compromised sensor nodes. The framework provides an appropriate abstraction of applicationspecific detection mechanisms and models the unique properties of sensor networks. Based on the framework, we develop alert reasoning algorithms to identify compromised nodes. The algorithm assumes that compromised nodes may collude at will. We show that our algorithm is optimal in the sense that it identifies the largest number of compromised nodes without introducing false positives. We evaluate the effectiveness of the designed algorithm through comprehensive experiments. Categories and Subject Descriptors: C.2.0 [Computer-Communication Networks]: General-Security and protection; K.6.5 [Management of Computing and Information Systems]: Security and Protection General Terms: Algorithms, Security Additional Key Words and Phrases: Sensor networks, intrusion detection ACM Reference Format: Zhang, Q., Yu, T., and Ning, P. 2008. A framework for identifying compromised nodes in wireless sensor network...