{'fraction_non_alphanumeric': 0.03217953257790368, 'fraction_numerical': 0.009782223796033994, 'mean_word_length': 4.292340126493324, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 1, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Power-Efficient Direct-Voting Assurance for Data Fusion in Wireless Sensor Networks

Wireless sensor networks place sensors into an area to collect data and send them back to a base station. Data fusion, which fuses the collected data before they are sent to the base station, is usually implemented over the network. Since the sensor is typically placed in locations accessible to malicious attackers, information assurance of the data fusion process is very important. A witness-based approach has been proposed to validate the fusion data. In this approach, the base station receives the fusion data and"votes"on the data from a randomly chosen sensor node. The vote comes from other sensor nodes, called"witnesses,"to verify the correctness of the fusion data. Because the base station obtains the vote through the chosen node, the chosen node could forge the vote if it is compromised. Thus, the witness node must encrypt the vote to prevent this forgery. Compared with the vote, the encryption requires more bits, increasing transmission burden from the chosen node to the base station. The chosen node consumes more power. This work improves the witness-based approach using direct voting mechanism such that the proposed scheme has better performance in terms of assurance, overhead, and delay. The witness node transmits the vote directly to the base station. Forgery is not a problem in this scheme. Moreover, fewer bits are necessary to represent the vote, significantly reducing the power consumption. Performance analysis and simulation results indicate that the proposed approach can achieve a 40 times better overhead than the witness-based approach.


I. INTRODUCTION
Wireless sensor networks (WSNs) comprise many tiny, low-cost, battery-powered sensors in a small area [1], [5], [11]- [13], [21], [22]. The sensors detect environmental variations and then transmit the detection results to other sensors or a base station [2], [4], [6], [7], [24]. One or several sensors then collect the detection results from other sensors. The collected data must be processed by the sensor to reduce the transmission burden before they are transmitted to the base station. This process is called data fusion and the sensor performing data fusion is the fusion node. The fusion data may be sent from the fusion node to the base station through multiple hops [10] or a direct link [19].
Although fusion significantly lowers the traffic between the fusion node and the base station, the fusion node is more critical and vulnerable to malicious attacks than non-fusion sensors [15], [16], [20]. If a fusion node is compromised, then the base station cannot ensure the correctness of the fusion data sent to it. This problem of fusion data assurance arises because the detection results are not sent directly to the base station, so the fusion result cannot usually be verified.
This problem can be resolved in two ways: One is hardware-based [3], [14] and the other is software-based [8], [9], [17]. Since the hardware-based approach requires extra circuits to detect or frustrate the compromised node, the cost and continual power consumption of sensors are increased but still cannot guarantee protection against all attacks. Conversely, the software methods generally require no or little extra hardware for data assurance. However, as mentioned in [8], [17], several copies of the fusion data must be sent to the base station, the power consumption for the data transmission is very high.
The witness-based approach presented by Du et al. [9] does not have this difficulty. Several This work develops a new data fusion assurance to improve the witness-based method of Du et al. [9]. The correctness of the verification in the proposed scheme depends only on the number of compromised fusion nodes. As in the witness-based approach, a fusion node is selected to transmit the fusion result, while other fusion nodes serve as witnesses. Nevertheless, the base station obtains votes contributing to the transmitted fusion result directly from the witness nodes.
No valid fusion data are available if the transmitted fusion data are not approved by a pre-set number of witness nodes. Based on this voting mechanism, two schemes are addressed: one needs variant rounds of voting and the other needs only one round of voting. In the variantround scheme, only one copy of the correct fusion data provided by one uncompromised fusion node is transmitted to the base station. Analytical and simulation results reveal that the proposed scheme is up to 40 times better on the overhead than that of Du et al. [9]. In the one-round scheme, the base station polls each sensor once at most. The maximum delay of the one-round scheme is much less than the variant-round scheme.
The remainder of this work is organized as follows. Section II briefly addresses the problem of data fusion assurance in WSNs and previous works on the problem. Section III describes the variant-round scheme and analyzes its performance in terms of overhead and delay. The description of the one-round scheme is also given. Section IV presents a performance evaluation of the proposed approach. Concluding remarks and suggestions for future work are presented in network architecture is similar to the so-called SENsor with Mobile Access (SENMA) [23], [28], Message Ferry [29], and Data Mule [18]. At the jth sensor, one observation y j is undertaken for one of phenomena H i , where i = 1, 2, . . . , L. If the detection (raw) data are transmitted to the fusion nodes without any processing, then the transmission imposes a very high communication burden. Hence, each sensor must make a local decision based on the raw data before transmission.
