A Ferry-based Intrusion Detection Scheme for Sparsely Connected Ad Hoc Networks

Abstract

Several intrusion detection approaches have been proposed for mobile adhoc networks. Many of the approaches assume that there are sufficient neighbors to help monitor the transmissions and receptions of data packets by other nodes to detect abnormality. However, in a sparsely connected adhoc network, nodes usually have very small number of neighbors. In addition, new history based routing schemes e.g. Prophet have been proposed because traditional adhoc routing schemes do not work well in sparse ad hoc networks. In this paper, we propose a ferry-based intrusion detection and mitigation (FBIDM) scheme for sparsely connected ad hoc networks that use Prophet as their routing scheme. Via simulations, we study the effectiveness of the FBIDM scheme when malicious nodes launch selective data dropping attacks. Our results with different mobility models, ferry speed, traffic load scenarios indicate that the FBIDM scheme is promising in reducing the impact of such malicious attacks.

Anomaly Detection and Mitigation for Disaster Area Networks

“…Among the few works that address intrusion detection in IC-MANET, there is work by Chuah et al [13] proposing a rule-based misuse detection mechanism targeted towards delay-tolerant networks. It builds on a history-based routing protocol, detects attacker nodes, and mitigates their effects by keeping them on a black list, i.e.…”

“…In most cases these metrics reflect the number of attacks detected, but sometimes they show the number of attackers detected [13]. The detection delay is not usually taken into account, but there are a few exceptions [16,17,13].…”

“…In most cases these metrics reflect the number of attacks detected, but sometimes they show the number of attackers detected [13]. The detection delay is not usually taken into account, but there are a few exceptions [16,17,13]. There are approaches that quantify the impact of the detectors, such as network overhead or the CPU speed-up [18], or data delivery ratio to evaluate the impact of attack response [13].…”

“…The detection delay is not usually taken into account, but there are a few exceptions [16,17,13]. There are approaches that quantify the impact of the detectors, such as network overhead or the CPU speed-up [18], or data delivery ratio to evaluate the impact of attack response [13]. In this paper we also advocate the use of delivery ratio and total transmissions (as an indicator of overhead) for evaluation purposes.…”

A routing defense mechanism using evolutionary game theory for Delay Tolerant Networks

“…Saha [11] et al propose a table-based strategy to record network history and use this information to detect discrepancies in the behavior of nodes, followed by elimination of those detected as malicious. Chuah et al [12] propose a message-ferry-based detection method. This scheme assumes that some dependable mobile nodes exist in the network, and these dependable nodes collect the history delivery information of the nodes they encounter, and then the malicious nodes can be distinguished according to the information collected by dependable nodes.…”