Abstract
In this paper, we study the problem of secure localization in Mobile Wireless Sensor Networks (MWSNs) where beacon nodes are not available. The location reference information is obtained from neighboring nodes within the commination rage of the target node, with the help of a relative location map. A Relative Location Map based Robust Positioning Algorithm (RLMRPA) for MWSNs is presented. The location estimate of the localizing node is formulated by constructing a distance measurement error model. Considering limited resources available, the steepest descent, which is fast and easy to implement, is employed to iteratively find the optimal solution. A 3- Farthest Neighbors Trilateral Localization Algorithm (3FNTLA) is presented to find the initial position. Considering that malicious neighbors tend to cause larger distance measurement errors and the further the neighbor, the larger the measurement error, an attack-resistant distance residue method is developed to neutralize the impact of inconsistent measurements. Our experiments show that the RLMRPA can perform secure location determination, even with some neighbors aiming at making the localization failed. In addition, our simulation results also demonstrate that the RLMRPA is more resistant to attacks and achieves higher localization accuracy than existing methods.
Introduction
In the last few years, the localization issue in wireless sensor networks (WSNs) has gained a lot of popularity for providing flexible and novel location-aware applications such as wildfire detection, fire detection in jungles, battlefield surveillance, and traffic regulation [1]. Common queries accompanying these applications are, for instance, “where are the detected animals?”, “where is the fire?”, “where is the enemy?”, and “where is a traffic jam?” To answer these questions, sensor needs to determine their location before they start sending gatheredinformation [2].
However, putting Global Positioning System (GPS) devices in every node or manually configuring locations is not cost effective for most sensor network applications [3].
There are two main scenarios for deploying sensors; depending on whether the sensor locations can be adjusted after the initial deployment [4]. The first scenario is the static deployment where all sensor locations are fixed and will not be changed once deployed. The second scenario is the mobile deployment where sensors can rearrange their locations after being deployed. Sensor network deployments are usually determined by real applications. For deployments in a wide area, adjusting node locations is generally infeasible. By contrast, when nodes are equipped with mobile capabilities, redeployment is possible. In fact, it has been shown that the integration of mobile entities into WSNs can improve coverage, and thus, utility of the sensor network deployment [5, 6]. For example, Fig. 1 illustrates a Mobile Wireless Sensor Network (MWSN) that can monitor forest fires. Mobile sensors can track the fire and provide update information to firefighters that detect where the fire edge currently is.

A MWSN that can monitor forest fires.
MWSNs are vulnerable to malicious attacks in untrusted environments, which is similar to static WSNs. The adversary can easily compromise mobile nodes, steal secret keys, and transmit misleading information to prevent accurate localization. Although a number of methods have been proposed to secure localization for static WSNs [7–11], few of these methods are suitable for MWSNs. When these methods are applied to MWSNs, they may suffer from limited resources and high computation overhead, because they need to update position estimates periodically to keep track of mobile sensors. Hence, the presence of malicious attacks also makes secure localization for MWSNs more complex.
Several works have been proposed for MWSNs [12–14]. However, mobile beacons know their own positions are assumed to be tamper-proof and trustworthy. This is a strong hypothesis in the real world. Prior deployment of beacons is impractical in many MWSNs applications (for example, mobile sensors dropped from a plane over a battlefield). Even if this is possible, in the lifetime of a network, the possibility of mobile beacons being compromised or tampered by adversaries is quite high as they periodically declare their positions. These mobile beacons may be re-programmed by adversaries to provide wrong location estimates to target nodes that are localizing themselves. If a majority of beacons in a given area are compromised, all regular nodes within this area will be cheated. This is a fairly serious setback for localization procedure because wrong localization may lead to damaging consequences. Naturally, we raise a problem:” Is it possible to design a secure MWSNs localization method that can be resistant to malicious attacks, without requiring anybeacons?”
