An attack-defense game based reliability analysis approach for wireless sensor networks

Abstract

Wireless sensor networks play an important role in daily life and have been applied in diverse fields. In practice, malware tries to infect sensor nodes, while wireless sensor network prevents from attacking. This article establishes a new attack–defense game based on Stackelberg game. In this game, malware selects its strategy of attacking first, and then wireless sensor network makes decision after observing the action of malware. This game considers the situation in which malware is more dominant than wireless sensor network. Then this game is solved and an equilibrium solution is calculated, which is the best strategy for malware and wireless sensor network to maximize their payoffs. With infection probability and defense probability, mean time to failure of a sensor node is computed and is used to analyze the reliability of wireless sensor network. The experiments show the influence of true-positive rate and false-positive rate on the equilibrium solution of game and the reliability of wireless sensor network. Finally, the proposed method is compared with the existing method based on a simultaneous game.

Introduction

Wireless sensor networks (WSNs) are widely applied in different systems,^1–3 for example, smart grid, ⁴ cooperative localization, ⁵ environmental monitoring, ⁶ and power system. ⁷ In the WSNs, sensor nodes gather,^8,9 transmit,^10,11 and fuse data.^12–15 But limited energy and other factors limit the normal operation of WSNs. ¹⁶ A challenge in WSNs is to reduce communication and computational costs and ensure a high level of coverage ¹⁷ and connectivity. ¹⁸ In order to solve this problem and make the network work longer,^19,20 many different methods have been studied. Some of these methods propose more reasonable energy management schemes,^21–23 some study clustering schemes ²⁴ , some research new topologies,^25,26 and some study communication protocols.^27,28 In addition, the uncertain factors such as uncertain environment also affect WSNs.^29,30 These uncertainties are difficult to assess^31–33 and cause the data collected by different sensor nodes to conflict with each other.^34,35 In practice, WSNs are vulnerable to a variety of attacks. ³⁶ Some methods are used to detect attacks ³⁷ and reduce the impact of network failures. ³⁸ Therefore, it is necessary to analyze the state of WSNs, and reliability is an important indicator for measuring the state of WSNs. ³⁹ Many methods have been applied to analyze reliability, such as dependency assessment,^33,40,41 Markov models,^42,43 fuzzy evaluation, and game theoretic methods.^44,45

When analyzing the reliability of WSNs, security is an important factor to consider. The attackers deliberately attack the vulnerable nodes in WSNs, while WSNs use intrusion detection systems (IDSs) to defend against the intrusion. Malware is an attacker that destroys the WSN through infection. Many extension models based on classical epidemiological models^46–48 have been proposed to simulate the propagation of malware. These models describe the transition relationships between different states of sensor nodes and are used to evaluate the reliability of WSNs. In order to analyze reliability, it is necessary to calculate the probability that a node is infected. The successful infection probability is affected by the infection probability of malware and the defense probability of WSN. So it is determined by the strategies of malware and WSN. In adversarial decision making, game theory is used to find the optimal strategies for decision makers.^49,50 It has been used in different fields^51–54 to solve some decision-making problems. For WSNs, there are some studies based on game theory to solve some problems such as topology control, ⁵⁵ resource allocation, ⁵⁶ intrusion detection, ⁵⁷ and data quality. ⁵⁸ In addition, in order to maximize the lifetime, ⁵⁹ games are used to control power^60,61 and save energy.^62,63 And some articles focus on the reliability of WSN, for example, a network game between router and attacker is formulated to analyze the reliability, ⁴⁴ and evolutionary game theory is to used to establish the model. ⁶⁴ In the attack–defense of malware and wireless networks, the game is established to predict the possible actions of malware and WSN. By solving the game, the best attack probability and defense probability are obtained.

In the existing attack–defense game, there are a simultaneous game and Stackelberg game.^65,66 In the simultaneous game, both of the players are fair and make decision simultaneously. Stackelberg game is used to consider the situation, where someone in this game dominates and has the priority to decide its strategy. In the attack and defense of WSN and malware, there will be situations in which one of them dominates, and Stackelberg model can take it into account. In the existing Stackelberg game, WSN is the leader and attacker is the follower. The attacker makes its decision after knowing the strategy of WSN, so WSN dominates the game. However, in some cases, malware will have more initiative than WSN, and its decision will affect WSN. Unlike those methods, this article establishes a new attack–defense game based on Stackelberg game. In this game, malware is seen as the leader and WSN is the follower. When making decision, WSN has some information and knowledge about the known malware. According to the knowledge and perception about malware, WSN will predict the possible action of the opponent and then make its decision. For malware, the pessimistic situation is that the infection probability predicted by WSN is equal to its true strategy. To find the best infection probability of malware, a new game is established. In this game, malware moves first and WSN makes decision later after knowing the strategy of the leader. Comparing to WSN, malware is more dominant in this game. Through solving this game, the successful infection probability is calculated. Using the method proposed in Börcsök et al., ⁶⁷ the mean time to failure (MTTF) of a sensor node is calculated. Then, according to the approach introduced in Shen et al., ⁴⁵ the reliability of WSN is analyzed. The main work of this article is as follows:

1. Based on Stackelberg model, this article establishes a new attack–defense game. This game considers a situation in which malware is more influential than WSN. In this game, malware is the leader and WSN is regarded as the follower, and the strategy of malware affects the decision of WSN.

2. The proposed game model is compared with the simultaneous game. The results illustrate that the new game better reflects the real situations when making decisions, because the proposed game considers the influence of more relevant factors on their strategies. Through analyzing the expected payoff matrix, it can be found that the equilibrium strategy of the proposed game is better for WSN than the strategy of the simultaneous game.

