Voting mechanism for trustworthy localization in wireless sensor networks

Abstract

This work aspires to provide a trustworthy solution for target localization in adverse environments, where malicious nodes, capable of manipulating distance measurements (i.e., performing spoofing attacks), are present, thus hindering accurate localization. Besides localization, its other goal is to identify (detect) which of the nodes participating in the process are malicious. This problem becomes extremely important with the forthcoming expansion of IoT and smart cities applications, that depend on accurate localization, and the presence of malicious attackers can represent serious security threats if not taken into consideration. This is the case with most existing localization systems which makes them highly vulnerable to spoofing attacks. In addition, existing methods that are intended for adversarial settings consider very specific settings or require additional knowledge about the system model, making them only partially secure. Therefore, this work proposes a novel voting scheme based on clustering and weighted central mass to securely solve the localization problem and detect attackers. The proposed solution has two main phases: 1) Choosing a cluster of suitable points of interest by taking advantage of the problem geometry to assigning votes in order to localize the target, and 2) Attacker detection by exploiting the location estimate and basic statistics. The proposed method is assessed in terms of localization accuracy, success in attacker detection, and computational complexity in different settings. Computer simulations and real-world experiments corroborate the effectiveness of the proposed scheme compared to state-of-the-art methods, showing that it can accomplish an error reduction of and is capable of achieving almost perfect attacker detection rate when the ratio between attacker intensity and noise standard deviation is significant.

1 Introduction

Recently, wireless sensor networks (WSNs) have attracted much interest of the scientific community, partially due to their ability to work in harsh environments, ease and low costs of implementation (Tomic et al., 2018; Matos-Carvalho et al., 2021), and wide variety of applications (Oigbochie et al., 2021; Qiang, 2014). From the localization perspective, generally, WSNs are composed of two distinct types of nodes: 1) anchor nodes, whose locations are known and serve as reference points in the localization process and 2) target nodes, whose locations are unknown and one desires to determine them. Naturally, it is expected that nodes are capable to communicate with each other in order to execute the localization task. In this work, a non-cooperative network, where targets are only allowed to communicate with anchors, is considered.

In most applications, data acquired by sensors are only useful if they can be associated with the respective physical location (Bazzi et al., 2016a, Shi, 2024). However, most existing localization systems overlook possible security threats (Tomic and Beko, 2020; Coluccia and Fascista, 2018, Bazzi et al., 2016b, Bazzi et al., 2018). Therefore, if these systems are exposed to malicious attacks, they can result in catastrophic outcomes (e.g., failure in a self-driving car collision system, change in drone trajectory, etc.). Mainly for this reason, localization systems should be developed for potentially adversarial environments, where a malicious (or damaged) sensor can produce false distance measurements (spoofing attacks) to manipulate the localization process.

Perhaps the easiest and most common way of localization is to equip sensors with global positioning system (GPS) receivers. However, this solution has several undesirable consequences, such as increased implementation costs and infeasibility in some environments (e.g., indoor, urban areas, forests, etc.). In addition, from the security point of view, GPS is considered a civilian localization system (e.g., uses unencrypted signals); thus, it is not very difficult to manipulate (spoof) it. Although there are different types of attacks in WSNs nowadays, this work focuses its attention on spoofing attacks specifically due to their close relationship with distance measurements (proximity). These attacks include forging distance measurements (either by reducing or enlarging them) that can be performed in various non-cryptographic ways, meaning that no infraction of upper-layer security protocols for carrying out these attacks is at risk (for instance, an attacker can add a physical obstacle between two nodes or change node’s transmit power without informing its neighbours). Moreover, these attacks (including GPS spoofing) come at a relatively low cost, but can cause severe problems in many systems (Kugler, 2017). Since spoofing attacks are closely related with distance they have real-world impact and are used in car thefts, executions of unauthorized payments and manipulation of navigation (Singh et al., 2019).

1.1 Related work

Secure localization in WSNs has attracted interest in the scientific literature (Li et al., 2005; Liu et al., 2007; Garg et al., 2012; Liu et al., 2019; Li et al., 2021; Beko and Tomic, 2021; Tomic and Beko, 2022; Mukhopadhyay et al., 2021; Tomic and Beko, 2024a; Tomic and Beko, 2024b). Still, there is no uniquely accepted solution and there is room for improvement in all aspects (localization accuracy, detection rates and complexity).