In this paper, we propose a secure distributed localization method by employing a relative location map and by developing a steepest descent approach, which fuses the initial position optimization and tolerance of bad location references, to address the above-mentioned challenging problems for MWSNs. The proposed RLMRPA has the followingfeatures. It uses a relative location map to collect information about location relationships with nearby nodes. Together with knowledge of the absolute locations of three or more nodes, it can easily determine the absolute locations of the remaining nodes in the network by translating the corresponding parameters. It constructs a distance measurement model for the analysis of secure localization, in order to find the best estimate for the localizing node. It takes a distrusted approach only involves local information (information within nearby nodes) and utilizes steepest descent method to satisfy the demands of limited resources forMWSNs. It exploits a 3FNTLA to optimize the initial location estimation and a robust distance residue method, which is more robust and resilient to attacks than other existing methods. Thus, it can effectively mitigate the impact of abnormal location information on the localization accuracy. It can guarantee a bounded localization error if and only if there are no more than [M/2] - 2 cheating neighbors, where M is the number of neighbors providing location information.
The rest of the paper is organized as follows: Section 2 reviews some related work. Section 3 describes the network structure, distance measurement error model, and threat model. Details of our RLMRPA method are introduced in Section 4. We present the experimental results and show some favorable simulation results in comparison to other methods in Section 5. Section 6 discusses a necessary condition for the exact localization of the localizing node. Finally, Section 7 concludes the paper in which we also discuss some future work.
Many localization schemes [15–21] have been proposed for MWSNs as traditional localization schemes are inefficient in mobile environments. Most of existing schemes utilize the Sequential Monte Carlo (SMC) method [15–19], which can naturally exploit the mobility of nodes to improve localization accuracy. Other schemes like periodically restarting traditional localization processes [20, 21] have high energy overhead or require special hardware (e.g., accelerometer [21]). These schemes can work well in hostile-free environment, but their localization accuracy suffers in the existence of malicious attacks.
There are a larger number of mechanisms been proposed for secure sensor localization in static WSNs [22, 27]. These mechanisms provide a set of good approaches to detect and filter out corrupted beacons and unknown nodes. According to who plays the role of the verifier and which information the mechanism verifies, these mechanisms can be classified into two categories. In the first category, a few centralized, but trusted nodes (called verifiers) detect and filter out fake measurement claims of individual nodes generated by adversaries, and then enable a secure computation of the locations of unknown nodes by employing several secure approaches. In the second category, unknown nodes detect the abnormal location information of beacons during the localization process. Through a suite of secure techniques, unknown nodes can filter out the corrupted beacons and only use the trusted beacons to compute their location. The above studies mainly eliminate the incorrect location information or figure out malicious nodes, however, hardly deal with location information of nodes, when these nodes move randomly.
Compared with static WSNs, very little work has been done on secure localization for MWSNs. In [28], the authors proposed a Secure Monte Carlo Localization algorithm (SecMCL) that can be used for secure localization in MWSNs. The key idea of SecMCL is to represent the posterior location distribution of nodes by a set of weighted samples, and in each time unit, nodes predict new samples based on samples in previous time unit. It also can filter out invalid samples based on new observations about 1-hop and 2-hop beacons. However, SecMCL suffers from high memory requirements and computational complexity. Hence, SecMCL may not be unsuitable for resource- constrained MWSNs. In [29], the authors proposed a game-based security localization algorithm (GSL) for solving the mobile node self-localization problem in the presence of malicious node. GSL utilized an improved game theory and the pluralistic behavior of neighboring beacons to establish a trust-preferential strategy. However, GSL requires a large number of beacons and incurs a larger amount of calculation in the to-localized nodes.
A common weakness of the mentioned secure localization mechanisms in MWSNs comes from the beacons with known coordinates. However, beacons are vulnerable to malicious attacks in the untrusted environment, since the number of beacons is much less than that of ordinary nodes. They could be located and compromised more easily by adversaries as they periodically broadcast their own locations. A natural method that overcomes this weakness is to eliminate all beacons. That is to say, it is recommendable to design a secure localization mechanism for MWSNs, where each node determines its location merely relies on nearby nodes, instead of depending on beacons.
In this paper, we are interested in performing secure localization in a more general network environment where the prior deployment of beacon is impossible, the node distribution is irregular, and where all nodes can move uncontrollably. In [2], the authors proposed a gradient descent (GD) algorithm for the case where the network may not have any beacon nodes. The algorithm combines traditional gradient descent with a selective pruning 50% to filter out and neutralize the effect of incorrect measurements reported by adversaries.