3. Sufficient experimental results and analysis are given. And these results illustrate the effect of different factors on the infection probability, defense probability, and reliability of WSN. The conclusions and analysis also show that the experimental results of this method are consistent with the actual situation.

The rest of this article is organized as follows. In section “Stackelberg game,” the Stackelberg game is introduced. In section “A new attack–defense game,” a new attack–defense game based on Stackelberg game is established. In section “Stackelberg equilibrium of the proposed attack–defense game,” the proposed game is solved to find the equilibrium solution. Then in section “Analysis of reliability of a clustered WSN,” the method of computing MTTF and the method of analyzing the reliability of WSN are introduced briefly. In section “Experimental results,” some experimental results and conclusions are given. In section “Comparison with a simultaneous game–based reliability analysis approach,” the proposed method is compared with a simultaneous game–based reliability analysis approach. Finally, this article is concluded in section “Conclusion.”

Stackelberg game

The Stackelberg game is a strategic game in economics. The players of this game are two firms whose aim is to maximize their profit. Unlike the simultaneous game, in Stackelberg game the leader firm moves first and then the follower firm moves sequentially. The leader firm can be seen as a market leader whose decision influences the price and the output of the follower. In general, the price function for the duopoly industry, denoted as p, is a function of the total output $q_1+q_2$ where $q_1,q_2$ represent the output of the leader firm and the output of the follower, respectively. Suppose that the cost structure for firm i is $C_i(q_i)$ . So the profit is ${\pi }_i=p{q}_i-C_i(q_i),i=1,2$ . In this section, it assumes a linear demand structure $p=a-(q_1+q_2)$ for simplicity, where a is a constant. Assume that the cost function is $C_i(q_i)=c_i{q}_i$ , where $c_i$ is the margin cost of firm i. So the profit functions are

$$\begin{array}{c}{\pi }_1=(a-c_1-q_2)q_1-{q_1}^2\hfill \\ \multicolumn{1}{c}{{\pi }_2=(a-c_2-q_1)q_2-{q_2}^2}\end{array}$$

(1)

The game is solved by backward induction. The leader firm considers the best response of the follower and then decides its output to maximize its profit. To calculate the equilibrium solution, the best response of the follower is considered first. When the output of the leader, $q_1$ , is given, the response of the follower is to find the optimal $q_2$ to maximal ${\pi }_2$ . The first partial derivative of ${\pi }_2$ with respect to $q_2$ is

$$\frac{\partial {\pi }_2}{\partial q_2}=a-c_2-q_1-2q_2$$

(2)

Set this equation to zero for maximization, and $q_2$ satisfying $\partial {\pi }_2/\partial q_2=0$ is the best output for the follower. Then, to compute the optimal output of the leader, consider $q_2$ as a function of $q_1$

$$q_2(q_1)=\frac{a-c_2-q_1}{2}$$

(3)

The profit of the leader is modified as follows

$${\pi }_1=(a-c_1-\frac{a-c_2-q_1}{2})q_1-q_1^2$$

(4)

The first partial derivative of ${\pi }_1$ with respect to $q_1$ is

$$\frac{\partial {\pi }_1}{\partial q_1}=-q_1+\frac{a+c_2-2c_1}{2}$$

(5)

Setting this to zero for maximization, compute the best output of the leader

$$q_1^{*}=\frac{a+c_2-2c_1}{2}$$

(6)

With the function $q_2(q_1)$ , compute the best output of the follower in equilibrium

$$q_2^{*}=\frac{a+2c_1-3c_2}{4}$$

(7)

where $(q_1^{*},q_2^{*})$ is the equilibrium solution of this game.

A new attack–defense game

The previous section introduces the Stackelberg game briefly, and this section establishes a new attack–defense game based on Stackelberg game. As for known malware, WSN gains knowledge based on its experiences and perceptions about malware. According to the knowledge, WSN is able to predict the possible strategy of malware. From the perspective of malware, the worst case is that its strategy is successfully predicted by WSN and then WSN maximizes its payoff. So malware can use a Stackelberg game to model this situation where WSN makes decisions based on the predicted infection probability of malware. For malware, when selecting the optimal strategy, it assumes that the WSN successfully predicts its strategy and moves later, that is, the predicted infection probability is equal to the real infection probability. Then a new game is established to compute the optimal strategy for malware, and in this game the malware is seen as a leader and WSN as a follower. After analyzing this game, the best infection probability is calculated and the optimal strategy for WSN is also obtained.

Table 1 lists the parameters used in the proposed game. $\alpha$ is the true-positive rate, indicating the probability that the attack is correctly identified as an attack. $\beta$ , false-positive rate, is the probability that a no-attack is mistakenly identified as an attack. If malware infects successfully, malware will gain ${\omega }_I$ and WSN will lose ${\omega }_D$ . The defense cost is $C_D$ and the infection cost is $C_I$ . When malware attempts to infect, it will have a certain probability of attack failure $(1-\lambda )$ .

Table 1.

Parameters used in the proposed game.

$\alpha$	True-positive rate of WSN
$\beta$	False-positive rate of WSN
${\omega }_I$	The utility of malware for successful infection of a node
${\omega }_D$	The loss of WSN because of successful infection or false alarm
$C_I$	The cost of infection
$C_D$	The cost of defense
$\lambda$	The probability of successful infection when WSN is not defensive or unable to detectmalware

WSN: wireless sensor network.

