information exchanged between nodes. By spoofing, altering, or replaying routing information, adversaries may be able to create routing loops, attract or repel network traffic, extend or shorten source routes, generate false error messages, partition the network, increase end-to-end latency, etc.
11.2 Selective forwarding
Multi-hop networks are often based on the assumption that participating nodes will faithfully forward receive messages. In a selective forwarding attack, malicious nodes may refuse to forward certain messages and simply drop them, ensuring that they are not propagated any further. A simple form of this attack is when a malicious node behaves like a black hole and refuses to forward every packet she sees. However, such an attacker runs the risk that neighboring nodes will conclude that she has failed and decides to seek another route. A more subtle form of this attack is when an adversary selectively forwards packets. An adversary interested in suppressing or modifying packets originating from a select few nodes can reliably forward the remaining traffic and limit suspicion of her wrongdoing. Selective forwarding attacks are typically most effective when the attacker is explicitly included on the path of a data flow. However, it is conceivable an adversary overhearing a flow passing through neighboring nodes might be able to emulate selective forwarding by jamming or causing a collision on each forwarded packet of interest.
11.3 Sinkhole attacks
In a sinkhole attack, the adversary's goal is to lure nearly all the traffic from a particular area through a compromised node, creating a metaphorical sinkhole with the adversary at the center. Because nodes on, or near, the path that packets follow have many opportunities to tamper with application data, sinkhole attacks can enable many other attacks (selective forwarding, for example). Sinkhole attacks typically work by making a compromised node look especially attractive to surrounding nodes with respect to the routing algorithm. For instance, an adversary could spoof or replay an advertisement for an extremely high quality route to a base station. Some protocols might actually try to verify the quality of route with end-to-end acknowledgements containing reliability or latency information. In this case, a laptop-class adversary with a powerful transmitter can actually provide a high quality route by transmitting with enough power to reach the base station in a single hop, or by using a wormhole attack. Due to either the real or imagined high quality route through the compromised node, it is likely each neighboring node of the adversary will forward packets destined for a base station through the adversary, and also propagate the attractiveness of the route to its neighbors. Effectively, the adversary creates a large "sphere of influence", attracting all traffic destined for a base station from nodes several (or more) hops away from the compromised node. One motivation for mounting a sinkhole attack is that it makes selective forwarding trivial. By ensuring that all traffic in the targeted area flows through a compromised node, an adversary can selectively suppress or modify packets originating from any node in the area. It should be noted that the reason sensor networks are particularly susceptible to sinkhole attacks is due to their specialized communication pattern. Since all packets share the same ultimate destination (in networks with only one base station), a compromised node needs only to provide a single high quality route to the base station in order to influence a potentially large number of nodes.
11.4 The Sybil attack
An insider cannot be prevented from participating in the network, but she should only be able to do so using the identities of the nodes she has compromised. Using a globally shared key allows an insider to masquerade as any (possibly even nonexistent) node. Identities must be verified. In the traditional setting, this might be done using public key cryptography, but generating and verifying digital signatures is beyond the capabilities of sensor nodes. One solution is to have every node share a unique symmetric key with a trusted base station. Two nodes can then use a Needham-Schroeder like protocol to verify each other's identity and establish a shared key. A pair of neighboring nodes can use the resulting key to implement an authenticated, encrypted link between them. In order to prevent an insider from wandering around a stationary network and establishing shared keys with every node in the network, the base station can reasonably limit the number of neighbors a node is allowed to have and send an error message when a node exceeds it. Thus, when a node is compromised, it is restricted to (meaningfully) communicating only with its verified neighbors. This is not to say that nodes are forbidden from sending messages to base stations or aggregation points multiple hops away, but they are restricted from using any node except their verified neighbors to do so. In addition, an adversary can still use a wormhole to create an artificial link between two nodes to convince them they are neighbors, but the adversary will not be able to eavesdrop on or modify any future communications between them.
11.5 Wormholes
In the wormhole attack, an adversary tunnels messages received in one part of the network over a low latency link and replays them in a different part. The simplest instance of this attack is a single node situated between two other nodes forwarding messages between the two of them. However, wormhole attacks more commonly involve two distant malicious nodes colluding to understate their distance from each other by relaying packets along an out-of-bound channel available only to the attacker. An adversary situated close to a base station may be able to completely disrupt routing by creating a well-placed wormhole. An adversary could convince nodes who would normally be multiple hops from a base station that they are only one or two hops away via the wormhole. This can create a sinkhole: since the adversary on the other side of the wormhole can artificially provide a high-quality route to the base station, potentially all traffic in the surrounding area will be drawn through her if alternate routes are significantly less attractive. This will most likely always be the case when the endpoint of the wormhole is relatively far from a base station. Wormholes can also be used simply to convince two distant nodes that they are neighbors by relaying packets between the two of them. Wormhole attacks would likely be used in combination with selective forwarding or eavesdropping. Detection is potentially difficult when used in conjunction with the Sybil attack.
11.6 HELLO flood attack
A novel attack against sensor networks is the HELLO flood. Many protocols require nodes to broadcast HELLO packets to announce themselves to their neighbors, and a node receiving such a packet may assume that it is within (normal) radio range of the sender. This assumption may be false: a laptop-class attacker broadcasting routing or other information with large enough transmission power could convince every node in the network that the adversary is its neighbor.
For example, an adversary advertising a very high quality route to the base station to very node in the network could cause a large number of nodes to attempt to use this route, but those nodes sufficiently far away from the adversary would be sending packets into oblivion. The network is left in a state of confusion. A node realizing the link to the adversary is false could be left with few options: all its neighbors might be attempting to forward packets to the adversary as well. Protocols which depend on localized information exchange between neighboring nodes for topology maintenance or flow control are also subject to this attack. An adversary does not necessarily need to be able to construct legitimate traffic in order to use the HELLO flood attack. She can simply re-broadcast overhead packets with enough power to be received by every node in the network. HELLO floods can also be thought of as one-way, broadcast wormholes.
Flooding is usually used to denote the epidemic like propagation of a message to every node in the network over a multi-hop topology. In contrast, despite its name, the HELLO flood attack uses a single hop broadcast to transmit a message to a large number of receivers.
11.7 Acknowledgement spoofing
Several sensor network routing algorithms rely on implicit or explicit link layer acknowledgements. Due to the inherent broadcast medium, an adversary can spoof link layer acknowledgments for "overheard" packets addressed to neighboring nodes. Goals include convincing the sender that a weak link is strong or that a dead or disabled node is alive. For example, a routing protocol may select the next hop in a path using link reliability. Artificially reinforcing a weak or dead link is a subtle way of manipulating such a scheme.
