Reduction of the feature space for the detection of attacks of wireles sensor networks

The article evaluates the informativeness of the features of the abnormal behaviour of node in wireless sensor network. The estimation is carried out for the basic methods of attacking on wireless sensor networks, such as "funnel", "wormhole", "selective forwarding", etc. The estimation is performed using three basic methods: the method of Shannon, the method of Kullback and the method of accumulated frequencies. Special attention is paid to the dependence of the feature informativeness on various characteristics of the network (topology, packet generation periods, the degree of stochasticity of the selection of addresses for the generated packets transmission). Estimates are compared with previously obtained estimates for the simplest network with the mesh topology. Key results are the reduction of the feature space by uninformative features extracting (when reducing the introduced scale of feature informativeness degree is used), the formation of samples with estimates of informativeness for each network and each pair "normal behaviour"-"specific attack type". Also the program for automatic calculation of estimates of the informativeness and its subsequent analysis is created. In the future the obtained results can be used as the basis for methods of classification, aimed at identifying of anomalous behaviour in wireless sensor networks.