A Cross-Layer, Anomaly-Based IDS for WSN and MANET

Abstract

Intrusion detection system (IDS) design for mobile adhoc networks (MANET) is a crucial component for maintaining the integrity of the network. The need for rapid deployment of IDS capability with minimal data availability for training and testing is an important requirement of such systems, especially for MANETs deployed in highly dynamic scenarios, such as battlefields. This work proposes a two-level detection scheme for detecting malicious nodes in MANETs. The first level deploys dedicated sniffers working in promiscuous mode. Each sniffer utilizes a decision-tree-based classifier that generates quantities which we refer to as correctly classified instances (CCIs) every reporting time. In the second level, the CCIs are sent to an algorithmically run supernode that calculates quantities, which we refer to as the accumulated measure of fluctuation (AMoF) of the received CCIs for each node under test (NUT). A key concept that is used in this work is that the variability of the smaller size population which represents the number of malicious nodes in the network is greater than the variance of the larger size population which represents the number of normal nodes in the network. A linear regression process is then performed in parallel with the calculation of the AMoF for fitting purposes and to set a proper threshold based on the slope of the fitted lines. As a result, the malicious nodes are efficiently and effectively separated from the normal nodes. The proposed scheme is tested for various node velocities and power levels and shows promising detection performance even at low-power levels. The results presented also apply to wireless sensor networks (WSN) and represent a novel IDS scheme for such networks.

A Machine Learning Based Intrusion Detection System for Mobile Internet of Things

“…Both scenarios are tested under blackhole (BH) and flooding (FL) attacks with both mobility models RWP, GM. Reporting time (Tr) is 25 s and sampling time (Ts) is 5 s. The detection parameters are true positive rate (TPR) also called recall, true negative rate (TNR), false positive rate (FPR), and false negative rate (FNR), precision, and F 1 score are shown in Equations (3)- (8). A detailed explanation for the detection performance using these equations and Algorithm 1, will be presented in the discussion section.…”

“…(3) An example showing how the results were obtained based on Equations (3)- (8) and Algorithm 1 is shown below. Every fitted slope point has a lower bound (LB) and upper bound (UB), malicious nodes reside in the region below the threshold whereas the benign nodes reside in the region above the threshold.…”

“…However, a study presented by [7] shows several advantages for using random forest when it comes to the complexity, accuracy, and memory usage. The rationale for Sensors 2020, 20, 461 2 of 15 using random forest as a core algorithm in our previous cross layer-based IDS is its suitability for the resource restrictions inherent in the afore mentioned networks [8].…”

“…In this paper, we expand the previous work [8,15] and test the proposed architecture under a wide range of malicious activities such as blackhole and DDoS (flooding attack) and under other scenarios, such as mobility models. The proposed scheme is tested under two different mobility models; random way point (RWP) and Gauss Markov models (GM).…”

SLGBM: An Intrusion Detection Mechanism for Wireless Sensor Networks in Smart Environments

“…Amouri et al [18] proposed a two-level detection scheme for detecting malicious nodes in MANET. The first stage deploys a dedicated sniffer that works in promiscuous mode.…”