SWAT: small world-based attacker traceback in ad-hoc networks

Abstract

Mobile Ad hoc NETworks (MANETs) provide a lot of promise for many practical applications. However, MANETs are vulnerable to a number of attacks due to its autonomous nature. DoS/DDoS attacker traceback is especially challenging in MANETs for the lack of infrastructure. In this paper, we propose an efficient on-the-fly search technique, SWAT, to trace back DoS and DDoS attackers in MANETs. Our scheme borrows from small worlds, utilizes the concept of Contacts, and use Traffic Pattern Matching (TPM) and Traffic Volume Matching (TVM) techniques. We also propose multi-directional search, in-network processing and query suppression to reduce communication overhead in energyconstrained MANETs and increase traceback robustness against spoofing and collusion. Simulation results show that SWAT successfully traces back DoS and DDoS attacker under reasonable background traffic. In addition, SWAT incurs low communication overhead (22% compared to flooding-based search). IntroductionFlooding-type/direct DoS [1][2][3][4] and DDoS [8] attacks consume the resources of a remote host or network, thereby denying or degrading service to legitimate users. There are several characteristics of such attacks: (I) Traffic volume abnormally increases during the attack period. (II) Attackers routinely disguise their location using incorrect/spoofed addresses. (III) It is reported that such attacks may persist for tens of minutes and in some case for several days [1].IP traceback in the Internet, which tracks down attacker(s), is a useful technique for forensics and to discourage attackers. There are several IP traceback schemes proposed for the Internet such as packet marking [14], logging [11], ICMP traceback [6,13], and others [5]. Such traceback schemes developed for the fixed networks are not directly applicable to MANETs due to the following reasons.In MANETs, there is no fixed infrastructure. Each node acts as an autonomous terminal, acting as both host and router. Node mobility frequently changes network topology.In general, network bandwidth and battery power are limited.To perform efficient DoS/DDoS attacker traceback under such a harsh environment in MANETs, we propose an efficient on-the-fly taceback technique. For that, we leverage the small world model. The concept of small worlds was studied in the 60's in the context of social networks [12], during which experiments of mail delivery using acquaintances resulted in an average of 'six degrees of separation', i.e., on average a letter needed six acquaintances to be delivered. Recent research by Watts [16] has shown that in relational graphs adding a few number of random links to regular graphs results in graphs with low average path length and high clustering. Such graphs are called small world graphs. Helmy [9][10] established the applicability of small world graphs to MANETs. Helmy found that path length of wireless networks is drastically reduced by adding a few random links (resembling a small world). Establishing a small world reduces the degrees of separation be...

A Coding-Based Incremental Traceback Scheme against DDoS Attacks in MANET

“…Based on ICMP technique, besides iTrace-CP method proposed by Vrizlynn, Kim studied out a scheme researching on flow characteristic. Hotspot-based Traceback [15], CAPTRA [16], the scheme proposed by Kim et al [17] and SWAT [18] are logging-based traceback schemes for wireless network. The above-mentioned schemes [15][16][17][18] mainly inherit from the Hash-based approach.…”

AK-PPM: An Authenticated Packet Attribution Scheme for Mobile Ad Hoc Networks

“…Zarai et al [31] and Kim et al [32] proposed clusterbased traceback schemes only for MANETs with trusted nodes. Kim and Helmy [14] proposed a traceback scheme in MANETs, named SW AT . Their scheme utilizes the small world model and sends the attack traffic signature to neighbor nodes of a victim which observe similar attack traffic.…”

“…Moreover, because both the scale of a MANET and its data traffic rate are much smaller than that of the high-speed Internet, traceback in MANETs must be more efficient. So far, very little research has been done on traceback in MANETs [12][13][14].…”

A Design of TNA(Traceback against Network Attacks) Based on Multihop Clustering using the depth of Tree structure on Ad-hoc Networks

“…애드혹 네트워크와 IP네트워크는 동일한 보안 위협을 가지 고 있으며 DOS나 DDOS 공격이 증가하고 있지만 제한적인 자원 등의 문제로 기존의 역추적 메커니 즘을 적용할 수가 없다 [3] . 현재 MANET을 위한 역 추적 메커니즘에 대한 연구는 클러스터링 기법을 적용한 역추적 메커니즘은 다른 구조들에 비해 최 대 29%의 CPU 사용률을 줄일 수 있기 때문에 클 러스터링 기법을 이용한 역추적 메커니즘 방향으로 연구가 진행되고 있다 [4][5][6][7] . 하지만 다중 홉 기반의 …”