The decisions 1 , v j , j = 1, 2, . . . , N, can be represented with fewer symbols than the raw data.
The sensor then transmits the local decision to M fusion nodes using broadcast. The fusion node can combine all of the local decisions to yield a final result, and directly communicate with the base station. Finally, one of the fusion nodes is specified to send the final result to the base 1 These decisions could be compressed data whose sizes depend on the applications of the WSNs. Two problems must be solved to ensure that the base station obtain the correct result. First, every fusion node must correctly fuse all of the local decisions, which also implies that all of the fusion results must be the same. Several algorithms have been proposed to deal with this problem [7], [25]- [27]. This work assumes that this problem has been solved. The second problem concerns assurance of the fusion result. The transmission between the fusion node and the base station is assumed herein to be error-free. Since some fusion nodes may be compromised, the fusion node chosen by the base station to transmit the fusion result may be one of the compromised nodes. Malicious data may be sent by the compromised node, and the base station cannot discover the compromised nodes from the normal fusion nodes since the data detected by the sensor are not sent directly to the base station. Consequently, the result obtained at the base station may be incorrect.
Du et al. [9] presented a witness-based approach to ensure the correctness of the fusion result.
All fusion nodes, other than the chosen node, acts as witnesses of the transmitted fusion result.
The witness nodes encrypt their own fusion results to MACs with private keys shared with the base station, and send the MACs, as "votes", to the chosen node. In the T + For instance, consider the majority voting rule in which T +1 ≥ ⌈M/2⌉. To ensure that P e ≤ 2 −10 , set k w = ⌈2 (10/(M − 1) + 1)⌉. Additionally, although only one copy of the fusion result is sent to the base station in this witness-based approach, the witness nodes still requires significant communication bandwidth because the MACs of the fusion results are transmitted.
To compare the proposed scheme fairly with the witness-based approach, the overhead is defined as the total number of bits, except the bits for one copy of the correct fusion result, transmitted to the base station by uncompromised nodes during the data assurance process. 2 The overhead can therefore be regarded as the useful power consumed for the data assurance.
Moreover, the round delay is defined as the number of rounds 3 required to collect all MACs (votes) from the witness nodes and the polling delay the number of votes (including all agree and disagree voting). 4 The overhead of the witness-based approach given in [9] is then derived as follows. If the received fusion result is not accepted, then the base station may start a polling mechanism to seek the correct fusion result. The base station randomly specifies another fusion node. The new chosen node then sends its fusion result and all MACs from the witness nodes to the base station. 5 When the number of compromised fusion nodes, C, is greater than M − T − 1 but less than T + 1, 6 the fusion result is invalid and M − T fusion nodes are chosen to transmit their fusion results to the base station in the polling process. Since the overhead defined only considers 2 The method does not consider the power consumption of all compromised nodes since they are not useful to the WSN. 3 Or the number of fusion results sent to the base station. 4 The overall time delay is then can be derived by these two delays. 5 All MACs must be sent to the base station again to avoid the denial of service since the previously chosen compromised fusion node might modify MACs it sent to the base station. This action is not clearly presented in [9]. the power consumption of uncompromised nodes, the number of uncompromised nodes among the M − T fusion nodes must be discovered. The probability that i of the M − T fusion nodes are uncompromised is given by where i − 1 is used because the overhead is defined such that one copy of correct fusion result does not count on. Equation The base station has to set up a group key for all fusion nodes to ensure that the direct voting February 1, 2008 DRAFT mechanism works. 7 When a fusion node wishes to send its fusion result to the base station, it adopts the group key to encrypt the result, and other fusion nodes serving as witness nodes can decode the encrypted result. The witness node then starts to vote on the transmitted result. Two data fusion assurance schemes are proposed based on the voting mechanism using a group key.

A. Variant-round Scheme
In this scheme, the base station needs to ask the witness node whether it agrees or disagrees with the transmitted fusion result. The witness node then sends its vote to the base station. If the transmitted fusion result is not supported by at least T witness nodes, then the base station might have to select a witness node that does not agree with the transmitted result as the next chosen node. The detail steps of the scheme are given as follows: Step 1: The base station chooses a fusion node. Other fusion nodes serve as witness nodes.
Define a set of witness nodes that includes all witness nodes and let the nodes in the set be randomly ordered. Denote M ′ = M − 1 as the size of the witness set in the current round.
Step 2: The chosen node transmits its fusion result to the base station.