In Li et al. (2005), two secure localization solutions were explored: least median of squares (LMS) and radio frequency (RF) fingerprinting. LMS selects the subset of anchors with the least median residues, while RF fingerprinting employs a median-based distance metric. The work in Liu et al. (2007) introduced attack-resistant minimum mean square estimation (ARMMSE) and a voting scheme (VS). ARMMSE detects and removes malicious anchors based on inconsistencies, whereas VS assigns votes to grid cells based on distance measurements, identifying the target’s likely location. An iterative algorithm using gradient descent was proposed in Garg et al. (2012) for both uncoordinated and coordinated attacks. Malicious anchors were identified by their higher residues and excluded from the localization process. In Liu et al. (2019), a density-based spatial clustering method classified location points as normal or abnormal, followed by a sequential probability ratio test to authenticate anchors using received signal strength (RSS) and time of arrival (TOA) data. The study in Li et al. (2021) addressed secure localization and velocity estimation in mobile WSNs with malicious anchors, using a maximum a posteriori (MAP) estimator solved via variational message passing. In Beko and Tomic (2021), an initial location estimate was obtained via weighted central mass (WCM), followed by distance-based filtering and a generalized trust region sub-problem (GTRS) solved using a bisection method. This was extended in Tomic and Beko (2022) to a general range-based scenario using a generalized likelihood ratio test (GLRT) and law of cosines (LC). The work in Mukhopadhyay et al. (2021) proposed secure weighted least squares (SWLS) for uncoordinated spoofing attacks and l1-norm (LN-1E) for coordinated attacks. SWLS filters malicious nodes based on estimated noise standard deviation, while LN-1E uses 3D plane fitting and K-means clustering to separate malicious anchors. In Tomic and Beko (2024a), a robust min-max approach was formulated as a second-order cone programming (R-SOCP) problem and a robust GTRS (R-GTRS). Lastly, Tomic and Beko (2024b) introduced an alternating direction method of multipliers (ADMM) approach, applying a weighted least squares criterion within a decomposition-coordination iterative scheme.

Even though the methods in Li et al. (2005), Tomic and Beko (2024b) work well in the settings under scrutiny in the respective works, they either require additional knowledge on certain parameters, such as noise power or the maximum magnitude of an attack (e.g., Liu et al., 2007, Liu et al., 2019, Li et al., 2021, Mukhopadhyay et al., 2021, Tomic and Beko, 2024a) and/or convex relaxations/approximations that expand the set of possible solution leading to higher error (e.g., Li et al., 2005, Li et al., 2021, Tomic and Beko, 2024a) or are executed iteratively (e.g., Garg et al., 2012, Tomic and Beko, 2024b), leaving room for improvement in all aspects (localization accuracy, detection rates and complexity). These limitations could severely deteriorate their performance in scenarios where the required parameters are unknown or imperfectly known, i.e., where problem assumptions do not hold, resulting in the applied relaxations/approximations not being sufficiently tight or lead to burdensome computations that might even raise convergence issues. Furthermore, the majority of the existing works assume knowledge about the type of spoofing attacks (uncoordinated or coordinated) under which the network is beforehand and develop a solution for that specific type of attack. However, it is not possible to acquire such knowledge in practice. Therefore, there are still some challenges to address and room for improvement in all main aspects of the considered problem.

1.2 Main contributions of the current work

Throughout the work, uppercase bold type, lowercase bold type, and regular type of fonts are used to denote matrices, vectors, and scalars, respectively. denotes the -dimensional real Euclidean space. Symbol represent the transpose operator, while and denote the binomial coefficients and the projection of the point onto the set , respectively. The normal (Gaussian) distribution with mean and variance is denoted by . The -dimensional identity matrix is denoted by and the matrix of all zeros by (if no ambiguity can occur, subscripts are omitted). denotes the vector norm defined by , where is a column vector. The -th column of the matrix is denoted by and an estimate of a parameter with .

The rest of this paper is structured as follows: Section 2 defines the problem, while Section 3 details the proposed solution. Section 4 presents performance comparisons, and Section 5 summarizes the key findings.

2 Problem formulation

Let us consider a 2-dimensional, non-cooperative and static WSN, where a single target, whose true location is unknown and denoted by , is located at a time by the help of a set of anchors whose true locations are known and denoted by . Some of the anchors are assumed malicious and try to disrupt the location process by manipulating their distance measurements (spoofing attacks). The target receives radio signals (from which it measures the RSS values) from the anchors. Note that in this work the measurement acquisition is assumed practically instantaneous; thus, ambient conditions do not change significantly during the measurement process, having very little to no impact on the deviation of the RSS measurements. This work considers two types of spoofing attacks: coordinated and uncoordinated.

