External Sinkhole Attack Detection in Large-Scale WSNs Using Metaheuristic Feature Selection

PREPRINT

External Sinkhole Attack Detection in Large-Scale WSNs Using Metaheuristic Feature Selection 1 Seungwoo Han, 1 Sawako Kitagata, 1 Ingon Chanpornpakdi, 1 Toshihisa Tanaka, and 2 Su Man Nam

arXiv:2608.15274v1 [cs.CR] 15 Aug 2026

1

Department of Electrical Engineering and Computer Science, Tokyo University of Agriculture and Technology, Tokyo, Japan 2 Department of Digital Security, Cheongju University, Cheongju-si, Republic of Korea han@sip.tuat.ac.jp, smnam@cju.ac.kr

Abstract—Sinkhole attacks in large-scale wireless sensor networks (WSNs) pose a serious threat to network functionality. This paper presents a metaheuristic feature selection for sinkhole attack detection using the bee swarm optimization (BSO) algorithm. In an external sinkhole attack simulation with 2000 nodes deployed over a 3000 × 3000 m2 field, the proposed method achieves a detection accuracy of 0.997 while reducing the 16feature set to eight features. Index Terms—Wireless Sensor Networks, Sinkhole Attack, Intrusion Detection System, Feature Selection

I. I NTRODUCTION Large-scale wireless sensor networks (WSNs) comprise hundreds to thousands of sensor nodes and enable wide-area monitoring through communication with a base station [1], [2]. WSNs are vulnerable to internal and external sinkhole attacks [3] due to their wireless characteristics. An internal sinkhole attack compromises normal nodes by installing malicious software. On the contrary, an external attack introduces new malicious nodes into the network from outside [3]. Machine learning (ML)-based approaches are powerful solutions for automatic sinkhole attack detection [2], [4]–[8]. However, some of these studies are limited to small-scale environments [4] and internal attack scenarios [4]–[8], or focus on employing a large number of features [2]. In particular, since WSNs operate under resource constraints, low-dimensional feature inputs are essential for reliable operation. Nevertheless, many prior studies have left external attack detection and feature reduction insufficiently explored. In this paper, we aim to detect external sinkhole attacks more efficiently by employing a metaheuristic feature searchbased intrusion detection system using the bee swarm optimization (BSO) [9], [10], assuming a deployment scenario in which the trained inference model operates on the selected features. BSO is well suited for this task due to its ability to explore large search spaces while avoiding local optima. We not only validate our proposed approach in a large-scale environment but also compare it with various feature selection This work was supported by JST BOOST, Japan Grant Number JPMJBS2420. (Corresponding author: Seungwoo Han, han@sip.tuat.ac.jp.) © 2026 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

methods. Moreover, we measure the floating-point operations per-sample (FLOPs/sample) during inference to quantify the reduction in computational cost, verifying that the selected features enable more efficient inference. II. M ETHOD A. Data Generation and Preprocessing We conducted an external sinkhole attack simulation using PyWSNSim [2] with the following configuration: a 2D field size of 3000 × 3000 m2 , 2000 MICAz [11] sensor nodes, a base station located at (2000, 2000), the Dijkstra routing protocol, 10 attacker nodes, an attack probability of 90%, and an attack range of 150 m. The final feature set is composed of 16 attributes, as summarized in Table I. For a description of each attribute, please refer to our previous study and PyWSNSim source code [2], [12]. Among the features, the hop_count column contained infinity values. We replaced infinity values with the maximum finite value in that column and added one to handle an arithmetic error. The simulation data were randomly partitioned such that 80% and 20% were allocated for ML model training and testing, and the features were then z-normalized as follows: z=

x−µ σ

(1)

where x denotes the feature value, µ the mean of the feature, and σ the standard deviation. The training set contains 1559 normal nodes and 41 affected nodes, and the test set contains 390 normal nodes and 10 affected nodes. B. BSO-based Feature Selection BSO [9] is a swarm optimization algorithm inspired by the behavior of bees. The pseudo-code and parameters of the BSObased feature selection [10] are presented in Algorithm 1, with its specific parameter values determined through our empirical selection. To generate neighboring solutions, each bee flips a bit in the current feature vector v according to Eq. (2): vj ← (vj + 1) mod 2 where j is determined as follows:

(2)

TABLE I F EATURE L IST FROM P Y WSNS IM -BASED S INKHOLE ATTACK S IMULATION . 0. pos_x 4. route_changes 8. energy_level 12. consumed_energy_rx

Feature list from PyWSNSim [2] 1. pos_y 2. hop_count 5. distance_to_bs 6. tx_count 9. initial_energy 10. energy_percentage 13. total_consumed_energy 14. tx_energy_per_byte

