Wireless Sensor Networks · Study deck
Selfish and Malicious Nodes
Picture five battery nodes passing readings toward a base.
Packet Pete is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Explain: That protects the affected path, but it can also reward the free rider if the node is now excused from relay work while its own traffic still moves through other neighbors.
- Explain: When the record stops arriving, the recovery review should preserve the last accepted reading and show the current source as unavailable until a complete new record or validated stored record arrives.
- Explain: If a node has 30 relay opportunities, forwards 4, and still delivers 12 of 12 own packets while link and queue records stay normal, reputation should fall for the relay role.
Major section
Start With the Field Story · In 60 Seconds
One node sends its own data but often fails to pass a neighbor's data.
- That pattern matters, yet it does not reveal intent by itself.
- A route around the node may protect delivery but use more energy.
- Removing it may stop harm but also remove the only path.
Major section
Minimum Viable Understanding · Classification Scope
Selfish and malicious labels are hypotheses supported by evidence, not guesses about motive.
- Selfish behavior usually preserves the node's own traffic while avoiding shared duties.
- Classification should record the expected role, observed behavior, corroborating views, benign checks, action, confidence, and retest trigger.
- The label should be useful to the next routing or validation decision.
Major section
Evidence Map · Distinguishing Selfish From Malicious
The difference is how the evidence fits together.
- Peer reports, path records, and gateway logs can corroborate the pattern.
- The resulting hypothesis may be selfish, malicious, suspect, or unknown.
- The chosen mitigation must fit the observed risk, and a retest trigger states what could confirm or change the label.
- Selfish behavior is a cooperation problem.
Major section
Cooperation Incentives and Enforcement
Selfish forwarding is a cooperation problem.
- A node can save energy by dropping relay traffic while still using other nodes to carry its own packets.
- A watchdog can overhear that a next hop did not forward, and a pathrater can route around that next hop.
- Deterrence requires a consequence that makes cooperation the better local choice.
Major section
Cooperation Incentives and Enforcement (continued)
That protects the affected path, but it can also reward the free rider if the node is now excused from relay work while its own traffic still moves through other neighbors.
- They expose the two conditions that the surrounding argument must keep together.
- That contrast is the visual's teaching load: Sensor behavior trust review loop from expected role through observations, evidence checks, trust update, bounded action, and retest trigger.
- Credit systems make the incentive arithmetic explicit.
Major section
Cooperation Incentives and Enforcement (continued)
The chapter can now use cooperation incentives and enforcement without dropping the conditions shown here.
- If a node has 30 relay opportunities, forwards 4, and still delivers 12 of 12 own packets while link and queue records stay normal, reputation should fall for the relay role.
- If the same node has a low-battery alarm and queue overflow during a known interference window, the safer label may remain suspect until the pattern repeats after recovery.
- A policy might charge one credit to inject an own packet and award one credit for forwarding a neighbor's packet.
Major section
Cooperation Incentives and Enforcement (continued)
A node that wants to send 20 of its own messages must forward roughly 20 qualifying packets or receive a documented maintenance allowance.
- A sinkhole or wormhole can forward enough traffic to preserve reputation while bending topology or observing data.
- Pair cooperation enforcement with route-metric validation, authenticated identities, multipath checks for critical traffic, and time-decayed evidence so old good behavior cannot permanently mask recent harm.
- Malicious behavior needs stronger controls because an attacker may accept personal cost to damage the network.
Major section
Common Attacks and Effects
Behind the behavior labels are a handful of well-known node attacks.
- Selfish (free-riding): The node uses the network for its own traffic but skips relay duty to save energy — it silently drops packets it was supposed to forward.
- Defense: a watchdog (neighbors overhear whether a node actually forwards) feeding a reputation/trust score that routes around persistent free-riders.
- Defense: authenticated routing metrics and geographic routing that does not trust advertised cost alone.
Major section
Common Attacks and Effects (continued)
Blackhole: The node advertises an attractive route — often "shortest path to the sink" — to pull traffic toward itself, then drops everything it should forward.
- Defense: multipath so critical messages have a second route, plus per-flow acknowledgement monitoring.
- Sybil: One physical node fabricates many identities to stuff reputation votes, win routing decisions, or defeat redundancy (every "replica" you trusted is really one attacker).
- Defense: bind identity to a key, or a radio-resource test so one node cannot cheaply mint many.
Major section
Review Workflow · Production Trust Record
The review loop keeps classification conservative.