Step 3: The base station polls the node in the witness set by following the order of the witness nodes. The polling-for-vote 8  Step 4: Represent A as the number of witness nodes that agree with the transmitted fusion result. If the compromised node always disagrees with the transmitted fusion result, then no forged fusion result is accepted. Two cases must be addressed: Note that the valid fusion result is not available in Case 1.
Assume that the chosen node at the first round is compromised. The probability that the chosen node is compromised at the first round is given by C/M. The first-round voting finishes when M − T witness nodes do not agree with the transmitted fusion result, as described in Step 3.
Thus, the polling order (i.e., the order of witness nodes as described in Step 1) determines the number of witness nodes that the base station has to poll at this round of voting. The number of possible polling orders in the sense of the black-white-ball model is given by where the subscript, v1, denotes the first case of the variant-round scheme, and the superscript, No node is excluded from the witness set. The number of compromised nodes and the size of the witness set at the second round become C − 1 and M − 2, respectively. The average overhead, when the chosen node at the first round is compromised, is expressed recursively by and where Next, suppose that the chosen node at the first round is not compromised, which has a probability of (M − C)/M. The number of the possible polling orders is given by where the superscript, u1, denotes the first round of polling while the chosen node is uncompromised. When the polling stops at witness node j, the node does not agree with the transmitted result and the base station has polled M − T disagreeing nodes (including witness node j).
Since the number of unpolled nodes M −j −1 is less than T , these nodes will never be polled in the following runs before the voting mechanism stops. Hence, only compromised nodes are polled after the first round and then no uncompromised nodes are further polled. Note that the number of uncompromised nodes among the polled nodes is j −(M −T ) = j −M +T . Therefore, the average overhead, when the chosen node at the first round is not compromised, is then given Otherwise, the size is decreased by 1 in each following round until it becomes T . Consequently, the total number of the following rounds is The average round delay is then represented by February 1, 2008 DRAFT Since the voting process will stop when M ′ − T + 1 nodes are polled at each round, the polling delay is Equations (2) to (7), and the initial conditions then give the average overhead and the average delays of Case 1 as Only one round of polling is needed when the chosen node is uncompromised at the first round.
When the polling stops at witness node j, the node agrees with the transmitted result and the base station has polled T agreeing nodes (including witness node j). Moreover, M − j − 1 nodes are unpolled, and M − 1 − C − T of these are uncompromised. The probability that the polling February 1, 2008 DRAFT process ends at the jth witness node, where T ≤ j ≤ T + C, is given by The number of polled uncompromised nodes is T . The average overhead when the chosen node is uncompromised at the first round is represented as and the average polling delay is Hence, the overhead of the scheme is independent of the size of the fusion result. 12 This claim can be proven by the following argument. In the case of a valid fusion result, when the fusion result from an uncompromised node is sent to the base station at a round of polling, the polling 12 Note that the overhead is defined as the total number of bits transmitted minus the bits of the correct fusion result. with the transmitted fusion result. In the former case, the polling process stops. In the latter case, another polling round is required. Importantly, in the next round all uncompromised nodes will be the last T − 1 nodes in the witness set and will not then be chosen to send any fusion result before the polling process is completed. 13 Therefore, only one fusion result is sent by all uncompromised nodes when no valid result can be obtained by the base station.

C. One-round Scheme
The number of rounds in the above scheme is not fixed. Hence, the delay varies. Variant delay is not desired in some applications such as real-time systems. This work proposes another scheme that is based on the improved voting mechanism. In this scheme the base station may receive different fusion results from the witness nodes. It requires that all received fusion results be stored. This scheme has a fixed delay and is summarized as follows: Step 1: The base station randomly chooses a fusion node. Other fusion nodes serve as witness nodes. Define a set of witness nodes that includes all of the witness nodes and let the nodes in the set be randomly ordered.
Step 2: The chosen node transmits its fusion result to the base station. The base station sets the fusion result as a potential voting result and the number of agreeing votes for the fusion result is set to be zero.
Step 3: The base station polls the nodes, with the voting result, one by one in the witness set, following the order of the witness nodes. The witness node compares its fusion result with the voting result. 13 In the next round, all uncompromised polled nodes are deleted from the witness set according to the scheme. For the witness-based approach, the size of each MAC, k w , is assumed to be four bits. In the evaluation of the overhead of the variant-round scheme, the size of fusion result is zero (i.e., K = 0), such that the witness-based approach has the best performance. As stated at the  Accordingly, the proposed scheme outperforms the witness-based approach given in [9] in terms of overhead and delay.