In [30], however, the authors found that pruning 50% of the malicious beacons may lead to increasing localization error. Pruning 6% of the malicious beacons instead of 50% causes to decrease the localization error by (roughly) 0.6–1.1 m.This phenomenon exists for two causes: On the one hand, it is conceivable that directions of some force vectors provided from malicious beacons are reasonable. Pruning these vectors causes to converge to the actual location slowly. On the other hand, these directions seem to be at random, they can eliminate the effect of each other. This may contribute to improving localization accuracy. Hence, it is improper to prune 50% of the beacons arising from adversaries. It is clear that the GD secure localization algorithm which combined traditional gradient descent with pruning stage is not robust against abnormal location information.
In [31], the authors also presented a combined game-based theoretic with gradient descent (GAME) technique for WSNs, which the learn reputation weights of anchor nodes can be used for sensor localization, but the calculation is quite heavy.
In the above two methods, the initial solution is generated in a random way, which can cause the increased search scope to become larger, and reduce positioning accuracy. Furthermore, the fixed and variable step size selection can also delay the positioning time.
Motivated by the above observation, in this paper, we do not aim at proposing a new localization mechanism which only prunes 6% of malicious beacons for secure localization in MWSNs. Instead, we focus on proposing a new, accurate, and easy to implement secure localization scheme, with the help of the relative map, to make position estimation procedure much more robust against malicious attacks and to make it also suitable for resource-constrained sensors.
The RLMRPA has the following obvious advantages: It can improve the localization error and success localization probability compared to other secure localization schemes for MWSNs in the presence of adversaries. It can improve the security of the localization process for MWSNs since it guarantees the security of each node in each time unit. It can be easily extended to supper secure localization for static WSNs. It can effectively reduce the energy consumption for the MWSNs applications, as it is computationally simple and efficient.
System model
In this section, the secure localization problem for mobile sensor networks is considered, where beacon nodes are not available. The localizing node determines its locations based on a signal of neighboring nodes containing their self-location and distance measurements. We call such a set of the location and measurement obtained from corresponding neighboring node as a location reference.
Due to all nodes are deployed in a move way, we need to update the node estimation periodically after a fixed amount of time. This problem can be simplified to build a relative location map that a visual representation on distances and relations among neighboring nodes. The absolute location of node is equivalently only a translation of the relative location. Once the absolute locations of any three nodes have been known, the absolute locations of the remaining nodes can be determined by estimating the translation parameters.
Thus, localization of sensor nodes in MWSNs can be done in three steps: a) collecting the reference location information from nearby nodes, b) calculating the relative location of node in the networks, and c) translating the relative location into the absolute location.
Network model and notations
In this paper, we suppose that all nodes are deployed randomly in a two-dimensional sensor field. Moreover, nodes can move randomly in the network. To make sensor nodes know their location, the network periodically restarts localization. Assume that all communication channels are established securely and authentically.
Suppose that m represents the number of nodes in the network. For the sake of presentation, we denote the actual position of the localizing node i by L i (t) = [x i (t) , y i (t)] T and its relative location estimate by . At each time-instant t, a localizing node i receives the current location estimate of neighbor j, a time-stamp from node j, and an estimated inter-node distance . The could be obtained through different range-based techniques such as Received Signal Strength Indicator (RSSI) or Time of Arrival (ToA).
Owing to ranging noises in , the measurement errors can be modeled as an additive Gaussian noise with zero mean and variance . As is the case in [31], this paper also assumes that all nodes remain stationary during the transmission and processing for time-stamp signals. Additionally, the neighboring node j may report the wrong location and the wrong estimated distance to force the position of localized node i far from the actual location L i (t).
In this paper, we regard nodes transmitting misleading information as malicious nodes. Malicious nodes contain adversarial and compromised nodes. Adversarial nodes may intentionally try to give bad or false responses, while compromised nodes may be controlled by an adversary and have wrong inputs to offer. With the help of compromised nodes, adversaries can alter nodes to listen to information in the WSN, circumvent any security mechanisms on nodes, recover network keys, reprogram normal nodes, and revoke legitimate nodes to corrupt localization. All these attacks will eventually result in the localizing nodes to obtain the incorrect location reference from their neighboring nodes.
