Abstract: The anomaly detection of sensor nodes is a great challenge to wireless sensor networks. A feature based on task transition probability is therefore proposed to model running states of sensor nodes, and the feature can be further used for anomaly detection. Task transition probability based anomaly detection (T2PAD) analyzes states of sensor nodes based on the one-step transition probability of running tasks within the nodes, and then performs anomaly detection by comparing similarities between transition probability vectors. T2PAD can identify tasks that caused the anomaly and narrow down the scope of problematic code, which provides clues to deal with the anomaly. Case studies on defects from a sensor network open source project are carried out to verify the effectiveness of T2PAD.

Key words: wireless sensor network, anomaly of sensor node, transition probability matrix, node state feature