This game has two players: malware (M) and WSN (W), both of which have two pure strategies to choose. The strategies for malware are infection (I) and non-infection $(\varphi )$ , and those for WSN are defense (D) and non-defense $(\varphi )$ . So there are four strategy combinations in this game. Table 2 illustrates the payoff matrix. The rows are the strategies of malware, and the columns are the strategies of WSN. In the cell of the table, the left one is payoff of malware, and the right one is payoff of WSN.

Table 2.

The payoff matrix of the proposed game.

	Defend (D)	Non-defend $(\varphi )$
Infect (I)	$(1-\alpha )\lambda {\omega }_I-\alpha {\omega }_I-C_I$ , $(\alpha -1)\lambda {\omega }_D+\alpha {\omega }_D-C_D$	$\lambda {\omega }_I-C_I$ , $-\lambda {\omega }_D$
Non-infect $(\varphi )$	0, $-\beta {\omega }_D-C_D$	0, 0

Analyze the strategy combination {Infect, Defend}. When using IDS to defend, WSN cannot detect the infection of malware accurately. The probability that WSN detects malware is $\alpha$ , so WSN gains $\alpha {\omega }_D$ while malware loses $\alpha {\omega }_I$ . In this situation, the probability that malware infects successfully is $(1-\alpha )\lambda$ , so malware obtains $(1-\alpha )\lambda {\omega }_I$ and WSN loses $(\alpha -1)\lambda {\omega }_D$ . In addition, malware pays the cost of infection $C_I$ and WSN pays the cost of defense $C_D$ . The payoff of malware $U_{\mathrm{ID}}^M$ and the payoff of WSN $U_{\mathrm{ID}}^W$ are

$$U_{\mathrm{ID}}^M=(1-\alpha )\lambda {\omega }_I-\alpha {\omega }_I-C_I$$

(8)

$$U_{\mathrm{ID}}^W=(\alpha -1)\lambda {\omega }_D+\alpha {\omega }_D-C_D$$

(9)

For the strategy combination {Infect, Non-defend}, malware gains $\lambda {\omega }_I$ because of the successful infection, but it pays the cost of infection $C_I$ . Thus, the payoff of malware, $U_{I\varphi }^M$ , is

$$U_{I\varphi }^M=\lambda {\omega }_I-C_I$$

(10)

On the other hand, WSN loses $\lambda {\omega }_D$ when malware infects successfully. The payoff of WSN, $U_{I\varphi }^W$ , is

$$U_{I\varphi }^W=-\lambda {\omega }_D$$

(11)

Then, for the strategy combination {Non-infect, Defend}, malware has neither gain nor loss so the payoff of malware, $U_{\varphi D}^M$ , is

$$U_{\varphi D}^M=0$$

(12)

But for WSN, in addition to defense costs $C_D$ , it loses $\beta {\omega }_D$ due to the mistaken recognition. So the payoff of WSN, $U_{\varphi D}^W$ , is

$$U_{\varphi D}^W=-\beta {\omega }_D-C_D$$

(13)

Finally, for the strategy combination {Non-infect, Non-defend}, the payoff of malware, $U_{\varphi \varphi }^M$ , is

$$U_{\varphi \varphi }^M=0$$

(14)

and the payoff of WSN, $U_{\varphi \varphi }^W$ , is

$$U_{\varphi \varphi }^W=0$$

(15)

Let $p,q$ denote the infection probability and the defense probability, respectively. According to Table 1, the expected payoff of malware $E_M$ is

$$E_M=\mathrm{pq}{\omega }_I(-\alpha \lambda -\alpha )+p(\lambda {\omega }_I-C_I)$$

(16)

$$E_W=\mathrm{pq}{\omega }_D(\alpha \lambda +\alpha )-p\lambda {\omega }_D-q\beta {\omega }_D-q{C}_D+\mathrm{pq}\beta {\omega }_D$$

(17)

Before solving this game, modify the costs $C_I$ and $C_D$ . For malware, if the infection probability is larger, its attack motivation is stronger. As a result, its preparation is more adequate and the cost of infection is correspondingly increasing. Likewise, as the defense probability increases, the cost of defense increases. Thus, $C_I$ and $C_D$ are improved as follows

$$C_I=p{\pi }_a$$

(18)

$$C_D=q{\pi }_b$$

(19)

where ${\pi }_a$ represents the basic cost of infection and $p{\pi }_a$ takes the effect of p on $C_I$ into account. In the same way, ${\pi }_b$ is the basic cost of defense and $q{\pi }_b$ considers the influence of q on $C_D$ . Then, using equation (18) to replace $C_I$ in equation (16), $E_M$ is

$$E_M=\mathrm{pq}{\omega }_I(-\alpha \lambda -\alpha )+p\lambda {\omega }_I-p^2{\pi }_a$$

(20)

Use equation (19) to replace $C_D$ in equation (17)

$$E_W=\mathrm{pq}{\omega }_D(\alpha \lambda +\alpha )-p\lambda {\omega }_D-q\beta {\omega }_D-q^2{\pi }_b+\mathrm{pq}\beta {\omega }_D$$

(21)

Stackelberg equilibrium of the proposed attack–defense game

In the last section, a new attack–defense game based on Stackelberg game is established. In this game, the malware makes the decision first and then WSN chooses its strategy. This game is solved by backward induction. To calculate the equilibrium solution, the best response of WSN is considered first. When the strategy of malware is known, the best response of WSN is changing its defense probability to maximize the expected payoff.

