Secure localization using hypothesis testing in wireless networks

Abstract

Localization is the method of estimating the location of a wireless node using measured inputs such as distances from nodes with known locations. When the measured distances from anchor nodes are used for localization, compromised nodes that are involved in the process can give false information that produces inaccurate location estimates. This paper proposes a Generalized Likelihood Ratio (GLRT) based approach to find the compromised nodes that deliberately give false information. After detecting such malicious nodes, the measurements given by them are eliminated from the localization computation to improve the location estimate. The proposed method works for Gaussian range measurement errors, which is considered more realistic, as compared to a method available in literature that works only for uniformly distributed range errors. Extensive simulations were carried out to assess the performance of the algorithm under various conditions. The proposed method was found to give better localization accuracy as compared to previous methods available in the literature which address the same problem. Simulations also showed that the algorithm performs well even when some of the assumptions used in the algorithm do not hold true.

Introduction

Localization is an important application in most wireless networks, particularly in sensor networks, as the information reported by nodes in the network is interpreted with reference to its location. Therefore, accurate localization is critical for many applications that depend on location information. It is, however, very expensive to equip all the sensor nodes with GPS receivers that can find the location on its own. Besides, GPS often fails indoors. The common approach is to equip some of the nodes with GPS receivers and find the location of the remaining nodes using them as reference.

In this work, the focus is on range-based localization that can be explained as follows: The node for which location is to be estimated is called target node. To estimate the location of the target node, we use the distances from n reference nodes called anchor nodes; and the locations of these anchor nodes are assumed to be known. The measured distances between the target and anchor nodes are called ranges.¹ The ranges are computed by sending time-stamped packets between target node and the anchor nodes, and computing the time of flight using the time difference between the time stamp and the time when the packet is received. Since the velocity of electromagnetic signals in air is known, the distance between the nodes can be calculated from the time of flight. Using the locations of the anchor nodes and the measured ranges, the location of the target node can be calculated. This calculation is a solved problem and many effective algorithms are available for it (see [1] and [2] for an overview of the methods available in literature). Should an attack happen in the network, the attacker may target the localization application to cause the nodes to report inaccurate or wrong location information. Hence, researchers are increasingly looking into secure localization problem, attempting to improve the accuracy of location estimate even in the case of having compromised nodes in the network that report wrong measurements. The security issues associated with localization is surveyed by Zeng et al. [3].

An example scenario for the problem considered is shown in Fig. 1. If all the range measurements provided to the localization algorithm are correct, the estimated location of the target nodes would be the point marked ‘X’. However, due to one malicious range estimate, shown by the dashed line, the location estimate is moved to the point marked star.

The work in [4] considered such attack and proposed the use of Least Median Square (LMS) estimate instead of Least Square Estimate (LSE). This approach attempts to find the location that minimizes the median of the differences between the measured distances and the calculated distances to the anchor nodes from that point.

Misra et al. [5] also tackled the above problem with erroneous range measurements. They proposed a method to eliminate the measurements given by nodes that are found to be malicious with absolute certainty. In the case of no measurement errors, the method proposed by Misra et al. works very well. It was shown in their work that in that case, the location can be estimated correctly when the number of malicious anchor nodes is less than or equal to $\lfloor n/2\rfloor -2,$ where n is the total number of anchor nodes that report range measurements to the target node. However, in the case of non-zero measurement errors, only ranges that are absolutely certain to be false are classified as malicious. As a result, the method misses many malicious range measurements. This is a cause for concern, as in a wireless network, classifying a malicious node as non-malicious (missed detection) is much more damaging than classifying a non-malicious node as malicious (false positive), as the former case can compromise the utility of the entire network. The work of Misra et al. [5] was shown to give better performance than LMS approach. This work can be used only in the case when range measurement errors are uniformly distributed. However, the approach taken by Misra et al. [5] assumes uniformly distributed range measurement errors, which is an unrealistic model in practice.

In this paper, we propose a hypothesis testing approach using a modified version of Generalized Likelihood Ratio Test (GLRT) method [6] to find malicious nodes using the range measurements reported by the nodes. After eliminating the range measurements that are classified as malicious, we use maximum likelihood estimation to do the final localization using the remaining range measurements. The method is shown to have better localization accuracy than LSE [7], LMS [4], and the work in [5]. To the best of our knowledge, the papers [5] and [4] are the only ones that have considered this problem of attack on localization using malicious range measurements.

Following are the important contributions in this work:

• We propose a hypothesis testing based scheme to find malicious range measurements to reduce localization error. The scheme works for Gaussian range measurement errors, which is a more realistic model, unlike the method in [5] that can be applied only for uniformly distributed range measurement errors.

• We provide detailed study of the performance of the scheme under various conditions such as varying number of anchor nodes, measurement errors and lying factor.

• We compare the proposed method with existing schemes in literature to show that the proposed scheme improves localization accuracy performance over methods available such as LSE [7], LMS [4], and the method described in [5].

• We test the resilience of the method by evaluating its performance in the cases where the assumptions used in the algorithm are not true

The remainder of this paper is organized as follows: Section 2 describes related work in the area of secure localization. Section 3 gives a description of the model we are considering for secure localization. Section 4 details the hypothesis testing approach to find false range measurements. The results are described in Section 5. The paper is concluded in Section 6.