Efficacy of misuse detection in adhoc networks

Abstract

We consider adhoc networks with multiple, mobile colluding intruders. We investigate the placement of the intrusion detection modules for misuse intrusion detection. Our goal is to maximize the detection performance subject to limitation in the computational resources. We mathematically formulate different detection objectives, and show that computing the optimal solution is NP-hard in each case. Thereafter, we propose a family of algorithms that approximate the optimal solution, and prove that some of these algorithms have guaranteeable approximation ratios. The algorithms that have analytically guaranteeable performance require re-computation every time the topology changes due to mobility. We next modify the computation strategy so as to seamlessly adapt to topological changes due to mobility. Using simulation we evaluate these algorithms, and identify the appropriate algorithms for different detection performance and resource consumption tradeoffs. (SECON 2004), pages 97-107. Publisher URL: http://ieeexplore.ieee.org/xpl/tocresult.jsp?isNumber=30129&page=1 Comments Copyright 2004 IEEE. Reprinted from Proceedings of the 2004 First Annual IEEE Communications Society Conference on Sensor and Ad Hoc Communications and NetworksThis material is posted here with permission of the IEEE. Such permission of the IEEE does not in any way imply IEEE endorsement of any of the University of Pennsylvania's products or services. Internal or personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution must be obtained from the IEEE by writing to pubs-permissions@ieee.org. By choosing to view this document, you agree to all provisions of the copyright laws protecting it. Abstract-We consider adhoc networks with multiple, mobile colluding intruders. We investigate the placement of the intrusion detection modules for misuse intrusion detection. Our goal is to maximize the detection performance subject to limitation in the computational resources. We mathematically formulate different detection objectives, and show that computing the optimal solution is NP-hard in each case. Thereafter, we propose a family of algorithms that approximate the optimal solution, and prove that some of these algorithms have guaranteeable approximation ratios. The algorithms that have analytically guaranteeable performance require re-computation every time the topology changes due to mobility. We next modify the computation strategy so as to seamlessly adapt to topological changes due to mobility. Using simulation we evaluate these algorithms, and identify the appropriate algorithms for different detection performance and resource consumption tradeoffs.

A Statistical Framework for Intrusion Detection in Ad Hoc Networks

“…Refer to figure 1 for an example detection procedure. Now, all packets, except those that are directly transmitted from an intruder to its target (which usually constitutes a small fraction of the total number of packets [22] Due to the coverage redundancy several insiders may analyze a packet, and they may decide differently whether the packet is bad. The different decisions must be combined to determine whether the packet is indeed bad.…”

RIDA: Robust Intrusion Detection in Ad Hoc Networks

“…In this case, every packet transmitted by an insider would be analyzed at least once and every insider detects whether a packet is bad without any error. Only the packets transmitted directly from an intruder to its target may not be analyzed, but the percentage of such packets is small [9]. This suggests that when insiders may decide erroneously, the IDS active insiders must be selected so that every insider is a neighbor of at least k IDS active insiders where k > 1.…”

“…Therefore, a prerequisite for deploying misuse detection in ad hoc networks is to determine which nodes should execute the sniffing and analysis software modules which we refer to as the intrusion detection software (IDS) modules. Previous works have considered this problem assuming that the insider nodes that analyze the traffic detect malicious packets without any failure [8], [9], [10]. But some insiders periodically stop functioning because of operational failure and low residual energy and would not detect attacks during those intervals.…”

Security evaluation over lightweight cryptographic protocols

“…In this way, many researchers have been tried to propose appropriate solutions to make such environments more reliable than ever before. From the security viewpoint, a subset of mentioned solutions have been tried to prevent the considered environment from some categories of external attacks [1][2][3], while some others tried to detect possible threats and proposed some solutions to resist against [4][5][6]. If roughly speaking, it is possible to claim that the level of proposed secure protocols can be emphasizing on cryptographic protocols or as a higher level they can use other cryptographic functions as a building block to make the considered protocol.…”