**3.4. Monitoring component: Efficient monitoring procedure in reputation systems (EMPIRE)**

In the context of reputation systems, monitoring is the function that is responsible for observing the activities of the nodes of its interest set, for example, the set of its neighbors.

Monitoring operation can be considered as the most expensive part in terms of resource usage for WSN. That is because it requires a node to track the events occurring around it by overhearing packet transmissions, which consumes lots of energy. Moreover, the computations and allocations of such events may consume a considerable amount of processing power and memory space, which are also important to conserve in WSN. As a result, a node has to monitor the behavior of its neighbors in an efficient manner that can provide a better possible way of resource conservation, while being able to reach to a good conclusion about the neighbors' behaviors so that it will take a proper action based on what it has observed. Thus, an efficient monitoring mechanism should guarantee a satisfactory level of capturing neighborhood activities, while trying to minimize power consumption, memory usage, processing activities, communication overhead, etc.

A new monitoring strategy that is called *Efficient Monitoring Procedure In REputation system* (EMPIRE) to solve the problem of efficient monitoring in WSN is proposed in [84]. Monitoring efficiency is realized here by the association between the nodal monitoring activity (NMA) and various performance measures. NMA is determined by the frequency of monitoring actions that a node takes to collect direct observation information. Reducing the frequency of monitoring, i.e. reducing NMA, will affect the quantity and/or the quality of the obtained information. Thus, the performance measures will be affected. However, on the other hand, this reduction implies a saving in node's resources such as power, processing and memory. EMPIRE provides a probabilistic approach to reduce nodal monitoring activities (NMA), while keeping the performance of the system, from the behavior and trust awareness perspective, at a desirable level.

In this procedure as depicted in figure 2, every sensor node is alternating between two nodal monitoring activity states, i.e. ON state and OFF state. A node that is in ON state is a node that performs monitoring activities such as overhearing packets, checking the headers for validation, storing packets to validate events, etc. On the other hand, an OFF node is a node that does not do any monitoring activity. Notice that ON and OFF states are associated with the nodal monitoring activity. Thus, an OFF node may still receive, send and process data not related to monitoring issues. As explained earlier, the objectives of this procedure are realized through the frequency of nodal monitoring activity, NMA. Since nodes alternate between ON and OFF states, reducing NMA is determined by how much a node will stay in each of these states. Thus, when a node stays longer in ON state, its NMA will increase and when it stays longer in OFF state, NMA will decrease. The basic phenomenon of EMPIRE is to allow each node to enter a certain state probabilistically, stay there for a deterministic duration and then, at the end of that duration, it probabilistically leaves its state to the other one or stay for another epoch.

**Figure 2.** EMPIRE algorithm block diagram

262 Wireless Sensor Networks – Technology and Protocols

node is used as a router.

evaluation.

**systems (EMPIRE)** 

 The system assumes always-suspicious nodes. This means that a node can not be fully trusted. Every node is assumed to have a minimum risk that can be encountered if that

 The system assumes a crypto system for any setup requirements. This system is dependent on the routing protocol and, hence, it would imply different

 The system assumes collusion-free attacks. The design of the system, however, can be easily modified to handle collusion based attacks since we adopt modular design.

 The system treats only one type of behavior related attacks, i.e. non forwarding attack. Although the reputation system can be applied to any other attack, we concentrate here on non-forwarding attack. This is because we are not interested in Intrusion detection Systems (IDS), and we want to maintain the focus of the work on reputation system

The system assumes honesty in treating information exchange about nodes energy

In the context of reputation systems, monitoring is the function that is responsible for observing the activities of the nodes of its interest set, for example, the set of its neighbors.

Monitoring operation can be considered as the most expensive part in terms of resource usage for WSN. That is because it requires a node to track the events occurring around it by overhearing packet transmissions, which consumes lots of energy. Moreover, the computations and allocations of such events may consume a considerable amount of processing power and memory space, which are also important to conserve in WSN. As a result, a node has to monitor the behavior of its neighbors in an efficient manner that can provide a better possible way of resource conservation, while being able to reach to a good conclusion about the neighbors' behaviors so that it will take a proper action based on what it has observed. Thus, an efficient monitoring mechanism should guarantee a satisfactory level of capturing neighborhood activities, while trying to minimize power consumption,

A new monitoring strategy that is called *Efficient Monitoring Procedure In REputation system* (EMPIRE) to solve the problem of efficient monitoring in WSN is proposed in [84]. Monitoring efficiency is realized here by the association between the nodal monitoring activity (NMA) and various performance measures. NMA is determined by the frequency of monitoring actions that a node takes to collect direct observation information. Reducing the frequency of monitoring, i.e. reducing NMA, will affect the quantity and/or the quality of the obtained information. Thus, the performance measures will be affected. However, on the other hand, this reduction implies a saving in node's resources such as power, processing and memory. EMPIRE provides a probabilistic approach to reduce nodal monitoring

levels or risk values. Honesty can be accounted for in the rating component.

**3.4. Monitoring component: Efficient monitoring procedure in reputation** 

implementations that are left to the desire of the operator.

memory usage, processing activities, communication overhead, etc.

Changes need to be done in the rating component.

In a cooperative monitoring environment, a node does not need to have a high NMA by continuously monitoring its neighbors' activities as long as there are a sufficient set of nodes that can monitor the same activities. So, if an activity can be monitored by two or more nodes who can share their knowledge among each other, then it is enough to have only one monitor active at a time. Then, upon some scheduling approach, the active node sleeps and another one gets awake. However, this scheduling problem is very complex and depends on different conditions like the network topology, network deployment, nodes mobility, etc. Thus, in our EMPIRE solution, we are trying to induce a condition-independent and probabilistic "virtual scheduling" among nodes to overcome that problem. It is very important here to emphasize the node cooperation assumption. Node cooperation implies that a node will be willing to inform other nodes about its findings from its NMA. This is known as indirect reputation knowledge sharing or second hand information propagation. With this assumption, nodes will still be able to capture the events it loses during its OFF state. EMPIRE is based on a distributed and probabilistic monitoring approach. The main goal of EMPIRE is to provide good monitoring operation that satisfies the security requirements, while using the least possible nodal monitoring activity. This way, a node will also be able to conserve its resources. Our simulation results show that EMPIRE can satisfy various levels of monitoring requirements with different possible choices of nodal monitoring activity levels. Moreover, EMPIRE is safe in the sense that it can differentiate between malicious and non malicious nodes regardless of the choice of the nodal monitoring activity.

A detailed discussion and analysis of the EMPIRE procedure, simulation setup, performance measures, and simulation results can be found in [84].