The first partial derivative of $E_W$ with respect to q and the second partial derivative of $E_W$ with respect to q are

$$\frac{\partial E_W}{\partial q}=p{\omega }_D(\alpha \lambda +\alpha )-\beta {\omega }_D-2q{\pi }_b+p\beta {\omega }_D$$

(22)

$$\frac{{\partial }^2{E}_W}{\partial q^2}=-2{\pi }_b$$

(23)

Because the second partial derivative of $E_W$ with respect to q is smaller than zero, $E_W$ has the maximum. Set equation (22) to zero

$$p{\omega }_D(\alpha \lambda +\alpha )-\beta {\omega }_D-2q{\pi }_b+p\beta {\omega }_D=0$$

When p is known, q satisfying this equation is the optimal defense probability that makes $E_W$ maximal. q is considered as a function of p

$$q=\frac{p{\omega }_D(\alpha +\alpha \lambda )+p\beta {\omega }_D-\beta {\omega }_D}{2{\pi }_b}$$

(24)

After obtaining the response function of the follower, the infection probability that maximizes the expected payoff of malware can be calculated. The first partial derivative of $E_M$ with respect to p and the second partial derivative of $E_M$ with respect to p are

$$\frac{\partial E_M}{\partial p}=(q+p\frac{\partial q}{\partial p}){\omega }_I(-\alpha \lambda -\alpha )+\lambda {\omega }_I-2p{\pi }_a$$

(25)

$$\frac{{\partial }^2{E}_M}{\partial p^2}=-2{\pi }_a$$

(26)

Because the second partial derivative is smaller than zero, $E_M$ has the maximum. Set equation (25) to zero for maximization. Replace q with equation (24) and simplify the formula to obtain p

$$p=\frac{2\lambda {\omega }_D{\omega }_I+\beta {\omega }_D{\omega }_I(\alpha +\alpha \lambda )}{4{\pi }_b{\pi }_a+2{\omega }_I{\omega }_D{(\alpha \lambda +\alpha )}^2+2\beta {\omega }_D{\omega }_I(\alpha \lambda +\alpha )}$$

(27)

Through solving the game, malware obtains the optimal infection probability that maximizes its expected payoff. With equation (24), WSN can calculate the optimal defense probability when p is determined. So the equilibrium solution of the proposed game is $(p,q)$ .

Analysis of reliability of a clustered WSN

Computing the MTTF of a sensor node

The reliability of the WSN indicates the probability that the WSN will work normally. MTTF denotes the expected time to failure for a sensor node, and it is a typical way to analyze the reliability of WSN. Based on the Markov chain model, the MTTF of the sensor node can be calculated. The Markov chain model describes the transition relationship between different states. In order to build the Markov chain model, the probability that a normal node is infected successfully is calculated first. In the last section, a new attack–defense game based on Stackelberg game is established. By solving this game, the infection probability and the defense probability are calculated. But not all attacks will succeed because of the defense of WSN or other reasons. So the successful infection probability, denoted as $P_{\mathrm{infected}}$ , is

$$P_{\mathrm{infected}}=\mathrm{pq}(1-\alpha )\lambda +p(1-q)\lambda$$

(28)

where p and q are the infection probability and defense probability of the equilibrium solution, respectively. This equation consists of two parts: the left is the successful infection probability when WSN defends, and the right is the successful infection probability when WSN chooses not to defend. Simplifying it, we obtain

$$P_{\mathrm{infected}}=p(1-q\alpha )\lambda$$

(29)

Figure 1 illustrates the Markov chain model mentioned in Wang et al. ⁴⁶ From this model, the state transition probability matrix is obtained. As shown in this figure, there are seven states.

Figure 1.

The Markov chain model of state transition.

A susceptible node works normally, but is vulnerable to malware. A infected node tries to infect other nodes, while a repaired node is immune to known malware. When the node is dormant, it cannot be infected or propagate malware to the adjacent nodes. A node becomes unusable because of exhaustion or destruction. And $P_{\mathrm{xy}}$ represents the transition probability from state x to state y (e.g. $P_{\mathrm{SR}}$ denotes the state transition probability from the susceptible to the repaired). Due to the successful infection, the state of sensor node changes from the susceptible to the infected. But, through adding security paths, the susceptible node becomes repaired and is immune to known malware. Because of repairing, the infected node becomes repaired. However, when new malware comes up, the repaired node becomes susceptible again. In order to save energy, sensor nodes have scheduled dormancy and work. So nodes periodically change between work and dormancy. Besides, when energy is exhausted, the node changes from other states to the dead.

$P_{\mathrm{SI}}$ , the state transition probability from the susceptible to the infected, is determined by the strategies of malware and WSN in the adversarial decision making. According to the equilibrium solution of the proposed game, the successful infection probability $P_{\mathrm{infected}}$ is calculated. When malware infects successfully, the node changes from the susceptible to the infected. So $P_{\mathrm{SI}}$ is equal to $P_{\mathrm{infected}}$ , and when analyzing the experimental results, $P_{\mathrm{SI}}$ is used to represent the successful infection probability.

The state transition probability matrix denoted as P is obtained from the Markov chain model above. And in this matrix, the sum of each row is one

