An Analytic Framework for Modeling and Detecting Access Layer Misbehavior in Wireless Networks

Abstract

The widespread deployment of wireless networks and hot spots that employ the IEEE 802.11 technology has forced network designers to put emphasis on the importance of ensuring efficient and fair use of network resources. In this work we propose a novel framework for detection of intelligent adaptive adversaries in the IEEE 802.11 MAC by addressing the problem of detection of the worst-case scenario attacks. Utilizing the nature of this protocol we employ sequential detection methods for detecting greedy behavior and illustrate their performance for detection of least favorable attacks. By using robust statistics in our problem formulation, we attempt to utilize the precision given by parametric tests, while avoiding the specification of the adversarial distribution. This approach establishes the lowest performance bound of a given Intrusion Detection System (IDS) in terms of detection delay and is applicable in online detection systems where users who pay for their services want to obtain the information about the best and the worst case scenarios and performance bounds of the system. This framework is meaningful for studying misbehavior due to the fact that it does not focus on specific adversarial strategies and therefore is applicable to a wide class of adversarial strategies.

Real-Time Misbehavior Detection in IEEE 802.11-Based Wireless Networks: An Analytical Approach

“…The sequential probability ratio test (SPRT) method is used in [5], [6], [7] to detect the 802.11 backoff misbehavior. The detection decision is made when a random walk of the likelihood ratio of observations (given two hypotheses) rises to be larger than an upper threshold.…”

“…For the second, the misbehavior needs to be detected in real time and we can then isolate the malicious node to prevent it from bringing more harm to the network as soon as possible. The existing solutions either can not address both issues at the same time [4], [5], [6], [7], or require modifications to the 802.11 protocols [8], [9].…”

Evaluation of Detection Algorithms for MAC Layer Misbehavior: Theory and Experiments

“…The robust SPRT [15], [16] addresses the detection of an adaptive intelligent attacker by casting the problem of misbehavior detection within the min-max robust detection framework. The key idea is to optimize the performance of the detection algorithm for the worst-case attacker strategy.…”

“…Theorem 3: For every and every (19) We omit the proof of this result; the details can be found in [15].…”

“…In this work we derive new analytical bounds for the performance of two previously proposed protocols for detecting random access misbehavior in IEEE 802.11 networks-DOMINO [18], [17] and robust SPRT tests [16], [15]-and show the optimality of SPRT against a worst-case adversary for all configurations of DOMINO. Following the main intuitive idea of DOMINO, we also introduce a nonparametric CUSUM statistic that shares the same basic concepts of DOMINO but gives better performance.…”