The following computer simulations evaluate the variant-round scheme when P f = 0.25, 0.5, and 0.75 by performing 10000 Monte Carlo tests for each simulation. In the first set of simulations, the witness-based approach given in [9] is compared with the proposed variant-round scheme when P f = 0.25, 0.5, and 0.75. Figure 6 presents the results for M = 11, k = 0 and k ′ = 1. The variant-round scheme outperforms the witness-based approach in every P f simulated.
For example, in Fig. 6, when T = 5 the proposed variant-round scheme is almost 40 times better than the witness-based approach given in [9] in terms of overhead performance for C = 1, 2 and P f = 0.25, 0.5, 0.75. Finally, Table I summarizes the maximum average overhead of the variant-round scheme and the witness-based approach for M = 11 and 12.
In the second set of simulations, the average numbers of bits sent by uncompromised nodes in the one-round scheme is evaluated. When the compromised node does not agree with the voting result, the fusion result transmitted by the compromised node is different from other fusion results and the size of the fusion result is K = 48. Fig. 7 shows the results for M = 11 when P f = 0, 0.5, and 1. In Fig. 7(a), when the base station can obtain a valid fusion result, the bits transmitted by the uncompromised nodes to the base station in the one-round scheme increase with the number of compromised nodes C, as expected. However, they are smaller than those in the witness-based approach. Notably, in this case, the bits transmitted by uncompromised nodes in the witness-based approach is constant, since once an uncompromised node is polled, the polling process is completed. For small C, such as C = 0, 1, 2 or 3, the number of bits  that when P f = 1, the only way to stop the polling process is for one fusion result to be sent by an uncompromised node and the other to be sent by a compromised node, and for the transmitted bits of the uncompromised nodes to be the same for all C. If P f = 1, the two compromised nodes may yield two different results, and no bit is transmitted by the uncompromised node. This concludes the simulation results. This subfigure reveals that the one-round scheme outperforms when C is small but loses when C exceeds T /2. Similarly, the maximum average number of bits in the one-round scheme is compared with that of the witness-based approach for M = 11 and 12, and the results are given in Table II. This table indicates that the maximum average number of bits transmitted in the one-round scheme is much lower than that in the witness-based approach.

V. CONCLUSIONS AND FUTURE WORK
This work proposes a power-efficient scheme for data fusion assurance, in which the base station in the wireless sensor network collects the fusion data and the votes on the data directly  from the fusion nodes. The proposed scheme is more reliable with less assurance overhead and delay than the witness-based approach. That is, the power and delay for the transmission of the fusion result and the votes are significantly decreased.
In the future, we will discover the performance when a node is compromised with some probability, both statistically dependent and independent to other nodes. Moreover, the propose scheme cannot be applied to multi-hop WSNs. We will develop other schemes based on the direct voting mechanism for the multi-hop WSN.

APPENDIX
Performance Analysis of the Variant-round Scheme when P f = 1 In this analysis we assume that 2T + 1 ≥ M. Since when C > T the base station will get a forged fusion result and this should be avoided, we are only considering two cases: The When the second round of polling stops at the jth witness node, the jth witness node (which Since A is at least M − T − 1 at the second round, it is easy to see that M ′ − T − 1 < A and the scheme will stop after the second round. Therefore, the average overhead is As mentioned before, when M ′ < T , i.e., 2M − 2T − 2 < i, the scheme will stop after the first round. Hence, the average round delay is and the average polling delay is In the first case, the probability that the chosen node is not compromised at the first round is given by (M − C)/M. The number of the possible polling orders is written as Thus, the probability that the polling stops at the ith witness node, where M − T ≤ i ≤ When the second round of polling stops at the jth witness node, the j polled nodes contain M ′ − T + 1 disagreeing (uncompromised) nodes and the unpolled nodes include 2M − C − The probability that the second round of polling finishes at the jth witness node, where (M ′ − T + 1) Similarly, it is easy to see that the scheme will stop after the second round. Therefore, the average overhead is given by Again, when M ′ < T , i.e., 2M − 2T − 2 < i, the scheme will stop after the first round. Hence, the average round delay is and the average polling delay is A valid fusion result is available in the second case. The first-round process is similar to the first-round process in the first case when the chosen node is compromised at the first round. The probability that the T th witness node agrees with the transmitted fusion result at witness node j of the second-round polling process is Significantly Only one round of polling is needed when the chosen node is uncompromised at the first round.
The probability that the polling process ends at the witness node i, where T ≤ i ≤ T + C, is written as Witness−based VR, P f = 0 VR, P f = 1