Assume that the incorrect values of neighboring node j are , where η j represents the location error and δ ij represents the distance error. Without loss of generality, we may assume that all errors can be imposed on the distance measurements, since any modification in the location information can be easily transformed into equivalent modification in the distance. In other words, we may just consider the , as the information in be equivalent with the information in . Suppose that we compute the localizing node i using trilateration approach. The equivalency process has been shown in the Fig. 2.

The equivalency process.
Consequently, we can apply attacks to location references (j ≠ i, j = 1, 2, …, N) by modifying only estimated distances . As a result, the secure localization problem for MWSNs is equivalent to finding a set of relative location estimates such that the estimated inter-node distances are equal to the actual inter-node distances d ij (t). For clarity, Table 1 lists the symbols and notations used in this paper.
Symbols and notations
All localization methods are intended to estimate the node location as close to its real location as possible. As described earlier, any modification in locations can be easily transformed into equivalent modification in distance measurements. Hence, we may suppose that the estimated location is very close to the real location in the case where distance measurements are error-free.
However, due to the influence of measurement noises and malicious attacks, distance measurement is always prone to error. Let d ij (t) denote the actual inter-node distance between nodes i and j by d ij (t) = ||Li (t) - L j (t) ||. If we ignore the errors in distance measurement, the estimated distance is equal to the actual distance d ij (t). So, after receiving the signal from nearby node j, distance measurement model can be written as:
Where || . || denotes the 2-norm and is the distance measurement errors. We define
Where υ j is the location reference attack variable and ψ j is the independent N Gaussian variable representing noise measurement.
If the distance measurements are noise-free and the neighbors are benign, i.e. , then the actual location L i (t) of the localizing node i is the common point of the bound circles, provided that there are at least three non-collinear neighbors within its communication range, as shown in Fig. 3(a). If some of the neighbors, in its range, are lying by enlarging or reducing their corresponding distance measurements, then the localizing node i will be located at the wrong position instead of the actual position L i (t), as shown in Fig. 3(b).

Neighbors reference circles with or without measurement noises and malicious attacks.

Location-Reference attacks.
In this subsection, we analyze the threat model to understand the adversary’s capabilities. Intuitively, location references introduced by adversarial attacks are aimed at misleading the location estimation of sensor nodes. We roughly classify them to non-collusion attacks and collusion attacks based on the smart level. Exemplary scenarios have been demonstrated in Fig. 4. In non-collusion attacks, malicious nodes are deemed to act independently. In collusion attacks, malicious nodes are deemed tocooperate. Non-Collusion Attacks: different bad location references are to mislead the localizing node to different incorrect locations, e.g., and in Fig. 4(a). We model the non-collusion attack by adding a random variable γ
j
uniformly distributed in an interval (0, dmax]. The strength of the non-collusion attack is characterized in terms of the distance, dmax. So, the distance error is.
Collusion Attacks: all bad location references are to mislead the localizing node to a random but the same incorrect location, e.g., L′ in Fig. 4(b). Collusion attacks are difficult launched in mobile sensor networks, as adversaries need to know the location of each node. However, all nodes are moving. Currently we do not consider the countermeasure of collusionattacks.
In this section, we present a robust positioning algorithm that is still accurate in the existence of malicious nodes aimed at misleading the location estimation of sensor nodes in MWSNs. In order to accurately determine the sensor position in the presence of malicious nodes, we need to identify malicious neighboring nodes and tolerate malicious location references introduced by adversaries. We first consider the optimal estimate given the true location of the localizing node.
Based on the distance measurement model given in Equation (1), our goal is to estimate the location of the localizing node when estimated distances are very close to real distances. So, the optimal estimate of the localizing node can then be found by minimizing the following sum of squared distance measurement errors
We define the error cost function
Therefore, the problem of secure localization in MWSNs is equivalent to finding the most suitable point F i in x-y that F (x, y) has its minimum value and . It can be seen that F (x, y) is a summation of N convex functions. So, it is a convex function as well [32]. The convexity of F (x, y) makes it suitable to apply steepest descent based algorithm to find its optimal point. Steepest descent approach is also known as gradient approach, and it is the simplest one among the existing unconstrained convex optimization solutions for nonlinear equations. The general steepest descent algorithm is described as follows:
Where Φ represents the objective function and u represents the estimated variable. The steepest descent is an iterative search approach to find the minimum of the objective function in Equation (6) at step k+1 as follows:
The RLMRPA involves two tasks: finding the initial position and tolerating bad location references caused by the malicious neighbors.
