Wireless sensor networks consist of autonomous,
self-organizing, low-power nodes which collaboratively measure
data in an environment and cooperate to route this data to its
intended destination. Black hole attacks are potentially devastating
attacks on wireless sensor networks in which a malicious
node uses spurious route updates to attract network traffic that
it then drops. We propose a robust and flexible attack detection
scheme that uses a watchdog mechanism and lightweight expert
system on each node to detect anomalies in the behaviour of
neighbouring nodes. Using this scheme, even if malicious nodes
are inserted into the network, good nodes will be able to identify
them based on their behaviour as inferred from their network
traffic. We examine the resource-preserving mechanisms of our
system using simulations and demonstrate that we can allow
groups of nodes to collectively evaluate network traffic and
identify attacks while respecting the limited hardware resources
(processing, memory and storage) that are typically available on
wireless sensor network nodes.