1Intrusion detection in MANETs is challenging because these networks change their topologies dynamically; lack concentration points where aggregated traffic can be analyzed; utilize infrastructure protocols that are susceptible to manipulation; and rely on noisy, intermittent wireless communications. We present a cooperative, distributed intrusion detection architecture that addresses these challenges while facilitating accurate detection of MANET-specific and conventional attacks. The architecture is organized as a dynamic hierarchy in which detection data is acquired at the leaves and is incrementally aggregated, reduced, and analyzed as it flows upward toward the root. Security management directives flow downward from nodes at the top.To maintain communications efficiency, the hierarchy is automatically reconfigured as needed using clustering techniques in which clusterheads are selected based on topology and other criteria. The utility of the architecture is illustrated via multiple attack scenarios.Proceedings of the Third IEEE International Workshop on Information Assurance (IWIA'05) 0-7695-2317-X/05 $20.00 © 2005 IEEE Network nodes in the problem domain of interest encompass a heterogeneous mixture of manned and unmanned mobile systems including autonomous vehicles and sensors. Platform types include PDAs, processors embedded in special purpose devices, laptopclass systems, and server-class systems, which may be positioned in various kinds of vehicles.A network in this problem domain can be characterized as a collection of interconnected islands, each containing up to a few hundred mobile nodes and corresponding to a single routing domain. Relationships between these islands may be organized in a way that roughly parallels the hierarchical structure of the human organizations that deploy them. Mobile nodes will communicate with their neighbors over radios, with data rates from tens of kilobits per second to a few megabits per second. Internet-based protocols play a role by binding together the disparate wireless link layers and physical layers in the network, and providing "reachback" capability to the Internet. All nodes will be IPaddressable, with the IP addressing hierarchy closely coupled with the domain hierarchy. Specific nodes in each domain may be connected to nodes in other domains with higher-data-rate links of a few Mbps. All links are dynamic since nodes may rapidly establish or lose connectivity with their neighbors. Key operational and technical challengesKey operational and technical challenges of this problem domain include the following: Proceedings of the Third IEEE International Workshop on Information Assurance (IWIA'05) 0-7695-2317-X/05 $20.00 © 2005 IEEE Proceedings of the Third IEEE International Workshop on Information Assurance (IWIA'05) 0-7695-2317-X/05 $20.00

No abstract

The use of IPSec for securing communication between nodes of wireless and mobile ad hoc networks has traditionally been considered difficult. We describe an IPSec-based architecture and implementation for ad hoc networks that can seamlessly handle node mobility and IP address change. The approach can be used for securing application traffic as well as configuration and mobility management protocol traffic. A certificate-based approach that aids dynamic key generation and distribution is used for creating security associations between nodes. Simple and backward compatible extensions to the IPSec and PKIX protocols that do not violate existing and proposed standards are described, and an existing implementation is discussed. Initial experimental evaluation reveals that the perpacket latency overhead at the end-host for using our proposed mechanisms is tolerable.

No abstract

We present a novel architecture for providing a reliable multicast transport service over existing protocol stacks. These protocol stacks ordinarily support reliable unicast transport layer connections over a network layer which is capable of providing an unreliable multicasting service. We propose the addition of a new Single Connection Emulation (SCE) sublayer between the unicast transport layer and the multicast network layer This added layer mimics the single destination network layer interface to the transport layer and interfaces with the multicast network layer to provide the necessary multicastfinctionality. The new architecture also enables interactions between applications and the SCE, thus allowing the applications to control the semantics of the reliable multicast connection. We discuss the design issues that need to be considered when such a sublayer is to be introduced.We also discuss an implementation of this new approach using the TCP/IP protocol stack.and present some preliminary experimental results.