2.1 Uncoordinated attack

In this setting, the genuine anchors have a predefined transmitted power, while the malicious anchors change the transmitted power arbitrarily without notifying the network. The -th RSS measurement sample between the target and the -th anchor can be modeled aswhere

and and are, respectively, the set of malicious and honest nodes, is the RSS at a short reference distance (for simplicity referred to as the transmitted power), is the path loss exponent (PLE) representing the decay of the signal strength with distance, is the noise term modeled as , and is the intensity of the spoofing attack of the -th anchor. Note that in this work the measurement acquisition is assumed practically instantaneous; thus, ambient conditions do not change significantly during the measurement process, having very little to no impact on the deviation of the RSS measurements.

Note that, in contrast to Beko and Tomic (2021), where malicious anchors could only enlarge their distance measurements, in this work it is assumed that the attackers can either reduce or enlarge distance measurements. For simplicity, it is assumed that the variance of all measurements is equal (for every link and sample), i.e., for . Moreover, to easier combat outliers and also for the sake of notation simplicity and without loss of generality, the median of all RSS measurements in (Equation 1) from the -th anchor is used in the following derivations.

Figure 1a shows an uncoordinated attack, where two (represented by red squares) of the five anchors are malicious and report, independently, false distance measurements, aggravating the localization process. In the concrete case, both malicious anchors reduced their measurements independently from each other, resulting in two intersection points of the red dashed circles to be relatively remote from the main cluster of the intersection points and thus, from the true target location.

FIGURE 1

2.2 Coordinated attack

In coordinated attacks the malicious anchors communicate with each other to agree on a (false) location for the target. The idea is to make the network believe that the target is at a different location than it actually is. Similar to Mukhopadhyay et al. (2021), the coordinated attack can be modeled aswhere is the false location that the attackers agree upon.

Figure 1b shows an example of a coordinated attack, where two malicious anchors (represented by a red square) attempt to make the network think that the location of the target is the one represented by a blue triangle instead of the real target position represented by a blue cross .

Note that (Equation 2) is a special case of (Equation 1), having . Hence, this work adopts (Equation 1) as the general model for both types of spoofing attacks. From it, the probability density function of parametrized by the median RSS observation at the -th anchor is given bywhere denotes the exponential function. Minimizing (Equation 3) leads to the ML estimator Kay (1993). However, the ML estimator is non-convex and therefore difficult to tackle directly. In this work, a VS algorithm is introduced to estimate the target’s location instead.

3 The proposed approach for the secure localization problem

This section describes the derivation of the proposed algorithm for secure localization. It is organized into three parts: 1) a preliminary part, where points of interest are determined, and two main parts in which 2) the proposed localization estimator is described in detail, and 3) the proposed detection procedure to identify attackers is introduced.

3.1 Determining points of interest

At the beginning, all anchors are treated as honest. Hence, the set of malicious nodes is initialized as , whereas the set of honest nodes is . Afterwards, one can construct circles, , centered at the known locations of the anchors and radii equivalent to the distance estimate, , obtained from (Equation 1), of the respective anchor (the reader is referred to Figure 2a). The intersection points between all pairs of circles are used as points of interest for the voting scheme. The intersection points between a pair of circles (given that they exist) can be calculated Tomic and Beko (2022) as followswherewithaccording to Figure 2a. However, due to the presence of noise and possibly malicious/faulty nodes, a pair of circles might not intersect (the reader is referred to Figure 2b). In this case, the tuple set of anchors without intersection is defined as , where the notation is used to denote that the circles corresponding to the -th and -th anchors do not intersect. In that case, one can draw a line that passes through the respective pair of anchors, and compute the intersections between the circles and the drawn line as follows.where is the position vector of the line, and is the unit vector that describes the line’s direction. Afterwards, the intersection points to be used in the voting-scheme, , , are obtained as the middle of the intersection points between the line and the circles at both ends, according to

FIGURE 2

The forged intersection points are required for the proposed algorithm in scenarios where the number of anchors is scarce and/or the genuine intersection points are in insufficient number. This idea has already been implemented in Tomic and Beko (2022), and the reasoning behind it is that when a pair of anchors is genuine, the intersection points would lay in the vicinity of the drawn line, making these forged intersection points a reasonable approximation of the real ones.

3.2 The proposed voting-based scheme for target localization

The voting scheme is a process to cluster and assign votes to the intersection points based on some criterion (for instance, their physical proximity). The main idea is to assign a value (vote) to each intersection point in order to find the most trustworthy ones. It is important to highlight that the localization process is done for a specific instant in time, therefore, past information of the network is not used to aid the voting-scheme. For the sake of simplicity, let us define the matrix containing all intersection points, and the vector as the -th column of . This process iterates all pairs of anchors, and for each pair a hyperplane is computed as

which divides the problem space into two-half spaces. The intersection points are assigned to the upper half space, , or to the lower half space, , according to their physical location with respect to the hyperplane. Next, clusters composed of elements that are physically the closest to each other in each half space are built: as the upper cluster and as the lower cluster. Lastly, votes, , are assigned to the points that belong to a cluster (if these exist), based on their distance to the hyperplane, see Figure 3. Vote for the -th intersection point is calculated aswhere

FIGURE 3

with , is the identity matrix of order two, denotes the distance of an intersection point, , to it’s respective projection on the hyperplane, and is a weight based on the distances and which takes into account the anchor and the point .