$$\left[\begin{array}{ccccccc}{P}_{\mathrm{SS}}\hfill & P_{S\stackrel{⌢}{S}}\hfill & P_{\mathrm{SR}}\hfill & P_{S\stackrel{⌢}{R}}\hfill & P_{\mathrm{SI}}\hfill & P_{S\stackrel{⌢}{I}}\hfill & P_{\mathrm{SD}}\hfill \\ \multicolumn{1}{c}{P_{\stackrel{⌢}{S}S}}& P_{\stackrel{⌢}{S}\stackrel{⌢}{S}}\hfill & P_{\stackrel{⌢}{S}R}\hfill & P_{\stackrel{⌢}{S}\stackrel{⌢}{R}}\hfill & P_{\stackrel{⌢}{S}I}\hfill & P_{\stackrel{⌢}{S}\stackrel{⌢}{I}}\hfill & P_{\stackrel{⌢}{S}D}\hfill \\ \multicolumn{1}{c}{P_{\mathrm{RS}}}& P_{R\stackrel{⌢}{S}}\hfill & P_{\mathrm{RR}}\hfill & P_{R\stackrel{⌢}{R}}\hfill & P_{\mathrm{RI}}\hfill & P_{R\stackrel{⌢}{I}}\hfill & P_{\mathrm{RD}}\hfill \\ \multicolumn{1}{c}{P_{\stackrel{⌢}{R}S}}& P_{\stackrel{⌢}{R}\stackrel{⌢}{S}}\hfill & P_{\stackrel{⌢}{R}R}\hfill & P_{\stackrel{⌢}{R}\stackrel{⌢}{R}}\hfill & P_{\stackrel{⌢}{R}I}\hfill & P_{\stackrel{⌢}{R}\stackrel{⌢}{I}}\hfill & P_{\stackrel{⌢}{R}D}\hfill \\ \multicolumn{1}{c}{P_{\mathrm{IS}}}& P_{I\stackrel{⌢}{S}}\hfill & P_{\mathrm{IR}}\hfill & P_{I\stackrel{⌢}{R}}\hfill & P_{\mathrm{II}}\hfill & P_{I\stackrel{⌢}{I}}\hfill & P_{\mathrm{ID}}\hfill \\ \multicolumn{1}{c}{P_{\stackrel{⌢}{I}S}}& P_{\stackrel{⌢}{I}\stackrel{⌢}{S}}\hfill & P_{\stackrel{⌢}{I}R}\hfill & P_{\stackrel{⌢}{I}\stackrel{⌢}{R}}\hfill & P_{\stackrel{⌢}{I}I}\hfill & P_{\stackrel{⌢}{I}\stackrel{⌢}{I}}\hfill & P_{\stackrel{⌢}{I}D}\hfill \\ \multicolumn{1}{c}{P_{\mathrm{DS}}}& P_{D\stackrel{⌢}{S}}\hfill & P_{\mathrm{DR}}\hfill & P_{D\stackrel{⌢}{R}}\hfill & P_{\mathrm{DI}}\hfill & P_{D\stackrel{⌢}{I}}\hfill & P_{\mathrm{DD}}\hfill \end{array}\right]$$

(30)

Then the approach proposed in Börcsök et al. ⁶⁷ is used to compute the MTTF of a sensor node. Separate out the normal working states of the node $S,R$ , and obtain a small probability matrix, Q

$$\left[\begin{array}{cc}{P}_{\mathrm{SS}}\hfill & P_{\mathrm{SR}}\hfill \\ \multicolumn{1}{c}{P_{\mathrm{RS}}}& P_{\mathrm{RR}}\hfill \end{array}\right]$$

(31)

Then compute matrix M, where I is the unit matrix

$$M=I-Q$$

(32)

The matrix N is the inverse of matrix M

$$N=[M{]}^{-1}$$

(33)

Finally, sum up the first row of matrix N to obtain the value of MTTF of a sensor node, which is represented by $\eta$ .

Method of reliability analysis

Then the reliability of WSN is analyzed with the MTTF of a sensor node. This section applies the method developed in Shen et al. ⁴⁵ to analyze the reliability of WSN. Using the MTTF of a sensor node, the reliability of a sensor node is computed

$$R_{\mathrm{node}}(t)=\exp (-\frac{t}{\eta })$$

(34)

Figure 2 illustrates the topology of a clustered WSN. There is a cluster head in a cluster of sensor nodes for coordinating sensor nodes. This structure is a two-layer model, in which the upper part comprises cluster heads and the lower part contains sensor nodes. Sensor nodes transmit sensed data to the responsible cluster head. A cluster is a parallel system consisting of a number of sensor nodes, so, as long as a node can work normally, the cluster can work normally. Then the cluster head collects and transmits data to the base station via other cluster heads in this route. Each route that contains a set of clusters is a serial system because the route does not work even if one of the clusters fails. In a clustered WSN, the sensed data can be transmitted to the base station through different routes. As long as a route in WSN works normally, the WSN works normally, so a clustered WSN is a parallel system. According to the topology, the reliability of WSN can be analyzed.

Figure 2.

The topology of a WSN.

The reliability of a cluster denoted by $R_{\mathrm{cluster}}(t)$ is computed

$$R_{\mathrm{cluster}}(t)=1-\underset{\mathrm{node}\in \mathrm{cluster}}{\Pi }(1-R_{\mathrm{node}}(t))$$

(35)

Then the reliability of the route is computed

$$R_{\mathrm{route}}(t)=\underset{\mathrm{cluster}\in \mathrm{route}}{\Pi }{R}_{\mathrm{cluster}}(t)$$

(36)

At last, the reliability of WSN is

$$R(t)=1-\underset{\mathrm{route}}{\Pi }(1-R_{\mathrm{route}}(t))$$

(37)

Experimental results

Infection probability

In this section, some experimental results are presented to illustrate the influence of true-positive rate $\alpha$ and false-positive rate $\beta$ on the equilibrium solution of the proposed game. Then, to analyze how $\alpha$ and $\beta$ impact successful infection probability $P_{\mathrm{SI}}$ , the MTTF of a sensor node and the reliability of WSN are calculated. And the influence of infection cost and defense cost on the reliability is discussed. Some parameters are set, ${\omega }_I=40$ , ${\omega }_D=50$ , ${\pi }_b=10$ , ${\pi }_a=20$ , $\lambda =0.5$ .