An initial position, to a large extent, affects the localization accuracy. The initial coordinate is usually established by random assignment. But the random coordinate often gets stuck in a local optimum during the iteration process. Because of the defects of the random assignment, in this paper, a 3FNTLA is presented. We select 3 largest distances between the target and the neighbors, and then calculate the initial reference coordinate of the target node using trilateral centroid localization.
The prerequisite for the 3FNTLA is that there may be relatively large errors in the distance between the target and the neighbors. The error causes the measured distance to be less than or more than the actual distance.
Based on the above assumption, the 3FNTLA works as flows:
Three largest distances between target and neighbors, expressed as d1, d2, and d3, are calculated. The coordinates of beacons are indicated as A (x1, y1), B (x2, y2), and C (x3, y3), respectively. The coordinate of target node is indicated as M (x, y).
Circles A, B, and C can intersect with each other. The equals sign = in Equation (11) should be revised as the less than or equal to sign: ≤.
The coordinates of crossover points can be obtained, which are respectively expressed as . Based on the axiom that the distance between any point in the intersecting region of three circles and the center of a circle is less than that the radius of circle, the vertex of the triangle region, where the target node is located, can be obtained. Assume that the coordinates of three vertices are E (a1, b1) , F (a3, b3) , G (a5, b5).
According to the centroid localization method, the initial coordinates of the target node i is calculated as
In this subsection, we introduce the distance residue processing method to minimize the impact of bad location references caused by the malicious neighbors.
Starting from the optimized initial location in the deployment area, RLMRPA iteratively moves the estimate toward the lower values of F by taking steps in the direction of the negative distance residue gradient drg i (t). Thus, the distance residue gradient drg i (t) is calculated as
As shown in Fig. 5, the ∥drv ij (t) ∥ 2 of the neighboring node j is the distance between the current estimate and the circle of radius around j. The drv ij (t) direction along the line joining and the location of the neighbor node j. The sum of these vectors gives the distance residue gradient.

Representation of distance residue vectors.
Regardless of being honest or dishonest, each neighbor j provides the localizing node i with a distance residue vector drv ij (t). In the first few iteration steps, most nodes would have large vectors. But after a few iterations, the anomalous nodes would have larger vectors in comparison to the majority of honest nodes.
This is because if a fraction of neighbors are malicious, their corresponding residue vectors are error-ridden. In Fig. 5, the larger ∥drv ij (t) ∥ 2 that are colored in red are belonged to the malicious neighboring sensors and need to be reduced their adverse influence. If the number of malicious neighboring nodes increases, the location estimation faces more errors. To reduce the localization error, several neighbors that have larger ∥drv ij (t) ∥ 2 values, are identified as malicious and should be eliminated or removed. However, directly removing the neighboring nodes which have high ∥drv ij (t) ∥ 2 values may increase the localization error.
As described in Section 2, pruning 50% of the malicious beacons in [2] may lead to increasing the localization error. Hence, secure localization becomes the problem of finding best vector sets to improve localization accuracy. To address this problem, we need a new method that can not only reduce the impact of inconsistent measurements arising from malicious nodes but also guarantee on localization accuracy. The main idea behind the method is to live with bad neighbors instead of mitigating all possible bad neighbors.
Intuitively, the drv ij (t) vector introduced by the adversary is aimed at misleading the location estimation at sensor nodes. It is usually “different” from the genuine vector. Hence, there must have some “inconsistency” between the malicious vector and the genuine one. (An adversary might have a drv ij (t) vector consistent with the genuine one after altering both the position and the distance measurements. However, such a drv ij (t) will not generate significantly negative influence on the location determination.) To harness this observation, we propose to utilize the “inconsistency” among vectors to identify the malicious ones, and then mitigate the erroneous impact before ultimately estimate the location of the target node.