- It starts with what the system expected, checks what actually happened, and ends with a retest trigger rather than a permanent judgment.
- The reference window shows 30 forwards from 30 relay requests, or 100%.
- The same node delivers all 12 of its own packets while link and queue records look normal.
Major section
Worked Review: Relay Concern · Common Review Findings
The monitor sees that the node continues to send its own readings, but several neighbor paths show missing forwarded messages.
- Neighbor observations agree that the node receives relay requests.
- The schedule record shows no expected sleep period, and there is no recent role change.
- The action should match the confidence.
Major section
Limited-Capability And Recovery Cases
Some weak behavior is not selfish or malicious.
- A simple sensor node may be silent, recently restarted, unable to expose rich diagnostics, or returning with stored readings after a gap.
- Scenario: a simple condition node sends periodic readings to a gateway.
- The gateway stops receiving messages.
- Observation: The current reading is missing.
Major section
Limited-Capability And Recovery Cases (continued)
Related sources remain available, so the silence appears isolated.
- Concrete example: a bin-fill node has no rich diagnostics; it normally sends a fill-level record and battery flag to a gateway.
- The last accepted reading is no longer fresh enough for the application decision.
- Recovery action: Fresh records may update the current decision.
Major section
Limited-Capability And Recovery Cases (continued)
When the record stops arriving, the recovery review should preserve the last accepted reading and show the current source as unavailable until a complete new record or validated stored record arrives.
- Evidence check: The monitor confirms the expected schedule, records the last accepted observation, and checks related sources.
- Recovery action: The dashboard marks this source unavailable and uses a fallback evidence path for the affected decision.
- Missing intervals remain marked as missing.
Major section
Limited-Capability And Recovery Cases (continued)
Retest trigger: Retest when the node sends a new complete reading, returns with buffered records, changes role, changes schedule, or remains silent past the review rule.
- Scenario: a simple node returns after a silent interval and sends stored readings.
- Observation: The node is communicating again, but the records cover an interval when the gateway had no live messages.
- Older records update the history only if their validity checks pass.
Major section
Key Takeaway · Concept Relationships
Selfish and malicious behavior must be handled through trust, monitoring, isolation, and recovery controls rather than assuming every node cooperates.
- Behavior Taxonomy provides the broader vocabulary for healthy, suspect, selfish, malicious, and limited-evidence behavior.
- Sensor Node Behavior Classification supplies the evidence-first process used before intent-heavy labels are assigned.
- WSN Energy and Duty Cycling explains why schedules and topology roles matter when judging missing relay behavior.
Deck summary
Key takeaways
One node sends its own data but often fails to pass a neighbor's data.
- Selfish and malicious labels are hypotheses supported by evidence, not guesses about motive.
- The difference is how the evidence fits together.
- Selfish forwarding is a cooperation problem.
- That protects the affected path, but it can also reward the free rider if the node is now excused from relay work while its own traffic still moves through other neighbors.
Retrieval practice
Recall check 1 of 3
Packet Pete says: answer from memory, then check your reasoning.
Q1A node forwards its own packets normally but silently drops most traffic it is asked to relay for others. Which classification best fits first?
Show answer
Answer: B Protecting one's own traffic while dodging shared relay work is the selfish hypothesis; malicious needs active-disruption evidence.
Retrieval practice
Recall check 2 of 3
Packet Pete says: answer from memory, then check your reasoning.
Q2A WSN uses a watchdog to detect non-forwarding nodes and a pathrater to route around them. Why might this fail to stop selfish behavior, and what actually deters it?
Show answer
Answer: A Selfish forwarding is a tragedy of the commons.
Retrieval practice
Recall check 3 of 3
Packet Pete says: answer from memory, then check your reasoning.
Q3A relay node keeps sending its own readings, but repeatedly fails to forward neighbor messages. Related nodes confirm that it received the relay requests, and the behavior improves when forwarding is explicitly monitored. Which classification is best supported?
Show answer
Answer: D Selfish-node classification depends on an evidence pattern: own traffic is preserved, shared duties are avoided, benign causes are checked, and behavior may improve when obligations are visible.
Print reference
Answers
Answer key.
- B · Protecting one's own traffic while dodging shared relay work is the selfish hypothesis; malicious needs active-disruption evidence.
- A · Selfish forwarding is a tragedy of the commons.
- D · Selfish-node classification depends on an evidence pattern: own traffic is preserved, shared duties are avoided, benign causes are checked, and behavior may improve when obligations are visible.