Algorithm 1 BSO-based feature selection [10] 1: Parameters M axChances ← 3; N umBees ← 10; M axIter ← 5; LocalIter ← 5; f lip ← 4; F itnessF unction f (·) ← Acc.; T abuList ← ∅; ResList ← ∅; 2: Ref F ← randomly choose sinkhole attack features; BestF ← Ref F ; 3: while number of iterations < M axIter do 4: Insert Ref F into T abuList 5: for each bee k = 1, . . . , N umBees do 6: Perform local search iterations LocalIter via Eq. (2) store result in ResList 7: end for 8: if M axChances > 0 then 9: Ref F ← arg maxp∈ResList f (p) via ML model 10: if f (Ref F ) > f (BestF ) then 11: BestF ← Ref F ; 12: else 13: M axChances ← M axChances − 1 14: end if 15: else 16: Ref F ← arg maxp∈ResList minq∈T abuList D(p, q); PNf where D(p, q) = i=1 |pi − qi | 17: end if 18: end while 19: return BestF

j=

  flip · l + (k − 1)     ⌊Nf /flip⌋ · (k − flip − 1) + l 

if k ≤ flip if flip < k ≤ 2 · flip,

      r ∼ U {0, N − 1} f

flip · l + (k − flip − 1) < Nf otherwise

l < ⌊Nf /flip⌋, and

(3)

where k is the bee index, l is the loop index, and Nf is the total number of features. r ∼ U is random sampling. The ML model used to measure detection accuracy (Acc.) was radial basis function-based support vector machine (SVM) [13], and the default hyper-parameters provided by scikit-learn 1.8.0 [14] were used. III. R ESULTS A. Evaluation of Feature Selection Performance Table II shows the inference performance — accuracy, precision (Pre.), recall (Rec.), and FLOPs/sample — for all features and the three feature selection methods. Accuracy, precision, recall, and FLOPs/sample are defined as follows:

3. neighbor_nodes 7. rx_count 11. consumed_energy_tx 15. rx_energy_per_byte

TABLE II P ERFORMANCE COMPARISON OF DIFFERENT FEATURE SELECTION METHODS . Method All features (Baseline) Low-variance threshold LASSO BSO (Proposed)

Nf 16 13 8 8

Accuracy =

Acc. 0.995 0.995 0.992 0.997

Pre. 1.000 1.000 0.888 1.000

Rec. 0.800 0.800 0.800 0.900

FLOPs/sample 1952 1586 1040 912

TP + TN TP + TN + FP + FN

(4)

TP TP + FP

(5)

TP TP + FN

(6)

Precision = Recall =

FLOPs/sampleSVM inference = 2 · Nsv · Nf

(7)

where T P , T N , F P , F N , Nsv denote number of true positives, true negatives, false positives, false negatives, and support vectors, respectively. The FLOPs were measured using the FLOPpy [15]. All features achieved an accuracy of 0.995. Low-variance threshold elimination retained 13 features and achieved the same accuracy, while least absolute shrinkage and selection operator (LASSO) [16] reduced the feature count to eight features with an accuracy of 0.992. Notably, the BSO-based method achieved the highest accuracy of 0.997, using eight features with indices 0, 1, 2, 5, 6, 13, 14, and 15. Beyond accuracy, the proposed method also attained the highest precision of 1.000 and recall of 0.900, whereas LASSO, despite using the same number of features, yielded a lower precision of 0.888 and recall of 0.800. In terms of computational cost, the proposed method required only 912 FLOPs/sample, the lowest among all methods and roughly a 50% reduction compared with using all features. These results suggest that the BSO-based method achieves accuracy on par with the other approaches while attaining the best overall performance across the three metrics at the lowest computational cost. B. Comparison of Existing Works Table III compares our result with existing ML-based sinkhole attack detection studies. The results demonstrate that the proposed method maintains high accuracy even in a large-scale environment containing a large number of nodes. Moreover, unlike some existing studies that report only accuracy and omit

TABLE III C OMPARISON OF EXPERIMENT SCALE AND DETECTION PERFORMANCE WITH EXISTING STUDIES . VALUES DENOTE FIGURES REPORTED IN THE REFERENCED STUDIES . Author Ioannou et al. [4] Aissaoui et al. [5] Hasan et al. [6] Bensaid et al. [7] Khedr et al. [8] Han et al. [2] This study N.R. : Not reported.

Inference model Logistic regression SVM Random forest Neural networks Neural networks SVM SVM

