Sinkhole Attack in Wireless Sensor Networks

Sinkhole attacks are carried out by either hacking a node in the network or introducing a fabricated node in the network.The malicious node promotes itself as the shortest path to the base station and tries to guide the traffic from other nodes towards itself. This not only lures all the nodes near the sinkhole but also each and every node closer to the base station than the sinkhole.The intruder node or the sinkhole can then easily alter the data compromising the security of the network. Sinkhole attack can be initiated from within the network as well as from outside. In the first scenario the attacker may use a bugged node to begin the intrusion and in the second case the invader may form a direct path to the base station through it tempting other nodes to send their traffic through it.

1. Anomaly Dependent: In Anomaly dependent intrusion prevention, the system activity is observed and it is categorized as anomalous or normal. Here any type of interference or invasion is considered as an anomalous activity. In order to successfully identify attack traffic the system must initially be trained to identify normal system activity. Mostly the anomaly detection systems consists of a training stage where system is configured to detect normal activity and a testing phase. The problem with this technique is that it may not always be accurate in identifying the sinkhole and can raise false alarms. Both statistical and rule based techniques are a sub division of anomaly dependent approach. 

2. Rule/Signature Based: In this type of intrusion detection system certain rules are defined which are to be followed by each node in the WSN. These rules are laid out the basis of the style and manner in which the sinkhole attacks are carried out. Nodes which are found violating the rules are labeled as intruder nodes and hence are disbanded. Drawback of this type of detection mechanism is that it is only able to detect already registered attacks and is vulnerable to new attacks. 

3. Statistical: This is another subset of the anomaly based detection technique.In this method the info related to different tasks performed by the node is recorded and analyzed . The info could be anything from CPU usage to packet transfer between nodes. The intruder node is then found by matching its behavior with the reference data. 

4. Hybrid: This approach is a combination of both anomaly and signature based Intrusion Detection Systems and eliminates the drawbacks of both of them. It is capable of catching even those attacks whose signatures are not a part of the database. Also the accuracy is improved considerably in contrast to the anomaly based approach. 

5. Key Management: This method is based on the principle of cryptography in which the data transferred between nodes is encoded and can only be decoded with the help of a key. Even a small change in the message can easily be detected in this method. Nodes can conveniently verify the legitimacy of the message and also ascertain if the data is sent from the Base Station with the aid of the key.

A Sinkhole Attack is a type of attack in Wireless Sensor Networks (WSN) where a malicious node attracts traffic towards itself by advertising itself as the shortest path to the sink node. 

Here are some features, advantages, and disadvantages of Sinkhole Attacks in WSN:

Features:

1. Sinkhole Attacks can be launched by a compromised node in the WSN.
2. The attacker node advertises itself as the shortest path to the sink node, which causes legitimate nodes to route their traffic through the attacker node.
3. Once the traffic is routed through the attacker node, it can selectively drop or modify the data packets to achieve its objective.

Advantages:

1. Sinkhole Attacks can be used to steal sensitive information or disrupt the network by dropping or modifying the data packets.
2. The attacker node can remain undetected by routing the traffic through itself and then forwarding it to the sink node.
   

Disadvantages:

1. Sinkhole Attacks can cause a significant amount of damage to the WSN by disrupting the network, stealing information, or causing the nodes to fail.
2. The attacker node may need to use a significant amount of energy to advertise itself as the shortest path, which can cause it to be detected by the legitimate nodes.
3. The WSN can be protected from Sinkhole Attacks by using secure routing protocols that authenticate the nodes and verify the path before forwarding the traffic.
   

Sinkhole Attacks are a serious threat to WSNs as they can cause significant damage and compromise the security of the network. However, secure routing protocols and authentication mechanisms can be used to prevent or detect these attacks.