Adaptive intrusion detection & prevention of denial of service attacks in MANETs

Abstract

Mobile ad-hoc networks (MANETs) are well known to be vulnerable to various attacks, due to features such as lack of centralized control, dynamic topology, limited physical security and energy constrained operations. In this paper we focus on preventing denial-of-service (DoS) attacks. As an example, we consider intruders that can cause DoS by exploiting the route discovery procedure of reactive routing protocols. We show the unsuitability of tools such as control chart, used in statistical process control (SPC), to detect DoS and propose an anomaly-based intrusion detection system that uses a combination of chi-square test & control chart to first detect intrusion and then identify an intruder. When the intruder is isolated from the network we show reduced overhead and increased throughput. Simulation results show that AIDP performs well at an affordable processing overhead over the range of scenarios tested.

A Comprehensive Survey on Anomaly-Based Intrusion Detection in MANET

“…5, No. 4;2012 detection and separation this labeled data among the huge amount of the data demands high resource.…”

An Evaluation of Anomaly-Based Intrusion Detection Engines for Mobile Ad Hoc Networks

“…Nadeem and M. Howarth [9] have proposed an anomaly-based engine for detecting DoS attacks in MANETs. The proposed engine utilizes a dynamic normal profile and relies on statistical analysis for resolving malicious behaviors.…”

“…However, in [7] and [9] the normal profile is static including only the initial conditions of the network when the normal profile is created. This may lead to high rates of false positives when dynamic changes on the network occur, since these changes are not incorporated into the normal profile and therefore, are falsely considered as results of malicious behaviors.…”

“…Thus, these attack(s) will be undetected. Another approach to address the limitation of the static normal profiles is through the use of thresholds [7] [9]. In this approach, periodic symptoms of suspicious behaviors, mainly caused by network topology changes, remain under the detection thresholds; while malicious behaviors that are constant exceed the thresholds indicating the occurrence of attacks.…”

A Hybrid Approach to Resolve Sinkhole Attack Using Raeed and Aodv Protocols

“…The broadcast nature of transmission enhances the chances of attacks. One the famous category of attacks is Denial of Service attacks(DOS) [2,3]. The DOS attacks interrupt the routing when data is transmitted from source to destination node.…”