A framework for MAC protocol misbehavior detection in wireless networks

Abstract

The pervasiveness of wireless devices and the architectural organization of wireless networks in distributed communities, where no notion of trust can be assumed, are the main reasons for the growing interest in the issue of compliance to protocol rules. Reliable and timely detection of deviation from legitimate protocol operation is recognized as a prerequisite for ensuring efficient and fair use of network resources and minimizing performance losses. Nevertheless, the random nature of protocol operation together with the inherent difficulty of monitoring in the open and highly volatile wireless medium poses significant challenges. In this paper, we consider the fundamental problem of detection of node misbehavior at the MAC layer. Starting from a model where the behavior of a node is observable, we cast the problem within a minimax robust detection framework, with the objective to provide a detection rule of optimum performance for the worst-case attack. The performance is measured in terms of required number of observations in order to derive a decision. This framework is meaningful for studying misbehavior because it captures the presence of uncertainty of attacks and concentrates on the attacks that are most significant in terms of incurred performance losses. It also refers to the case of an intelligent attacker that can adapt its policy to avoid being detected. Although the basic model does not include interference, we show that our ideas can be extended to the case where observations are hindered by interference due to concurrent transmissions. We also present some hints for the problem of notifying the rest of the network about a misbehavior event. Our work provides interesting insights and performance bounds and serves as a prelude to a future study that would capture more composite instances of the problem.

Identifying and Averting the MAC Layer Misbehavior in AD-HOC Networks

“…It does not modify the protocol installed at the Access Point. In [3], the authors provide a detection rule for optimum performance worst-case attack. Their aim is to provide a solution with the help of mini max robust detection framework.…”

A Study Paper on Detecting Spam Zombies

“…Problem formulation deals with training the machine in the network based on unsupervised machine learning to plot the different cluster among the email is zombie spam or not, here the sequential probability testing plays a vital role in classifying the test data in to zombie spam or not and then training the system to clearly identify the zombie spam [6]. Here we have a trained set of data and the emails which were successfully classified by spot using the sequential probability testing In this section we formulate the spam zombie detection problem in a network.…”

Impact of Contention Window Cheating on Single-Hop IEEE 802.11e MANETs

“…Several works in the field were written by Baras et al: [1], [2], and [11]. In [2], an algorithm (named ERA-802.11) for ensuring randomness in ad-hoc networks is proposed.…”

“…It is also necessary to determine when to stop the observation and make a decision. This problem is discussed in [11]. The authors take into account an adaptive attacker and prove that a particular decision rule, the sequential probability ratio test (SPRT), is the optimal approach to minimizing the number of needed observations.…”