Detecting Colluding Blackhole and Greyhole Attacks in Delay Tolerant Networks

Abstract

Delay Tolerant Network (DTN) is developed to cope with intermittent connectivity and long delay in wireless networks. Due to the limited connectivity, DTN is vulnerable to blackhole and greyhole attacks in which malicious nodes intentionally drop all or part of the received messages. Although existing proposals could accurately detect the attack launched by individuals, they fail to tackle the case that malicious nodes cooperate with each other to cheat the defense system. In this paper, we suggest a scheme called Statistical-based Detection of Blackhole and Greyhole attackers (SDBG) to address both individual and collusion attacks. Nodes are required to exchange their encounter record histories, based on which other nodes can evaluate their forwarding behaviors. To detect the individual misbehavior, we define forwarding ratio metrics that can distinguish the behavious of attackers from normal nodes. Malicious nodes might avoid being detected by colluding to manipulate their forwarding ratio metrics. To continuously drop messages and promote the metrics at the same time, attackers need to create fake encounter records frequently and with high forged numbers of sent messages. We exploit the abnormal pattern of appearance frequency and number of sent messages in fake encounters to design a robust algorithm to detect colluding attackers. Extensive simulation shows that our solution can work with various dropping probabilities and different number of attackers per collusion at high accuracy and low false positive.

A Security and Efficient Routing Scheme with Misbehavior Detection in Delay-Tolerant Networks

“…However, these routing schemes are inefficient in the DTNs environment with malicious or selfish nodes. To mitigate the impact of selfish or malicious nodes on DTNs, some detection attacks schemes are proposed in [3,6,7], which make use of the history forwarding evidences and encounter records of each node to analyze its forwarding behavior. However, these detection schemes are independent of specific routing protocols and require more computing capability, network bandwidth, and storage resources to work well.…”

“…(1) if node meets node then (2) node triggers Algorithm 2 and detects behavior of node ; (3) get detection result of node from Algorithm 2; (4) end (5) if node is a well-behavior node and ̸ = then (6) sorts messages by the remaining TTL; (7) for each message ∈ do (8) get destination node from head field of ; (9) get ⋅ , ⋅ of node and node from = ( 1 , 2 , 3 , . .…”

“…To detect colluding blackhole and greyhole attacks, Pham and Yeo [6] designs a statistical-based detection scheme (SDBG) in which each node locally maintains the encounter records and the meeting summary with other nodes. When the nodes meet each other, they are required to exchange their encounter record histories, based on which other nodes can evaluate their forwarding behaviors.…”

“…However, DTNs are threatened by various attacks, because some nodes will behave selfishly and may not be willing to help others forward messages in order to conserve their limited resources (e.g., power and buffer), and even some nodes controlled by adversary will behave maliciously and may launch black hole, grey hole, or DoS attacks against the networks by dropping all or part of the received message packets, maliciously tampering message packets, or producing an enormous number of fake message packets [4][5][6][7]. The recent researches show that these selfish or malicious nodes would significantly degrade the routing performance of DTNs, resulting in low delivery rate and poor forwarding efficiency of messages and high average delivery delay.…”

A Comprehensive Review and Performance Evaluation of Detection Techniques of Black Hole Attack in MANET

“…No changes to the packets configurations are required, so the overhead is a little measure of computation at nodes and no additional correspondence. Thi and Yeo (2016) for identifying the individual bad conduct, they characterized sending proportion metrics that can recognize the behaviors of assailants from typical nodes. According to us in this the malevolent nodes may abstain from being distinguished by conniving to control their sending proportion metrics.…”