Figure 3 shows the influence of $\alpha$ and $\beta$ on p. The upper image has three curves, with the $\beta$ values of $0.01,0.05$ , and 0.1, respectively. This picture illustrates that when $\alpha$ increases from 0.7 to 0.98, p is reduced. For example, when $\beta$ is 0.05, p falls from 0.093 to 0.056 as $\alpha$ increases from 0.7 to 0.98. The $\alpha$ values for the three curves in the lower image are $0.7,0.8,\mathrm{and}0.9$ , and the curves show the trend of p. The figure demonstrates that p increases when $\beta$ increases from 0.01 to 0.1. For example, when $\alpha =0.8$ , p increases from 0.064 to 0.091 as $\beta$ increases from 0.01 to 0.1.

Figure 3.

The influence of $\alpha$ and $\beta$ on the infection probability.

If $\alpha$ is higher, WSN has a higher probability to detect infection of malware accurately, and malware is more difficult to attack successfully. For malware, it results in the reduction of its payoff of infection. In order to maximize its expected payoff, malware will choose lower infection probability as its strategy. So when $\alpha$ increases, p will decrease. $\beta$ , false alarm rate, is the probability of fraudulently or erroneously detecting an infection. The false alarm results in the waste of defense resource. If $\beta$ of a WSN is higher, its payoff of strategy defense will decrease. In this case, lower defense probability is a better strategy for WSN. So a higher $\beta$ is beneficial to malware, and malware can select a higher infection probability to increase its expected payoff. Therefore, in order to reduce the infection probability of malware, WSN can increase $\alpha$ or reduce $\beta$ .

Defense probability

Figure 4 shows the effect of $\alpha$ and $\beta$ on q. The upper figure illustrates the change of q when $\alpha$ increases from 0.7 to 0.98. As shown in the figure, when $\beta =0.05$ , q decreases from 0.131 to 0.088 as $\alpha$ increases from 0.7 to 0.98. So q decreases when $\alpha$ increases. In the lower figure, q varies as $\beta$ increases from 0.01 to 0.1. It can be observed from the curve with $\alpha =0.8$ that q decreases from 0.169 to 0.045 as $\beta$ increases from 0.01 to 0.1.

Figure 4.

The influence of $\alpha$ and $\beta$ on the defense probability.

As analyzed in the last subsection, WSNs with higher $\alpha$ values are more difficult to be successfully attacked, and malware will choose a lower infection probability. So WSN reduces its defense probability to reduce the cost of defense and increase its payoff. But if the false alarm rate $\beta$ increases, the loss caused by misidentification would increase. In order to maximize the expected payoff, WSN would choose a lower defense probability.

Successful infection probability and MTTF

As introduced in the last section, when malware chooses to attack, there is a probability that malware attacks failed. And the successful infection probability $P_{\mathrm{SI}}$ is $P_{\mathrm{SI}}=p(1-q\alpha )\lambda$ . Figure 5 illustrates the influence of $\alpha$ and $\beta$ on the successful infection probability. When $\alpha$ increases, $P_{\mathrm{SI}}$ decreases. For example, when $\beta =0.05$ , $P_{\mathrm{SI}}$ decreases from 0.042 to 0.026 as $\alpha$ increases from 0.7 to 0.98. When the detection rate is high, malware is easier to be recognized by WSN and $P_{\mathrm{SI}}$ is low. But when the false alarm rate is high, this situation is adverse to WSN because of additional cost. On the other hand, it is beneficial to malware so that $P_{\mathrm{SI}}$ is high. So when $\beta$ increases, $P_{\mathrm{SI}}$ increases. When $\alpha =0.7$ , $P_{\mathrm{SI}}$ increases from 0.035 to 0.052 as $\beta$ increases from 0.01 to 0.1. So WSN can improve the detection rate or reduce the false alarm rate to reduce the probability of successful infection.

Figure 5.

The influence of $\alpha$ and $\beta$ on the successful infection probability.

In order to compute MTTF of a sensor node, the parameters of state transition probabilities are set as follows

$$\begin{array}{c}{P}_{S\stackrel{⌢}{S}}=P_{R\stackrel{⌢}{R}}=P_{I\stackrel{⌢}{I}}=0.2\hfill \\ \multicolumn{1}{c}{P_{\stackrel{⌢}{S}S}=P_{\stackrel{⌢}{I}I}=P_{\stackrel{⌢}{R}R}=0.25}\\ \multicolumn{1}{c}{P_{S}D=P_{R}D=0.005,P_{I}D=0.05,P_{S}R=P_{I}R=0.05}\end{array}$$

Setting the other transition probabilities to zero, the P matrix is

$$\left[\begin{array}{ccccccc}0.745-P_{\mathrm{SI}}\hfill & 0.2\hfill & 0.05\hfill & 0\hfill & 0\hfill & P_{\mathrm{SI}}\hfill & 0.005\hfill \\ \multicolumn{1}{c}{0.25}& 0.75\hfill & 0\hfill & 0\hfill & 0\hfill & 0\hfill & 0\hfill \\ \multicolumn{1}{c}{0}& 0\hfill & 0.795\hfill & 0.2\hfill & 0\hfill & 0\hfill & 0.005\hfill \\ \multicolumn{1}{c}{0}& 0\hfill & 0.25\hfill & 0.75\hfill & 0\hfill & 0\hfill & 0\hfill \\ \multicolumn{1}{c}{0}& 0\hfill & 0.05\hfill & 0\hfill & 0.65\hfill & 0.2\hfill & 0.05\hfill \\ \multicolumn{1}{c}{0}& 0\hfill & 0\hfill & 0\hfill & 0.25\hfill & 0.75\hfill & 0\hfill \\ \multicolumn{1}{c}{0}& 0\hfill & 0\hfill & 0\hfill & 0\hfill & 0\hfill & 1\hfill \end{array}\right]$$

Figure 6 shows the trend of MTTF as $\alpha$ and $\beta$ change. When $\alpha$ increases or $\beta$ decreases, the MTTF of the sensor node increases. As shown in the graph, when $\alpha =0.8$ , MTTF decreases from 3.537 to 3.347 as $\beta$ increases from 0.01 to 0.1. When $\beta =0.1$ , MTTF increases from 3.259 to 3.462 as $\alpha$ increases from 0.7 to 0.98.