The procedure to compute the votes defined in (Equation 7) is explained in the following. For every point of interest , with , one considers all combinations of pairs of anchors , where and , and calculates the respective hyperplanes according to (Equation 6). Then, each weight divides a single vote according to the proximity of to and , such that more weight is assigned to the half space containing the anchor closer to the hyperplane (Equation 8). A cluster of points physically closest to one another, and , are formed in each half space. If or , distances of the cluster points to are calculated (Equation 9) and converted into weights by dividing the individual distances with the sum of all distances of the points in the cluster to the hyperplane; otherwise, sum zero and move on to the next anchor pair. Lastly, these weights are further weighted with and summed up to form a vote for the -th point of interest. Hence, the intuition behind the votes defined in (Equation 7) is that it assigns greater weights (belief) to points closer to the hyperplane, since the correct cluster of (genuine) points should lie in its vicinity.

An estimate of the target’s location can be obtained by re-ordering the vote vector in a descending fashion, , such that . The first votes correspond to the most trustworthy points; hence, the estimate is obtained by applying the WCM principle for the (normalized) vote values as

3.3 Attack detection

Considering (Equation 3), in the case of a malicious anchor, it is intuitive that the attack would shift the probability distribution according to the attack intensity. This shift of the distribution could cause the mean to fall outside of a CI. In other words, one could take advantage of it to detect attackers. However, as the attack intensity is unknown, it can be estimated by exploiting the estimated target location in (Equation 10) based on the ML principle. Similar can be done for the noise standard deviation and the expected (genuine) RSS value aswith .

It is well known that 68% of the mass of a normal distribution falls within one standard deviation of the mean. Thus, if the measured RSS in (Equation 1) lays outside of the CI , the respective anchor is classified as malicious, and the set of malicious nodes becomes . Notice that the symmetric band used to flag an anchor as malicious might not be the optimal one, especially for anchors at very different ranges. Still, it effectively serves its intended purpose and achieves strong performance in practice; thus, its further enhancement is left for future work.

Note that, in contrast to Beko and Tomic (2021), Mukhopadhyay et al. (2021), the malicious node is possibly exploited in the localization process. This can be advantageous when the is not high compared to noise power, and quantity of anchors prevails over quality.

The proposed algorithm is summarized in Algorithm 1. It should be noted that the proposed algorithm operates entirely locally at the target using a single network snapshot in time. While the inferred corruption status of the anchors could be reused by the same target over time (e.g., in tracking or navigation problems) or shared with other targets in a cooperative setting, such mechanisms fall outside the scope of this work; thus, no inter-target cooperation or information exchange is assumed or required by the algorithm.

4 Performance analysis

This section presents a series of numerical results in order to assess the performance of the proposed solution. It presents analysis based on computational complexity, localization accuracy and success in detecting malicious attackers, as well as a discussion on the limitations of the proposed scheme. It is thus organized correspondingly.

4.1 Complexity analysis

The complexity analysis is highly relevant for the applicability of the algorithm, especially in real-time scenarios. Given that and are respectively the maximum number of iterations for the GTRS-based and for the ADMM-based algorithms, Table 1 summarizes the worst-case computational complexity together with the average running time of the considered methods. The latter evaluation was performed with 100 Monte Carlo (MC) runs, for , dB, dB, on a machine with the following characteristics: CPU: Intel(R) Core(TM) i5-1135G7 CPU @ 2.40 GHz, RAM: 16 GB, OS: Windows 11 Home, running MATLAB R2016b.

Essentially, all considered methods involve matrix addition, multiplication and transpose operations, and the LC-GTRS in Tomic and Beko (2022) and SWLS in Mukhopadhyay et al. (2021) require matrix inversion. These operations come with certain computational costs associated with them (e.g., is the cost of matrix inversion, where stands for the size of the square matrix). Nevertheless, one can note from the table that all considered algorithms have linear complexity in the dominant term, . Regarding the complexity of the proposed VS method, its most expensive operation is the calculation of the votes in (Equation 7), where a series of matrix additions and multiplications is required in order to compute the projection of points of interest onto the hyperplane. However, dimensions of the matrices and vectors involved in these computations are fixed to and respectively, with denoting the dimension of the space of interest (2-D or 3-D). Hence, although the operations in VS are computationally the least demanding, the proposed algorithm requires repeated actions (for each pair of anchors), which results in somewhat higher average running time than SWLS and R-GTRS. However, note that these actions could be done in parallel, so that the running time of VS is reduced significantly. Moreover, the GTRS-based and ADMM-based approaches require repeated actions, while LC-GTRS and LN-1E require two phases to obtain the final location estimation.

