Intrusion and anomaly detection model exchange for mobile ad-hoc networks

Abstract

Mobile Ad-hoc NETworks (MANETs) pose unique security requirements and challenges due to their reliance on open, peer-to-peer models that often don't require authentication between nodes. Additionally, the limited processing power and battery life of the devices used in a MANET also prevent the adoption of heavy-duty cryptographic techniques. While traditional misuse-based Intrusion Detection Systems (IDSes) may work in a MANET, watching for packet dropouts or unknown outsiders is difficult as both occur frequently in both malicious and non-malicious traffic. Anomaly detection approaches hold out more promise, as they utilize learning techniques to adapt to the wireless environment and flag malicious data. The anomaly detection model can also create device behavior profiles, which peers can utilize to help determine its trustworthiness. However, computing the anomaly model itself is a time-consuming and processor-heavy task. To avoid this, we propose the use of model exchange as a device moves between different networks as a means to minimize computation and traffic utilization. Any node should be able to obtain peers' model(s) and evaluate it against its own model of "normal" behavior. We present this model, discuss scenarios in which it may be used, and provide preliminary results and a framework for future implementation.

A Survey of MANET Intrusion Detection & Prevention Approaches for Network Layer Attacks

“…In [63] Cretu et al proposed an anomaly detection approach for MANETs in which they model device behaviour, which peers can then use to determine the trustworthiness of other nodes. They examine their approach through an anomalous payload detector: the training phase observes payloads and then aggregates them from different nodes to build profiles which are compared by forming a similarity matrix.…”

Protection of MANETs from a range of attacks using an intrusion detection and prevention system

“…In [8] Hijazi and Nasser studied and analysed the feasibility of mobile agents in MANETs and they concluded that many mobile agents' features are the exact requirement for MANET IDS. In [9] Cretu et al proposed an anomaly detection approach for MANETs in which it models device behavior that peers can use to determine trustworthiness of other nodes. Jiang and Wang [10] proposed an anomaly detection algorithm based on Markov chains for wireless ad hoc networks.…”

Securing the data path of next-generation router systems

“…The use of model comparison to perform anomaly and intrusion detection has been used in selected networking domains (e.g., mobile ad-hoc networks [35]). In our case, the problem is simpler since our model is derived from a protocol description or the actual binary of the protocol implementation.…”