A framework for misuse detection in ad hoc Networks-part I

Abstract

We consider ad hoc networks with multiple, mobile intruders. We investigate the placement of the intrusion detection modules for misuse-based detection strategy. Our goal is to maximize the detection rate subject to limited availability of communication and computational resources. We mathematically formulate this problem, and show that computing the optimal solution is NP-hard. Thereafter, we propose two approximation algorithms that approximate the optimal solution within a constant factor, and prove that they attain the best possible approximation ratios. The approximation algorithms though require recomputation every time the topology changes. Thereafter, we modify these algorithms to adapt seamlessly to topological changes. We obtain analytical expressions to quantify the resource consumption versus detection rate tradeoffs for different algorithms. Using analysis and simulation, we evaluate these algorithms, and identify the appropriate algorithms for different detection rate and resource consumption tradeoffs.Abstract-We consider ad hoc networks with multiple, mobile intruders. We investigate the placement of the intrusion detection modules for misuse-based detection strategy. Our goal is to maximize the detection rate subject to limited availability of communication and computational resources. We mathematically formulate this problem, and show that computing the optimal solution is NP-hard. Thereafter, we propose two approximation algorithms that approximate the optimal solution within a constant factor, and prove that they attain the best possible approximation ratios. The approximation algorithms though require recomputation every time the topology changes. Thereafter, we modify these algorithms to adapt seamlessly to topological changes. We obtain analytical expressions to quantify the resource consumption versus detection rate tradeoffs for different algorithms. Using analysis and simulation, we evaluate these algorithms, and identify the appropriate algorithms for different detection rate and resource consumption tradeoffs.

Energy Efficient Monitoring for Intrusion Detection in Battery-Powered Wireless Mesh Networks

“…Our novel approach for monitoring node selection is to consider monitoring "wireless links" and not monitoring "nodes" as existing solutions propose [9,10]. Our approach helps detecting attacks that affect functionality of communication link, e.g., Black hole attack.…”

“…The monitoring node selection as an optimization problem has received some attention [9,10,12], where the first two papers optimize the channel assignment in monitoring nodes equipped with multi-channel radios, while the latter only addresse the coverage problem of distributed monitoring selection algorithms. While the authors use existing mesh routers for monitoring purposes, another set of related work (e.g., [9,13]) considers deploying additional monitoring nodes.…”

“…As proposed in the literature, in wireless networks, some nodes can be selected as "monitoring" nodes. They cooperatively perform intrusion detection functions [9,10]. It is obvious that duty-cycling mesh nodes are not suitable to be monitor nodes, since they are not awake all the time.…”

A Flow Monitoring based Distributed Defense Technique for Reduction of Quality Attacks in MANET

“…• Transmission security is based on digital signature method [12] in which each node uses private key to sign the blacklist.…”

RAPID: Traffic-agnostic intrusion detection for resource-constrained wireless mesh networks

“…Monitoring node solutions [8][9][10] select a subset of nodes (called monitoring nodes), assign each selected node the same set of IDS functions for monitoring a distinct part of network (i.e., either communication links [10] or WMN nodes [9]). These solutions, however, suffer from high false negative rates because some IDS functions cannot be activated on monitoring nodes due to limited resources (e.g., memory and processing power).…”