4.2 Performance analysis via simulations

This section validates the performance of the considered algorithms in terms of localization accuracy and success of attacker detection through numerical simulations. All simulations disclose the results for randomly deployed anchors and a single target (at a time), within a two-dimensional area of with two malicious anchors. Moreover, anchors are randomly deployed times and, for each localization setting, two randomly chosen anchors are considered malicious times.

The RSS measurements¹ were obtained through (Equation 1), where the transmit power at the target node is set to dBm, the PLE is set at , which corresponds to propagation in an urban area, and observation were considered. The main metric used to assess the localization performance is the root mean squared error (RMSE), (m), where and are, respectively, the true and the estimated target location in the -th Monte Carlo run, i.e., .

It is worth mentioning here that SWLS in Mukhopadhyay et al. (2021) requires tuning the detection threshold by studying an empirical parameter, . By fine-tuning the empirical threshold in the considered settings, it was concluded that the best localization results for SWLS were obtained for ; thus, this value is adopted for SWLS in all presented simulations. Furthermore, R-GTRS in Tomic and Beko (2024a) requires knowledge on the magnitude of the attack intensity, i.e., in (Equation 1). The true value is given to R-GTRS in all presented simulations.

4.2.1 Uncoordinated attacks

In a non-coordinated attack, the attack intensity in (Equation 1) is chosen according towhere (dB) is defined below for each scenario.

Figure 4 illustrates RMSE (m) versus (dB) comparison of the considered approaches in an uncoordinated attack scenario with two malicious anchors for different values of and (dB). As expected, the figure clearly shows that the performance of all methods degrades with the increase of (dB). Likewise, it shows a trend that all methods benefit from the increase of and suffer from the increase of (dB). From Figure 4, one can see that the proposed solution outperforms the existing ones for medium-to-high (dB), whereas R-GTRS exhibits superior performance for low (dB). Nevertheless, R-GTRS suffers significant performance degradation for high (dB), making it unusable in these settings. This behavior most likely occurs due to a high dis-balance between the number of genuine and malicious anchors in the considered scenario, causing R-GTRS to erroneously penalize the genuine anchors instead of the malicious ones. This is particularly noticeable when is relatively high, causing significant difference in malicious and genuine measurements and tricking R-GTRS to mistakenly penalize more the genuine anchors, thus favoring the malicious ones and resulting in higher performance loss. Hence, although it is a robust min-max approach that is conceived for the worst-case scenario (it assumes that all anchors malicious initially), R-GTRS method experiences difficulties in lighter and milder settings.

FIGURE 4

Figure 5 illustrates different detection rates versus (dB) comparison of the considered approaches in an uncoordinated attack scenario with two malicious anchors for different values of and (dB). In order to show the stability of the detection results, Wilson binomial CI Wilson (1927) is employed to provide accurate coverage for finite sample sizes. In this way, each detection outcome is a Bernoulli process, with the correct detection corresponding to success, and all other outcomes (false and no detection) are treated as failure. The CI is calculated aswith denoting the empirical correct detection rate, and respectively being the number of Monte Carlo runs and the number of attackers, and representing the standard normal quantile ( for confidence interval). Figure 5 corroborates the effectiveness of the proposed detection scheme and confirms the superiority of the proposed approach for high (dB). The latter claim can be explained by the robustness of the proposed approach to high (dB) in terms of localization performance, since the location estimate of VS is exploited for detection, and having better localization estimate can naturally lead better detection performance (if used in a correct manner). Finally, it is worth mentioning that the detection of SWLS is poor in general, which suggest that its hyper-parameter might need more fine-tuning (even though resulted in the best localization performance).

FIGURE 5

Figure 6 illustrates the cumulative distribution function (CDF) versus localization error (LE) in the considered uncoordinated scenario, when , (dB) and (dB). The LE in the -th MC run is defined as . The figure shows that the proposed scheme and LC-GTRS exhibit similar performance which is clearly superior over the remaining existing ones. For instance, the former two solutions have a median of (m), whereas the best of the remaining ones exhibits a median of (m).

FIGURE 6

4.2.2 Coordinated attacks

In a coordinated attack, in (Equation 2) is obtained by choosing a random point on a circle centered at the true target’s location with radius , i.e., , where is a random angle chosen from a uniform distribution from the interval .

