Evaluation of Detection Algorithms for MAC Layer Misbehavior: Theory and Experiments

Abstract

Abstract-We revisit the problem of detecting greedy behavior in the IEEE 802.11 MAC protocol by evaluating the performance of two previously proposed schemes: DOMINO and the Sequential Probability Ratio Test (SPRT). Our evaluation is carried out in four steps. We first derive a new analytical formulation of the SPRT that considers access to the wireless medium in discrete time slots. Then, we introduce an analytical model for DOMINO. As a third step, we evaluate the theoretical performance of SPRT and DOMINO with newly introduced metrics that take into account the repeated nature of the tests. This theoretical comparison provides two major insights into the problem: it confirms the optimality of SPRT, and motivates us to define yet another test: a nonparametric CUSUM statistic that shares the same intuition as DOMINO but gives better performance. We finalize the paper with experimental results, confirming the correctness of our theoretical analysis and validating the introduction of the new nonparametric CUSUM statistic.

Denial-of-Service Attacks in Wireless Networks Using Off-the-Shelf Hardware

“…3, jamming causes extended SINR drops. Based on this, we deploy a cumulative-sum (cusum) algorithm [14] able to detect abrupt changes of the SINR. In previous works [15,11,16,17] we show that maximum performance, in terms of false alarms/detection probability, is achieved when considering the maximum minus the minimum values of SINR within a short and long windows.…”

Design and performance evaluation of a lightweight wireless early warning intrusion detection prototype

“…Cardenas et al [5] consider the sequential probability ratio test. However, their work is about detecting MAClayer misbehaviours and not attacks.…”

“…Cusum belongs to the category of the Cusum algorithms, detecting changes of a certain distribution (change-point detection), and it has been widely used in the literature for anomaly-based intrusion detection (e.g. [5,11,[26][27][28]). In general, there are two types of Cusum algorithms: (i) parametric and (ii) non-parametric.…”

“…However, due to their open nature, wireless networks are susceptible to a number of attacks. Adversaries can exploit vulnerabilities in the medium access and physical layers and heavily disrupt the network operation (e.g., see [1][2][3][4][5]). The traditional methods of protecting the networks by using firewalls and encryption software are not sufficient, and for this reason, several intrusion detection algorithms have been proposed by the research community in order to address these issues.…”

Fast and Efficient Countermeasure for MAC Layer Misbehavior in MANETs

“…WLAN Access Point or a Wireless Mesh Router) that monitors the behavior of its neighbors during equal-length time intervals and then uses several mechanisms (e.g. simple tests [5] logic based tests [8] or statistical methods [6]) to analyze the collected information and detect any misbehavior. In the second category, the backoff algorithm is changed in most solutions in order to make the backoff value predictable or give the receiver node a control over it.…”