In order to do this, a weighted method, which combined the suspiciousness of the drv
ij
(t) vector with the distance deviation, is introduced into the location determination. The basic idea is to evaluate the suspiciousness of each neighbor based on the relative deviation of ∥drv
ij
(t) ∥ 2 and the distance deviation based on the distance between the neighbor and the target. The neighbors with a high degree of suspiciousness will be regarded as being malicious. There is a great probability that the neighbor is compromised and its location information may be intentionally modified. The further the neighbor, the larger the measurement error [34]. The distance deviation weight wdj is inversely proportional to the interval.
The following issue is to determine the suspiciousness of each neighbor based on its provided ∥drv ij (t) ∥ 2 value. Evaluate the suspiciousness of each neighbor has two purposes.
Firstly, if the ∥drv ij (t) ∥ 2 value is larger, it means that the vector is likely to correspond to the inconsistent measurement obtained from compromised or malicious node. Otherwise, it is likely to correspond to the genuine one. To achieve high localization accuracy, the fraction of vectors with large ∥drv ij (t) ∥ 2 values need to be minimized the impact of their inconsistent measurements and then be combined with the remaining genuine vectors to calculate the overall gradient.
Secondly, the suspiciousness also decides how much a vector may contribute to the final gradient. This is reasonable since if the vector from a neighbor tends to be incorrect, it should be counted less on the final gradient. In the other words, if the ∥drv
ij
(t) ∥ 2 has a larger relative deviation, it means that the vector obviously deviates from the other genuine ones that can correctly calculate the sensor position, and it has a worse impact on localization accuracy. So, the bigger the suspiciousness weight ws
j
is, the higher the probability of a neighbor is under attack, and the lower the influence of attacks on the localization accuracy should be reduced. The suspiciousness weight ws
j
is calculated as
in which is the average distance residue value and is calculated as
Then, the location estimate is dynamically updated by moving it one step along the direction of the resultant weighted gradient.
The pseudo code of the RLMRPA algorithm is presented in Algorithm 1.
Robust positioning algorithm
In the section, we perform extensive simulations to evaluate the performance of the proposed RLMRPA for secure localization in MWSNs under the threat model described in Section 3.3. In our simulation setting, sensor nodes N = 30 are deployed randomly in an area of 100 m×100 m. The used mobility model is similar to the common mobile and ad-hoc networks model proposed in [3, 35]. The standard deviation of distance measurement noise is set to be σ n = 2 m. The default parameters are in Table 2.
Default parameter settings
Default parameter settings
The network and sensor parameters we vary are: Velocity of the node (v), the moving distance per time unit. The moving velocity of the node is the range of [0, vmax]. We study the impact of varying v in Section 5.1.1, and use a fixed v = 2 for other experiments. Distance measurement error (dmax), the maximum distance errors imposed on the distance measurements. We consider the effects of varying dmax in Section 5.1.2, and use a fixed dmax = 20 m for other experiments. Proportion of malicious neighbors (p
m
), the ratio of the compromised neighbor around the target. We consider the effects of varying p
m
in Section 5.1.3, and use a fixed pm = 30% for other experiments.
In addition, iteration number is regarded as one of the important factors affecting the algorithm efficiency. We consider the convergence in Section 5.1.4.
In order to evaluate the effectiveness of our RLMRPA, we compare our proposed algorithm with other two algorithms: GD [2] and GAME [31]. For GD and GAME, the step size can be chosen as [2] and [15 - 15 (i - 1)] v/k [31], where i represent iteration times, i = 1, …, k.
There are two performance metrics used in our simulation: Localization Error (LE): the sum of the absolute difference between the real inter-node distances d
ij
(t) and the computed inter-node distances , i.e.
Probability of correct localization (Pcl): the probability of the estimated sensor location being within a distance of σ
n
i.e. 2 m from its actual location over 1500 runs, i.e.,
Localization error determines the performance of the methods in terms of the estimation accuracy of the relative location map. A lower localization error indicates that the method can accurately provide a relative location map satisfying all distance constraints.
Node velocity
We assume that nodes are unaware of their velocity and direction, but have a known maximum velocity v. We represent the maximum node velocity as v and vary node velocity from 0 to 3.5. The node velocity at each instant is a random variable with x and y components V x and V y , uniformly distributed on [0, V].