Figure 7 illustrates RMSE (m) versus (dB) comparison of the considered approaches in a coordinated attack scenario with two malicious anchors for different values of and (dB). Similar as in the uncoordinated scenario, Figure 7 exhibits superior performance of the proposed solution for medium-to-high (dB), being R-GTRS and LN-1E its only competitors for low (dB). This result suggests that these two methods might be somewhat more robust to noise, since low (dB) can be seen as noise corruption. Still, the gain that the new method achieves for high (dB) clearly compensates this behavior.

FIGURE 7

Figure 8 illustrates different detection rates versus (dB) comparison of the considered approaches in a coordinated attack scenario with two malicious anchors for different values of and (dB). As foreseen, (correct) detection performance of all methods degrades with the increase of (dB). This is explained by the fact that higher noise power gives attackers more room to disguise their malicious deeds within the noise, aggravating the detection process. This is particularly discernible for all methods in the interval . Nonetheless, the proposed scheme significantly outperforms the existing ones in terms of attacker detection in general.

FIGURE 8

Figure 9 illustrates the cumulative distribution function (CDF) versus localization error (LE) in the considered coordinated scenario, when , (dB) and (dB). Figure 9 shows that the proposed scheme and LC-GTRS have almost identical performance which is clearly superior over the remaining existing ones. For instance, the former two solutions have a median of (m), whereas the best of the remaining ones exhibits a median of (m).

FIGURE 9

To finish off the analysis via computer simulations, Figure 10 illustrates the performance comparison in the considered uncoordinated and coordinated attack scenarios, when , (dB), (dB), , where attackers were randomly chosen times in each of random deployments of all nodes. The figure illustrates general superiority of the proposed VS in both uncoordinated and coordinated attack scenarios. Only R-GTRS manages to provide better results in uncoordinated attack scenario when half of the anchors are malicious. This is not surprising, since the R-GTRS method is a robust min-max approach that is conceived for the worst-case scenario, but experiences difficulties in lighter and milder settings. Similarly, the proposed detection scheme outperforms the existing ones in both scenarios in general, achieving around of correct attacker detection in the considered uncoordinated attack scenarios when at least of anchors are malicious.

FIGURE 10

4.3 Performance analysis via experimental measurements

This section validates the performance of the considered algorithms in terms of localization accuracy and success of attacker detection through experimental measurements. The considered experimental configuration is illustrated in Figure 11. In all experiments, was considered to localize a single target at a time, in the presence of two malicious anchors. Moreover, two randomly chosen anchors in each run out of runs are considered malicious, and their spoofing attacks were generated by simply injecting a value into the acquired experimental measurements.

FIGURE 11

4.3.1 Uncoordinated attacks

Figure 12 illustrates RMSE (m) versus (dB) comparison of the considered approaches in the experimental uncoordinated attack scenario with two malicious anchors. The figure exhibits that only R-GTRS performs better than the proposed scheme for low-to-medium (dB), whereas for high attack intensities (e.g., ), both methods exhibit similar performance. Nevertheless, it is worth remembering that R-GTRS requires additional knowledge about the maximum attack intensity, which is unlikely to be perfectly available beforehand in practice.

FIGURE 12

Figure 13 illustrates detection rates versus (dB) comparison of the considered approaches in the experimental uncoordinated attack scenario with two malicious anchors. Figure 13 shows that the achieved detection rates are significantly lower than the ones from the simulations, but this is expected given various obstacles, anisotropies and other phenomena that were not considered in simulations. Even so, the results indicate that the proposed detection scheme works well in practice, which is corroborated by the fact that its results match the best existing ones, LC-GTRS in this case, and go up to .

FIGURE 13

4.3.2 Coordinated attacks

Figure 14 illustrates RMSE (m) versus (dB) comparison of the considered approaches in the experimental coordinated attack scenario with two malicious anchors. Similar as in the uncoordinated case, only R-GTRS performs better than the proposed scheme for low-to-medium (dB), whereas for high attack intensities (e.g., ), the proposed approach exhibits the best performance.

FIGURE 14

Figure 15 illustrates detection rates versus (dB) comparison of the considered approaches in the experimental coordinated attack scenario with two malicious anchors. Naturally, the figure shows a drop in the detection rates when compared with the ones in the simulations. Again, the proposed detection scheme is corroborated in practice, matching the performance of the best existing one, and goes up to .

FIGURE 15

4.4 Discussion

While the proposed solution outperforms existing methods in localization and detection for medium-to-high attack intensity, some limitations and parameter choices are worth discussing. Certain parameters are fixed, such as the number of points of interest set to for localization and the confidence interval for attacker detection set within one estimated noise standard deviation. The rationale for using points is that not all intersection points are necessary, as some may be affected by attacks or excessive noise. For smaller , trimming unnecessary points improves accuracy. The confidence interval choice balances false detection (if too narrow) and missed detection (if too wide), with one standard deviation offering a reasonable trade-off. Although these parameters could be fine-tuned for different scenarios, numerical results indicate that the chosen values work well within the considered settings.

