Artificial Intelligence based Anomaly Detection in WSN

Abstract

Wireless Sensor Networks (WSNs) are utilized in many applications including environmental monitoring, industrial systems, healthcare and Infrastructure Management to continuously sense and communicate. The uses of WSNs can be applied to smart infrastructure, industrial monitoring and cyber-physical systems among other mission-critical uses. But due to the resource constraint and distributed nature of the sensor nodes, WSNs are vulnerable to Blackhole, Grayhole, Flooding and Scheduling attacks. Current anomaly detection methods are typically based on statistical deviations or temporal traffic patterns, and lack attention to inter-node relationships and attack response in the energy domain. In this paper, a Graph Attention Network–Bidirectional Gated Recurrent Unit with Proximal Policy Optimization (GAT–BiGRU–PPO) architecture is proposed for anomaly detection and resource-aware response in WSNs. The method is applied to the WSN-DS that comprises about 3.4 million observations across 19 attributes. GAT models the communication dependency between neighboring sensor nodes and BiGRU extracts bi-directional temporal pattern from sequential network activity. The resulting anomaly probability is, along with the residual energy, traffic intensity, communication cost and the false-positive behavior provided to a PPO agent in order to provide an appropriate network response. Experimental results have shown that the proposed method has obtained an overall accuracy of 99.08%, F₁-score of 98.70%, and AUC of 0.992. In addition, the PPO-based response mechanism can further decrease the estimated energy consumption to 14.72 J and increase the network lifetime to 3,180 rounds. The attack-wise ROC analysis shows the AUC values ranging from 0.986 to 0.997, which means that there is a consistent separation between normal and malicious network behavior. Experimental findings indicate that the combination of graph-based node interaction, bidirectional temporal modelling and policy-based response selection is an effective way of detection of different attacks to the WSN and resource expenditure control. Thus, the proposed security framework is appropriate for the resource-constrained WSN setting.