Figure 6 indicates the localization accuracy of different algorithms when node velocity varies. We can see when node velocity v is less than 3.5, the increment of localization error is very slighter in the proposed RLMRPA method as opposed to GD and GAME as the maximum measurement dmax increases. When the maximum velocity v increases to 3.5, all algorithms have an observable growth in the localization accuracy. However, the localization error is obviously lower for the RLMRPA when compared to others. This is consistent with our idea that the neighboring nodes which have higher vectors can be minimized their wrong effects on the localization accuracy in the whole localization procedure by employing the attack-resistant distance residual and the initial location optimization technology. The traditional GD method just directly removes the malicious neighbors in the final calculation stage so as to increase the localization error. GAME also shows a high localization error because the random assignment approach for the initial position estimation and the step size selection affects its efficiency.

Impact of node velocity for dmax = 20 m and pm = 30%.
Figure 7 shows the localization errors of different algorithms from dmax 5 to 30 m. The localization errors of all algorithms increase as dmax increases, which is very natural. Each compromised neighbor j randomly selects a false location d j away from the real location to broadcast, 0 < d j ≤ dmax. We can see that RLMRPA outperforms others in the localization accuracy, because it filters the effect of malicious neighbors. GAME converges faster than GD due to its filtering ability.

Impact of distance measure error for v = 2 and pm = 30%.
We examine the localization errors of different algorithms from pm 0% to pm 49%, as shown in Fig. 8. When the number of malicious nodes is no less than (M-2)/2, where M is the number of reference nodes providing information, no method can provide any degree of localization accuracy, as discussed in Section 6.

Impact of Proportion of malicious neighbors for v = 2 and dmax = 20 m.
The proposed RLMRPA outperformed other methods. For RLMRPA, the location estimation accuracy increases steadily as the proportion of malicious neighbors increases. When pm is larger than 40%, RLMRPA and GAME have similar localization errors. The main reason for the rapid increase in the localization error is that more malicious neighbors can result in worse localization accuracy.
Figure 9 shows the RLMRPA converges rapidly compared to others under the same circumstances. For example, the RLMRPA algorithm takes 26 rounds of iteration to reach lower localization error (i.e. 0.9973 m), whereas GAME takes 185 rounds to reach 1.0945 m, and GD takes 103 rounds to reach 1.1928 m. Due to the use of the same communication model, the less iteration number, the less communication overhead. The proposed RLMRPA uses the centroid of the intersection of farthest neighbors as the initial location, which is better than others that use the random coordinates as the initial location. In addition, malicious neighbors were allocated a lower weight, so the location vibration is reduced during the localization process.

Impact of distance measure error for v = 2, dmax = 20 m, and pm = 30%.
Although the localization error is a greatly significant metric for the performance evaluation, it may also be impacted for the case where the methods do not converge to the actual location. We consider the localization accuracy from a different perspective and then examine the probability that the methods can correctly identify the actual location.
A higher Pcl indicates that the method can converge to the correct location with a high probability.
Considering the incorrect measurements and movable sensors, we compare the probability of correct localization in our algorithm with other algorithms.
As shown in Fig. 10, we compare these three algorithms under different distance measurement errors and different velocities. We also find that RLMRPA outperforms other techniques where the probability of correct localization plummets steadily as the measurement error and velocity increases, simultaneously. For instance, with the measurement error dmax = 25, our RLMRPA localizes correctly with a probability of 56.12% –88.3%, while for GD and GAME is 26.12% –81.45% and 50.64% –83.6%, respectively. In general, our RLMRPA method is more effective in improving the accuracy of localization and identifying the correct location.

The probability distribution of correct localization when the values of dmax and v were varied from 5 to 30 and 0.5 to 3.5 and pm was fixed to 30%. (a) RLMRPA. (b) GAME. (c) GD.
To understand the impact of the proportion of malicious neighbors and node velocity on the localization, we further examine the probability of correct localization.
Figure 11 shows how the probability of accurate localization is affected by the proportion of malicious neighbors and node velocity, simultaneously. It is obvious that the proposed RLMRPA outperforms other methods in the localization accuracy. Even with 50% malicious nodes are participating in attacks, the proposed RLMRPA approach was able to converge to the correct location estimate with the probability of 74.32% –42.99%, whereas GAME and GD had lower probability of 68.74% –30.79% and 64.38% –23.87%, respectively. This observation is also not surprising if the number of malicious nodes is no less than (M-2)/2, where M is the number of reference nodes providing information, then no algorithm can provide any degree of localization accuracy. From the above evaluation, it can be concluded that our RLMRPA method can achieve a much better performance both on localization accuracy and on localization correct probability with very delectable results.