The proposed approach assigns beliefs (votes) to each intersection point, but under high noise or unfavorable attack coordination, it may mistakenly remove a genuine point, potentially impacting localization accuracy. However, numerical results confirm that such occurrences are infrequent and do not significantly degrade performance. While the final detection output is a binary decision (genuine or malicious anchor), this classification is solely for detection purposes and does not influence localization refinement. Like existing methods, the approach requires at least of anchors to be non-compromised, particularly in coordinated attacks, as a malicious majority would easily manipulate localization. A unique aspect of the method is its ability to generate points of interest even when anchor circles do not intersect. In extreme cases, all points might need to be fabricated, leading to inaccurate clusters. However, this scenario poses a challenge for all existing methods, as they inherently rely on intersection points for localization.

Although not all considered methods estimate the attack intensity directly in their detection procedure, one can obtain this estimate as explained here in (Equation 11). Hence, Figure 16 illustrates the average RMSE of in (dB) versus (dB) in the considered experimental uncoordinated attack scenario, Figure 16a, and the considered experimental coordinated attack scenario, Figure 16b, for . The figure shows that none of the considered approaches accomplishes an error below 7 (dB), which is due to the complexity of the scenario. Still, the proposed scheme exhibits a fairly good, but in general not the best, estimation performance, indicating that this estimation is not a prerequisite for high detection rate, which is somewhat intuitive. Finally, it is worth mentioning that the results of LN-1E are around 22 dBs in the considered setting, and are thus cut off for a better overview.

FIGURE 16

5 Conclusion

This work advances target localization in randomly deployed WSNs under both uncoordinated and coordinated spoofing attacks by introducing a novel geometric approach for accurate localization and attacker detection. The method estimates the target’s location using intersection points of anchor pairs, applying a VS and WCM, followed by attacker detection via confidence intervals. Unlike traditional methods, it employs soft detection decisions, assigning beliefs (votes) instead of binary classifications. These votes are converted into probabilities and used as WCM weights for refined localization. Potential attack intensities are estimated using an ML criterion, with final detection based on confidence intervals. Performance evaluation in terms of localization accuracy, detection rate, and computational complexity shows that the method achieves near-perfect detection when the attack intensity-to-noise ratio is sufficiently high. Although detection rate decreases as this ratio lowers, the proposed approach consistently outperforms existing methods in both detection performance and localization accuracy, reducing localization error by at least across various scenarios. Additionally, the VS-based solution operates efficiently, with a runtime of just a few milliseconds.

References

• 1

  Bazzi A. Slock D. T. M. Meilhac L. (2016a).JADED-RIP: Joint angle and delay estimator and detector via rotational invariance properties, IEEE international symposium on signal processing and information technology (ISSPIT), Limassol, Cyprus, 160–165. 10.1109/ISSPIT.2016.7886027

  • CrossRef
  • Google Scholar

• 2

  Bazzi A. Slock D. T. M. Meilhac L. , (2016b). Sparse recovery using an iterative variational bayes algorithm and application to AoA estimation, IEEE international symposium on signal processing and information technology (ISSPIT), Limassol, Cyprus, 197–202. 10.1109/ISSPIT.2016.7886034

  • CrossRef
  • Google Scholar

• 3

  Bazzi A. Slock D. T. M. Meilhac L. , (2018). On Maximum Likelihood Angle of Arrival Estimation Using Orthogonal Projection, 2018 IEEE international conference on acoustics, speech and signal processing (ICASSP), Calgary, AB, Canada, 3241–3245. 10.1109/ICASSP.2018.8462437

  • CrossRef
  • Google Scholar

• 4

  Beko M. Tomic S. (2021). Toward secure localization in randomly deployed wireless networks. IEEE Internet Things J.8, 17436–17448. 10.1109/jiot.2021.3078216

  • CrossRef
  • Google Scholar

• 5

  Coluccia A. Fascista A. (2018). On the hybrid toa/rss range estimation in wireless sensor networks. IEEE Trans. Wirel. Commun.17, 361–371. 10.1109/twc.2017.2766628

  • CrossRef
  • Google Scholar

• 6

  Garg R. Varna A. L. Wu M. (2012). An efficient gradient descent approach to secure localization in resource constrained wireless sensor networks. IEEE Trans. Inf. Forensics Secur.7, 717–730. 10.1109/tifs.2012.2184094

  • CrossRef
  • Google Scholar

• 7

  Kay S. M. (1993). Fundamentals of statistical signal processing: estimation theory. Prentice-Hall, Inc.

