A framework for misuse detection in ad hoc networks- part II

Subhadrabandhu, D.; Sarkar, Saswati; Anjum, F.

doi:10.1109/jsac.2005.861388

Cited by 20 publications

(22 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We prove that the latter is NP-hard. We subsequently describe a polynomial-complexity distributed approximation algorithm, "Maximum Unsatisfied Neighbors in Extended Neighborhood" (MUNEN), which attains the best possible approximation guarantee for the optimal selection problem [21], [25].…”

Section: B Selection Of Ids Active Insidersmentioning

confidence: 99%

“…Thus, unless P = NP, the best possible approximation ratio for this selection problem is Ω(ln N ) (pp.112 − 116, [26]). In our earlier work [21], [25], we have proved that there exists a distributed computationally simple approximation algorithm MUNEN, that not only attains the above approximation ratio (O(ln N )) for the set-multicover problem, but also selects the same set of nodes as the best known centralized approximation algorithm. For completeness, we describe MUNEN here.…”

Section: Now the Detection Goal Of Attaining The Tolerable Expected mentioning

confidence: 99%

“…We have recently proposed a framework that attains the above goal in ad hoc networks [24], [25]. The framework however relies on the assumption that the sniffing nodes never generate "false positives", i.e., never conclude that there is an attack when there is none.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A Statistical Framework for Intrusion Detection in Ad Hoc Networks

Subhadrabandhu

Sarkar

Anjum³

2006

Proceedings IEEE INFOCOM 2006. 25TH IEEE International Conference on Computer Communications

Self Cite

View full text Add to dashboard Cite

We focus on detecting intrusions in ad hoc networks using the misuse detection technique. We allow for detection modules that periodically fail to detect attacks and also generate false positives. Combining theories of hypothesis testing and approximation algorithms, we develop a framework to counter different threats while minimizing the resource consumption. We obtain computationally simple optimal rules for aggregating and thereby minimizing the errors in the decisions of the nodes executing the intrusion detection software (IDS) modules. But, we show that the selection of the optimal set of nodes for executing the IDS is an NPhard problem. We describe a polynomial complexity, distributed selection algorithm, "Maximum Unsatisfied Neighbors in Extended Neighborhood" (MUNEN) that attains the best possible approximation ratio. The aggregation rules and MUNEN can be executed by mobile nodes with limited processing power. The overall framework provides a good balance between complexity and performance for attaining robust intrusion detection in ad hoc networks. This material is posted here with permission of the IEEE. Such permission of the IEEE does not in any way imply IEEE endorsement of any of the University of Pennsylvania's products or services. Internal or personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution must be obtained from the IEEE by writing to pubs-permissions@ieee.org. By choosing to view this document, you agree to all provisions of the copyright laws protecting it. Abstract-We focus on detecting intrusions in ad hoc networks using the misuse detection technique. We allow for detection modules that periodically fail to detect attacks and also generate false positives. Combining theories of hypothesis testing and approximation algorithms, we develop a framework to counter different threats while minimizing the resource consumption. We obtain computationally simple optimal rules for aggregating and thereby minimizing the errors in the decisions of the nodes executing the intrusion detection software (IDS) modules. But, we show that the selection of the optimal set of nodes for executing the IDS is an NP-hard problem. We describe a polynomial complexity, distributed selection algorithm, "Maximum Unsatisfied Neighbors in Extended Neighborhood" (MUNEN) that attains the best possible approximation ratio. The aggregation rules and MUNEN can be executed by mobile nodes with limited processing power. The overall framework provides a good balance between complexity and performance for attaining robust intrusion detection in ad hoc networks.

show abstract

Section: B Selection Of Ids Active Insidersmentioning

confidence: 99%

Section: Now the Detection Goal Of Attaining The Tolerable Expected mentioning

confidence: 99%

See 1 more Smart Citation

A Statistical Framework for Intrusion Detection in Ad Hoc Networks

Subhadrabandhu

Sarkar

Anjum³

2006

Proceedings IEEE INFOCOM 2006. 25TH IEEE International Conference on Computer Communications

Self Cite

View full text Add to dashboard Cite

show abstract

“…In the past, numerous research articles that addressed the problem of network intrusion modeling have appeared in the literature [8][9][10][11][12][13][14][15][16][17][18][19]. Kephart and White [8,9] published the first analytical work on the modeling of the propagation of viruses and worms.…”

Section: Introductionmentioning

confidence: 99%

Intrusion detection model based on selective packet sampling

Bakhoum

2011

EURASIP J. on Info. Security

View full text Add to dashboard Cite

Recent experimental work by Androulidakis and Papavassiliou (IET Commun 2(3):399, 2008; IEEE Netw 23(1):6, 2009) has shown that it is possible to maintain a high level of network security while selectively inspecting packets for the existence of intrusive activity, thereby resulting in a minimal amount of processing overhead. In this paper, a statistical approach for the modeling of network intrusions as Markov processes is introduced. The theoretical findings presented here confirm the earlier experimental results of Androulidakis and Papavassiliou. A common notion about network intrusion detection systems is that every packet arriving into a network must be inspected in order to prevent intrusions. This investigation, together with the earlier experimental results, disproves that notion. Additional experimental testing of a corporate local area network is reported.

show abstract

“…In [4] and [5] the authors propose a framework for misuse detection which divides the nodes in a network into two categories: insiders and outsiders. Insiders are always well-behaved nodes in charge of performing network tasks.…”

Section: Related Workmentioning

confidence: 99%

Detection of Packet Forwarding Misbehavior in Mobile Ad-Hoc Networks

Gonzalez

Howarth

Pavlou

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Mobile Ad Hoc networks (MANETs) are susceptible to having their effective operation compromised by a variety of security attacks. Nodes may misbehave either because they are malicious and deliberately wish to disrupt the network, or because they are selfish and wish to conserve their own limited resources such as power, or for other reasons. In this paper, we present a mechanism that enables the detection of nodes that exhibit packet forwarding misbehavior. We present evaluation results that demonstrate the operation of our algorithm in mobile ad hoc environments and show that it effectively detects nodes that drop a significant fraction of packets.

show abstract

A framework for misuse detection in ad hoc networks- part II

Cited by 20 publications

References 3 publications

A Statistical Framework for Intrusion Detection in Ad Hoc Networks

A Statistical Framework for Intrusion Detection in Ad Hoc Networks

Intrusion detection model based on selective packet sampling

Detection of Packet Forwarding Misbehavior in Mobile Ad-Hoc Networks

Contact Info

Product

Resources

About