The probability distribution of correct localization when the values of pm and v were varied from 10% to 49% and 0.5 to 3.5, and dmax was fixed to 30%. (a) RLMRPA. (b) GAME. (c) GD.
In this section, we discuss a necessary condition for exact localization with the presence of cheating neighbors. Even if the majority of the neighbors within the communication range of the localizing node are genius, it still does not ensure exact localization of the localizing node. So, in what follows, we derive the upper bound Ub, on the number of malicious neighbors out of M neighbors within the range of the localizing node that can be accepted by the localization procedure without undermining localization accuracy.

Failure localization even if majority of neighbors being trusted.
Whereas, the malicious neighbors ({N6, N7, N8}) collude in a smart way to have their boundary circles intersect at another point A where two trusted neighbors N2 and N5 also intersect. So, the number of neighbors that intersect at the correct location of the localizing node (point B) is 5 ({N1, N2, N3, N4, N5}) and the number of neighbors that intersect at the wrong location of the localizing node (point A) is 5 ({N2, N5, N6, N7, N8}). There are two candidate locations of the localizing node (points A and B), that is, majority of neighbors intersect at the two locations. It is impossible to uniquely localize the sensor under such a scenario. Thus, the existence of [M/2] + 1 (M = 8) trusted neighbors still does not guarantee the correct localization of a localizing node. Next, we shall indicate that the existence of at least [M/2] + 2 trusted neighbors guarantees the correct localization of the localizing node.
Let the localizing node be located at point l, which will also be the common point of intersection of boundary circles of all the trusted neighbors. For any other point l’ to be a potential candidate location for the localizing node, another set of [M/2] + 2 boundary circles would have to intersect at l’. From Corollary 1, the maximum number of trusted neighbors that can intersect at l’ is 2 (as they already intersect at l). Furthermore, if the rest [M/2] - 2 malicious neighbors collude, l’ can also be the point of intersection of those [M/2] - 2 malicious neighbors. So making the number of intersecting boundary circles at l’ to be [M/2] - 2 +2 = [M/2]. Any point (except l) in the network cannot have more than [M/2] neighbors intersecting at its location. Hence, the localizing node is exactly localized at the point l. Consequently, if we have a minimum of [M/2] + 2 trusted neighbors, then the localizing node can be localized at the correct location, where the boundary circles of those neighbors intersect.
Theorem 1 indicates that if there are M neighbors within the communication range of a localizing node in some time unit, the maximum number of malicious neighbors accepted by the localization procedure without undermining localization accuracy is then [M/2] - 2. We call this value the upper bound and denote it by U b . This condition can also be considered as a necessary condition for exact localization of the localizing node with the present of malicious neighbors.
Secure localization is necessitated by the untrusted environment in which most MWSNs operate. In this paper, we presented a robust positioning algorithm based on a relative location map. The location information of the neighbors is extracted to determine the target location without any beacon nodes. A 3FNTLA is proposed to avoid getting stuck on local optimum. In view of the “relative inconsistency” between the malicious measurements and the benign ones, we present an attack-resistance distance residue method, which can live with bad neighbors instead of eliminating all possible bad neighbors. The simple and easy to implement steepest descent algorithm, which fuses an initial position optimization algorithm and tolerance of bad location references, can effectively suppressing the influence of false location reference provided by malicious nodes in the networks and achieve a high localization accuracy in MWSNs. The upper bound on the number of malicious neighbors, whose existence does not undermine sensors location determination, is proved.
In future work, we plan to investigate the application of our scheme to three-dimensional (3D) sensor networks. We also plan to investigate the use of localization history to better identify malicious nodes.
Footnotes
Acknowledgments
The work was supported by the National High Technology Research and Development Program of China (Grant No. 2015AA016005), the National Natural Science Foundation of China (Grant No. 61402096), and China Postdoctoral Science Foundation (Grant No. 2016M591448).
