Node compromise occurs when an attacker through some subvert means, gains the control of a node in the network after deployment. Once in control of that node, the attacker can alter the node to listen to information in the network, input malicious data, cause black hole, or any one of a myriad of attacks on the network. Generally a node compromise occurs in two ways. The first way is called physical/external attack, when the attacker physically accesses or captures a node, and then directly connects the node to his/her computer via a wired connection of some sort. Once connected the attacker controls the node by extracting the data and/or putting new data, etc. Most researchers in this area have only considered this kind of node compromise attack and many methods have been discovered to detect such attacks. The second way is called soft/internal attack, when the attacker compromises a node in a network via software/viruses which can spread over the physical communication channels or over the air interfaces. The soft attack method is hard to be detected and is the main or the only reason that leads to the emergence of compromised nodes in some practical applications. This proposed research aims at developing node compromise distribution models and their defending considerations for Mobile Ad-hoc Sensor Networks. Specifically, the research involves an exploratory investigation of modeling attack distribution that can help system to estimate the probability of a node being compromised and thus defend against it effectively and efficiently. We develop several models for a node compromise based on different application environments. Furthermore, we develop an analytical framework to theoretically evaluate our node compromise distribution models. The analytical results will be evaluated by extensive simulations and experimental measurements.