Figure 6.

The influence of $\alpha$ and $\beta$ on MTTF.

According to the former experimental results, when the detection rate is higher, the successful infection probability is lower which means that it is more difficult to infect. So the sensor node works normally for a longer time, and MTTF is larger. But when the false alarm rate is higher, the loss of WSN is more and the infection probability is higher. Successful infection results in the failure of WSN, so $P_{\mathrm{SI}}$ is larger and the MTTF is smaller.

Reliability of WSNs

The reliability of WSN can be calculated and analyzed using the methods mentioned in the previous section. This subsection assumes that the WSN has four routes, one route has four clusters, and one cluster has four nodes. Then it analyzes the influence of $\alpha$ and $\beta$ on the reliability and the influence of infection cost ${\pi }_a$ and defense cost ${\pi }_b$ on the reliability.

The first subgraph in Figure 7 shows that the reliability of WSN varies with $\alpha$ . This figure illustrates that reliability increases when $\alpha$ increases. The second subgraph the effect of $\beta$ on the reliability of WSN, and it indicates that reliability decreases when $\beta$ increases. If WSN has a higher $\alpha$ or a lower $\beta$ , the successful infection probability $P_{\mathrm{SI}}$ will decrease. And WSN is more difficult to be attacked and destroyed, so it can work normally for a longer time. Thus, WSN maintains a higher reliability when $\alpha$ is higher or $\beta$ is lower. In order to increase the reliability, WSN can improve the true-positive rate or reduce the false-positive rate.

Figure 7.

The influence of $\alpha$ and $\beta$ on reliability of a WSN.

Figure 8 illustrates the impact of infection cost ${\pi }_a$ and defense cost ${\pi }_b$ . In the first subgraph, the reliability of the curve, the infection cost of which is 30, is higher than that of the other curve with the infection cost of 10. When malware needs more cost to infect, the payoff of infection is reduced and prefers to reduce the infection probability. Therefore, the WSN can work normally for a longer period of time, and the reliability is also higher. In the second subgraph, the value of the curve, the defense cost of which is 10, is higher than the curve with the defense cost of 15. It shows that a low defense cost is beneficial to maintain higher reliability. If WSN costs less defense cost, it can select a higher defense probability as its strategy. So the sensor node is more difficult to be infected and the WSN has higher reliability.

Figure 8.

The influence of ${\pi }_a$ and ${\pi }_b$ on reliability of a WSN.

Comparison with a simultaneous game–based reliability analysis approach

This section compares the proposed method with the existing method based on a simultaneous game and analyzes the differences between them. The simultaneous game discussed in Shen et al. ⁴⁵ is one in which attacker and defender make decisions simultaneously. Table 3 illustrates the payoff matrix of the simultaneous game; let P and Q denote the infection probability and defense probability, respectively. In equilibrium, the attacker has no preference between infection and non-infection, so the expected payoff of infection is equal to that of non-infection. The expected payoffs are as follows

$$E_{\mathrm{infect}}=[(1-\alpha )\lambda {\omega }_I-\alpha {\omega }_I-{\pi }_a]Q+(\lambda {\omega }_I-{\pi }_a)(1-Q)$$

(38)

$$E_{\mathrm{non}-\mathrm{infect}}=0$$

(39)

Table 3.

The payoff matrix of the simultaneous game.

	Defend (D)	Non-defend $(\varphi )$
Infect (I)	$(1-\alpha )\lambda {\omega }_I-\alpha {\omega }_I-{\pi }_a$ , $(\alpha -1)\lambda {\omega }_D+\alpha {\omega }_D-{\pi }_b$	$\lambda {\omega }_I-{\pi }_a$ , $-\lambda {\omega }_D$
Non-infect $(\varphi )$	0, $-\beta {\omega }_D-{\pi }_b$	0, 0

Let $E_{\mathrm{infect}}$ equal $E_{\mathrm{non}-\mathrm{infect}}$ ; then calculate the defense probability when in equilibrium

$$Q=\frac{\lambda {\omega }_I-{\pi }_a}{\alpha \lambda {\omega }_I+\alpha {\omega }_I}$$

(40)

In the same way, compute the infection probability

$$P=\frac{\beta {\omega }_D+{\pi }_b}{\alpha {\omega }_D+\lambda \alpha {\omega }_D+\beta {\omega }_D}$$

(41)

Set ${\omega }_I=40$ , ${\omega }_D=50$ , $\alpha =0.8$ , $\beta =0.1$ , $\lambda =0.5$ , and ${\pi }_b=10$ . Figure 9 illustrates the influence of infection cost ${\pi }_a$ on the infection probability. The second subgraph in Figure 9 demonstrates that in the simultaneous game the infection probability remains unchanged when ${\pi }_a$ increases, while the first subgraph demonstrates that in the proposed game the infection probability decreases when ${\pi }_a$ increases. However, in practice, the infection cost has an influence on the strategy of malware. In order to maximize its payoff, malware would take infection cost into account. The higher the cost is, the smaller the infection probability is. But in the simultaneous game ${\pi }_a$ has no effect on the infection probability. The proposed game considers the influence of ${\pi }_a$ on the infection probability.