Attack type Inside Inside Inside Inside Inside Outside Outside

Field size 5×5 100 × 100 500 × 500 1000 × 1000 1100 × 1100 2000 × 2000 3000 × 3000

precision and recall, our study evaluates the model comprehensively across precision and recall as well as FLOPs/sample. IV. D ISCUSSION This study has two points that warrant further validation. First, the performance improvement over the baseline is relatively marginal, and the evaluation is confined to simulations employing an SVM. In addition, the model was evaluated on a random data split, and we plan to conduct a cross-validation in future work given the class imbalance. Second, as BSO is a metaheuristic that necessitates iterative evaluations, its overall computational cost is likely to be substantially higher than that of alternative feature selection methods. However, this cost occurs only once during training, while our efficiency gains apply to the recurring per-sample inference at deployment. Nevertheless, the selection cost should still be weighed against model inference benefit when determining an appropriate feature selection strategy. V. C ONCLUSION In this paper, we evaluated the effectiveness of metaheuristic feature selection for external sinkhole attack detection in largescale WSNs. The evaluation demonstrates that the feature set can be successfully reduced to a smaller number of features while maintaining a high detection accuracy. Future work will extend this study by designing unsupervised models that achieve both low inference energy consumption and high detection accuracy. R EFERENCES [1] S. M. Nam and H. J. Kim, “WSN-SES/MB: System Entity Structure and Model Base Framework for Large-Scale Wireless Sensor Networks,” Sensors, vol. 21, p. 430, Jan. 2021. [2] S. Han, T. Tanaka, and S. M. Nam, “PyWSNSim: A Python-based component-oriented simulation framework for sinkhole attack analysis in large-scale WSNs,” SoftwareX, vol. 34, p. 102667, 2026. [3] H. Shafiei, A. Khonsari, H. Derakhshi, and P. Mousavi, “Detection and mitigation of sinkhole attacks in wireless sensor networks,” Journal of Computer and System Sciences, vol. 80, p. 644–653, May 2014. [4] C. Ioannou and V. Vassiliou, “Accurate Detection of Sinkhole Attacks in IoT Networks Using Local Agents,” in 2020 Mediterranean Communication and Computer Networking Conference (MedComNet), p. 1–8, IEEE, 2020. [5] S. Aissaoui and S. B. Hacene, “Sinkhole Attack Detection-Based SVM In Wireless Sensor Networks,” International Journal of Wireless Networks and Broadband Technologies, vol. 10, no. 2, p. 16–31, 2021. [6] M. Z. Hasan, Z. M. Hanapi, Z. A. Zukarnain, F. H. Huyop, and M. D. H. Abdullah, “An efficient detection of Sinkhole attacks using machine learning: Impact on energy and security,” PLOS ONE, vol. 20, p. e0309532, Mar. 2025.

Node count 25 20 50 45 500 1000 2000

Nf 4 2 5 8 4 16 8

Acc. 1.000 1.000 1.000 0.971 0.954 0.980 0.997

Pre. 1.000 N.R. 1.000 N.R. 0.972 1.000 1.000

Rec. 1.000 N.R. 1.000 N.R. 0.978 0.764 0.900

FLOPs/sample N.R. N.R. N.R. N.R. N.R. N.R. 912

[7] H. Bensaid, “Machine Learning Techniques for SinkHole Attack Prediction in IoT,” in 2025 3rd International Conference on Electronics, Energy and Measurement (IC2EM), p. 1–6, IEEE, May 2025. [8] A. M. Khedr, P. V. P. Raj, and S. S. Rani, “Time Synchronized Multivariate Regressive Convolution Deep Neural Network Model for Sinkhole Attack Detection in WSN,” Wireless Personal Communications, vol. 134, p. 361–382, Jan. 2024. [9] H. Drias, S. Sadeg, and S. Yahi, Cooperative Bees Swarm for Solving the Maximum Weighted Satisfiability Problem. Springer Berlin Heidelberg, 2005. [10] S. Sadeg, L. Hamdad, K. Benatchba, and Z. Habbas, BSO-FS: Bee Swarm Optimization for Feature Selection in Classification, p. 387–399. Springer International Publishing, 2015. [11] MEMSIC Inc., “MICAz datasheet: 6020-0065-05 rev.” San Jose, CA, 2003. [12] “PyWSNSim github repository, https://github.com/sumannam/pywsnsim,” Accessed: 29 May 2026. [13] C. Cortes and V. Vapnik, “Support-vector networks,” Machine Learning, vol. 20, no. 3, p. 273–297, 1995. [14] F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and Édouard Duchesnay, “Scikit-learn: Machine Learning in Python,” Journal of Machine Learning Research, vol. 12, no. 85, pp. 2825–2830, 2011. [15] F. Scala, F. Mandarino, L. Martirano, and L. Pontieri, “FLOPpy: A hardware-agnostic Python library to monitor the computational cost of machine and deep learning algorithms,” SoftwareX, vol. 35, p. 102865, 2026. [16] R. Tibshirani, “Regression Shrinkage and Selection Via the Lasso,” Journal of the Royal Statistical Society Series B: Statistical Methodology, vol. 58, p. 267–288, Jan. 1996.

Related documents

• iWatchRoad: Scalable Detection and Geospatial Visualization of Potholes for Smart Cities#173344
• Cyber-attack detection via non-linear prediction of IP addresses: an innovative big data analytics approach#344700
• Scalable Variable Selection under Predictor Dependence with Adaptive Virtual Dummies#1105815
• Methods for Estimating Selected Low-Flow Statistics at Gaged and Ungaged Stream Sites in Massachusetts#621770
• Fractal basins trap latent reasoning#971926