Abstract

1Intrusion detection in MANETs is challenging because these networks change their topologies dynamically; lack concentration points where aggregated traffic can be analyzed; utilize infrastructure protocols that are susceptible to manipulation; and rely on noisy, intermittent wireless communications. We present a cooperative, distributed intrusion detection architecture that addresses these challenges while facilitating accurate detection of MANET-specific and conventional attacks. The architecture is organized as a dynamic hierarchy in which detection data is acquired at the leaves and is incrementally aggregated, reduced, and analyzed as it flows upward toward the root. Security management directives flow downward from nodes at the top.To maintain communications efficiency, the hierarchy is automatically reconfigured as needed using clustering techniques in which clusterheads are selected based on topology and other criteria. The utility of the architecture is illustrated via multiple attack scenarios.Proceedings of the Third IEEE International Workshop on Information Assurance (IWIA'05) 0-7695-2317-X/05 $20.00 © 2005 IEEE Network nodes in the problem domain of interest encompass a heterogeneous mixture of manned and unmanned mobile systems including autonomous vehicles and sensors. Platform types include PDAs, processors embedded in special purpose devices, laptopclass systems, and server-class systems, which may be positioned in various kinds of vehicles.A network in this problem domain can be characterized as a collection of interconnected islands, each containing up to a few hundred mobile nodes and corresponding to a single routing domain. Relationships between these islands may be organized in a way that roughly parallels the hierarchical structure of the human organizations that deploy them. Mobile nodes will communicate with their neighbors over radios, with data rates from tens of kilobits per second to a few megabits per second. Internet-based protocols play a role by binding together the disparate wireless link layers and physical layers in the network, and providing "reachback" capability to the Internet. All nodes will be IPaddressable, with the IP addressing hierarchy closely coupled with the domain hierarchy. Specific nodes in each domain may be connected to nodes in other domains with higher-data-rate links of a few Mbps. All links are dynamic since nodes may rapidly establish or lose connectivity with their neighbors. Key operational and technical challengesKey operational and technical challenges of this problem domain include the following: Proceedings of the Third IEEE International Workshop on Information Assurance (IWIA'05) 0-7695-2317-X/05 $20.00 © 2005 IEEE Proceedings of the Third IEEE International Workshop on Information Assurance (IWIA'05) 0-7695-2317-X/05 $20.00

No abstract

No abstract

The nature of the threats posed by Distributed Denial of Service (DDoS) attacks on large networks, such as the Internet, demands effective detection and response methods. These methods must be deployed not only at the edge but also at the core of the network. The DDoS Tolerant Networks technology incorporates methods to detect, characterize, and respond to DDoS attacks by computing entropy and frequency-sorted distributions of selected packet attributes. Preliminary results indicate that these methods can be effective against current attacks and suggest directions for improving detection of more stealthy attacks.