Figure 9.

The influence of ${\pi }_a$ on the infection probability.

Figure 10 illustrates that the defense probability varies with defense cost ${\pi }_b$ when ${\pi }_a=15$ . The second subgraph demonstrates that ${\pi }_b$ has no effect on the defense probability in the simultaneous game, while the first subgraph demonstrates that the defense probability increases when ${\pi }_b$ increases. ${\pi }_b$ is an important factor affecting the decisions of WSN. If the cost is high, WSN will reduce the defense probability to make expected payoff maximal. But the higher defense cost also causes the increase of the infection probability. Then the loss because of infection results in the increase of the defense probability. The proposed game considers the influence of ${\pi }_b$ on the defense probability, but in the simultaneous game there is almost no relation between ${\pi }_b$ and the defense probability.

Figure 10.

The influence of ${\pi }_b$ on the defense probability.

After analyzing the influence of infection cost and defense cost on the strategies of WSN and malware, the influence of ${\omega }_I$ and ${\omega }_D$ is analyzed.

Figure 11 shows the influence of ${\omega }_I$ on the infection probability. From the first subgraph, it can be found that the infection probability increases as ${\omega }_I$ increases. But in the second subgraph $\omega$ has no impact on the infection probability. ${\omega }_I$ is the utility of malware for successful infection. If the value of ${\omega }_I$ is larger, the payoff of infection is greater. So malware will choose a higher infection probability as its strategy. However, the simultaneous game does not reflect it.

Figure 11.

The influence of ${\omega }_I$ on the infection probability.

Figure 12 illustrates the influence of ${\omega }_D$ on the defense probability. ${\omega }_D$ is the loss of WSN because of infection. And the increase of ${\omega }_D$ tends the loss of false alarm to increase. So the payoff of defense decreases and WSN reduces the defense probability to maximize its expected payoff. The curve in the first subgraph shows this trend, but the curve of the simultaneous game shows that ${\omega }_D$ has no impact on the defense probability.

Figure 12.

The influence of ${\omega }_D$ on the defense probability.

The previous sections discuss the influence of $\beta$ on the defense probability in the proposed game. Figure 13 illustrates how $\beta$ affects the defense probability in the simultaneous game. When $\alpha =0.8$ , ${\pi }_a=15$ , and $\beta$ increases from 0.01 to 0.1, the defense probability remains the same. However, the false alarm causes the loss so WSN will change the strategy as $\beta$ changes. The proposed game takes the loss of false alarm into account, while the simultaneous game does not consider the influence of $\beta$ .

Figure 13.

The influence of $\beta$ on the defense probability in the simultaneous game.

Then this section calculates and compares the expected payoffs of the two players under different strategies. Assume that both of the players have two models to choose, that is, the simultaneous model and the proposed model. Set ${\omega }_I={\omega }_D=50$ , $\alpha =0.7$ , $\beta =0.1$ , $\lambda =0.5$ , ${\pi }_a=20$ , and ${\pi }_b=10$ . The equilibrium solution of the proposed game is $\{0.112,0.071\}$ , namely, the infection probability is 0.112 and the defense probability is 0.071. The equilibrium solution of the simultaneous game is $\{0.261,0.095\}$ . Tables 4 and 5 show the expected payoffs of malware and WSN under four different situations, respectively. In the tables, $P_{\mathrm{simultaneous}}$ and $Q_{\mathrm{simultaneous}}$ indicate that malware and WSN use the simultaneous model; $P_{\mathrm{new}}$ and $Q_{\mathrm{new}}$ indicate that malware and WSN use the new model. The two tables illustrate that the strategy from the simultaneous game is better for malware and the equilibrium strategy of the proposed game is a better choice for WSN. So for WSN it can use the proposed model to increase its expected payoff.

Table 4.

The expected payoff of malware.

	$P_{\mathrm{simultaneous}}$	$P_{\mathrm{new}}$
$Q_{\mathrm{simultaneous}}$	0	0
$Q_{\mathrm{new}}$	0.337	0.144

Table 5.

The expected payoff of WSN.

	$P_{\mathrm{simultaneous}}$	$P_{\mathrm{new}}$
$Q_{\mathrm{simultaneous}}$	−6.522	−3.606
$Q_{\mathrm{new}}$	−6.522	−3.394

WSN: wireless sensor network.

Therefore, the proposed method based on Stackelberg game considers more relevant factors when analyzing infection probability and defense probability, but the existing method based on the simultaneous game ignores the influences of these parameters. However, these factors affect the decisions of malware and WSN in practice. Through analyzing the expected payoffs of WSN and malware under different strategies, it can be observed that the equilibrium strategy of the new game is better for WSN.

Conclusion

This article proposes a new attack–defense game between malware and WSN based on Stackelberg game. With the equilibrium solution, the reliability of WSN is analyzed. This game considers a situation that malware is more initiative than WSN in adversarial decision making. Malware is regarded as a leader and WSN as the follower. The malware decides its strategy first and then WSN makes its decision according to the action of the former. Compared with the method based on a simultaneous game, this method considers the influence of more relevant parameters. And the equilibrium strategy is better for WSN than the strategy of the simultaneous game. In addition, sufficient experimental results and analysis illustrate the influence of different parameters on the equilibrium solution and reliability of WSN. In future research, when researching the optimal strategy for WSN in adversarial decision making, the more complex situation can be considered where WSN and malware both have some methods to select, and the relationship of topology and strategy selection can be taken in account.