  • Google Scholar

• 8

  Kugler L. (2017). Why gps spoofing is a threat to companies, countries. Commun. ACM6, 18–19. 10.1145/3121436

  • CrossRef
  • Google Scholar

• 9

  Li Z. Trappe W. Zhang Y. Nath B. (2005). “Robust statistical methods for securing wireless localization in sensor networks,” in IPSN 2005. Fourth international symposium on information processing in sensor networks, 91–98.

  • Google Scholar

• 10

  Li Y. Ma S. Yang G. Wong K.-K. (2021). Secure localization and velocity estimation in mobile iot networks with malicious attacks. IEEE Internet Things J.8, 6878–6892. 10.1109/jiot.2020.3036849

  • CrossRef
  • Google Scholar

• 11

  Liu D. Ning P. Liu A. Wang C. Du W. (2007). Attack-resistant location estimation in wireless sensor networks. Electr. Eng. Comput. Sci.11, 1–36. 10.1145/1380564.1380570

  • CrossRef
  • Google Scholar

• 12

  Liu X. Su S. Han F. Liu Y. Pan Z. (2019). A range-based secure localization algorithm for wireless sensor networks. IEEE Sensors J.19, 785–796. 10.1109/jsen.2018.2877306

  • CrossRef
  • Google Scholar

• 13

  Matos-Carvalho J. P. Santos R. Tomic S. Beko M. (2021). Gtrs-based algorithm for uav navigation in indoor environments employing range measurements and odometry. IEEE Access9, 89120–89132. 10.1109/access.2021.3089900

  • CrossRef
  • Google Scholar

• 14

  Mukhopadhyay B. Srirangarajan S. Kar S. (2021). Rss-based localization in the presence of malicious nodes in sensor networks. IEEE Trans. Instrum. Meas.70, 1–16. 10.1109/tim.2021.3104385

  • Pubmed Abstract
  • CrossRef
  • Google Scholar

• 15

  Niculescu D. Nath B. (2004). “Vor base stations for indoor 802.11 positioning,” in MobiCom’04, 58–69.

  • Google Scholar

• 16

  Oigbochie A. Odigie E. Adejumo B. (2021). Importance of drones in healthcare delivery amid a pandemic: current and generation next application. Open J. Med. Res.2, 1–13. 10.52417/ojmr.v2i1.187

  • CrossRef
  • Google Scholar

• 17

  Qiang C. (2014). A forest early fire detection algorithm based on wireless sensor networks. Sensors and Transducers166, 89–96.

  • Google Scholar

• 18

  Shi Y. Yang G. H. (2024). Secure bearing-based target localization for multi-agent networks against malicious agents. IEEE Trans. Automation Sci. Eng.21, 5812–5825. 10.1109/tase.2023.3319334

  • CrossRef
  • Google Scholar

• 19

  Singh M. Leu P. Abdou A. R. Čapkun S. (2019). “Uwb-ed: distance enlargement attack detection in ultra-wideband,” in 28th USENIX security symposium, 73–88.

  • Google Scholar

• 20

  Tomic S. Beko M. (2020). A geometric approach for distributed multi-hop target localization in cooperative networks. IEEE Trans. Veh. Technol.69, 914–919. 10.1109/tvt.2019.2952715

  • CrossRef
  • Google Scholar

• 21

  Tomic S. Beko M. (2022). Detecting distance-spoofing attacks in arbitrarily-deployed wireless networks. IEEE Trans. Veh. Technol.71, 4383–4395. 10.1109/tvt.2022.3148199

  • CrossRef
  • Google Scholar

• 22

  Tomic S. Beko M. (2024a). A min-max optimization-based approach for secure localization in wireless networks. IEEE Trans. Veh. Technol.73, 4151–4161. 10.1109/tvt.2023.3325063

  • CrossRef
  • Google Scholar

• 23

  Tomic S. Beko M. (2024b). Trustworthy target localization via admm in the presence of malicious nodes. IEEE Trans. Veh. Technol.73, 7250–7261. 10.1109/tvt.2023.3346476

  • CrossRef
  • Google Scholar

• 24

  Tomic S. Beko M. Dinis R. Bernardo L. (2018). On target localization using combined rss and aoa measurements. Sensors18, 1–25. 10.3390/s18041266

  • Pubmed Abstract
  • CrossRef
  • Google Scholar

• 25

  Wilson E. B. (1927). Probable inference, the law of succession, and statistical inference. J. Am. Stat. Assoc.22, 209–212. 10.1080/01621459.1927.10502953

  • CrossRef
  • Google Scholar