Efficient Intrusion Detection in Ad-Hoc Networks

Abstract

We study efficient and lightweight Intrusion Detection Systems (IDS) for ad-hoc networks via the prism of IPv6-enabled Wireless Sensor Actuator Networks. These networks consist of highly constrained devices able to communicate wirelessly in an ad-hoc fashion, thus following mesh networks. Current state-of-the-art (IDS) have been developed taking into consideration regular computer networks, and as such they do not efficiently addresses the paradigm of ad-hoc networks. In this work we firstly identify a trade-off between the communication and energy overheads of an IDS (as captured by the number of active IDS agents in the network) and the performance of the system in terms of successfully identifying attacks. In order to fine tune this trade-off, we model such networks as Random Geometric Graphs; a rigorous approach that allows us to capture underlying structural properties of the network. We then introduce a novel IDS architectural approach by having only a subset of the nodes acting as IDS agents. These nodes are able to efficiently detect attacks at the networking layer in a collaborative manner by monitoring locally available network information provided by IoT routing protocols such as RPL. Our detailed experimental evaluation demonstrates significant performance gains in terms of communication overhead and energy dissipation while maintaining high detection rates. We also show that the performance of our IDS in ad-hoc networks does not rely on the size of the network but on fundamental underling network properties, such as the network topology and the average degree of the nodes.

An Architecture for Resilient Intrusion Detection in IoT Networks

“…Figures 3 and 4 show that the energy consumption and the communication overhead introduced to the network by the IDS is proportional to the number of nodes operating as IDS agents. This shows that our approach achieved lower communication overhead and energy consumption rate compered to random placement [18] based on connectivity threshold where a constant number of nodes performing the IDS agent. Moreover, figures 2 and 3 show that our approach achieved high detection rate with lower energy consumption which reveals that minimal number of nodes were allowed to run the IDS agent.…”

“…Figure 2 shows that in all network densities the average of detection rate where the subset of the node population operates as an IDS agent selected by our approach that uses cover set (greedy algorithm) remains high, around 80%. Also, the detection rate in random placement of distributed IDS agents based on connectivity threshold [18] remains as high as 85%. However, in very rare cases areas of the network remain unmonitored because of the random placement of IDS agents.…”

An architecture for resilient intrusion detection in ad-hoc networks

“…We consider that the random uniform placement of the sensors inside the network area is abstracted by RGG as we had used in [1]. RGG is formed by n vertices that are placed uniformly at random in the [ 0, 1] 2 square.…”

A Reliable Real-Time Slow DoS Detection Framework for Resource-Constrained IoT Networks

“…Various IoT intrusion detection systems (IDS) have been proposed to detect DoS and DDoS attacks [6], with most identifying high incoming traffic volume as characteristic of malicious activity. This has led to several, open-source IDS datasets [7] being created, however these contain huge amounts of post-event network data, with the corollary being that the resulting high storage and processing requirements restrict their usage to only offline analysis.…”