A Provenance-Driven Trust Framework with Physics-Consistent Validation for Secure Wireless Sensor Networks.

Wireless sensor networks (WSNs) play a critical role in cyber-physical applications such as industrial monitoring, environmental sensing, and critical infrastructure management. In these environments, security mechanisms must not only detect malicious activities but also explain how compromised measurements propagate through sensing, aggregation, and decision processes while operating under stringent resource constraints. Existing approaches typically address intrusion detection, trust management, provenance analysis, or blockchain-based integrity independently, providing limited support for integrated and explainable security. This paper presents PhyProvTrust-WSN, a physics-aware framework that combines physics-consistency validation, dynamic provenance graphs, evidence-based trust propagation, multi-factor risk fusion, and selective evidence anchoring to improve the transparency and auditability of secure sensor data aggregation. The framework models sensing, forwarding, aggregation, validation, and response events as a bounded provenance directed acyclic graph (DAG), enabling causal tracing of suspicious activities while maintaining low memory and communication overhead. A weighted risk fusion mechanism integrates anomaly evidence, domain-consistency assessment, trust evolution, and inherited provenance risk to support explainable security decisions. Rather than continuously recording all events, only high-risk or decision-relevant evidence hashes are anchored to a permissioned audit layer, reducing storage and communication costs. To avoid overclaiming, the proposed framework is evaluated using a hybrid methodology that combines attack-labeled WSN datasets, real sensor measurements for physics-consistency validation, and simulation-based overhead analysis. The results demonstrate that the integrated framework provides strong detection capability while improving explainability, supporting root-cause analysis, and maintaining bounded communication and storage overhead suitable for resource-constrained WSN deployments.