Energy Efficient Monitoring for Intrusion Detection in Battery-Powered Wireless Mesh Networks

Abstract

Abstract. Wireless Mesh Networks (WMN) are easy-to-deploy, low cost solutions for providing networking and internet services in environments with no network infrastructure, e.g., disaster areas and battlefields. Since electric power is not readily available in such environments batterypowered mesh routers, operating in an energy efficient manner, are required. To the best of our knowledge, the impact of energy efficient solutions, e.g., involving duty-cycling, on WMN intrusion detection systems, which require continuous monitoring, remains an open research problem. In this paper we propose that carefully chosen monitoring mesh nodes ensure continuous and complete detection coverage, while allowing non-monitoring mesh nodes to save energy through duty-cycling. We formulate the monitoring node selection problem as an optimization problem and propose distributed and centralized solutions for it, with different tradeoffs. Through extensive simulations and a proof-of-concept hardware/software implementation we demonstrate that our solutions extend the WMN lifetime by 8%, while ensuring, at the minimum, a 97% intrusion detection rate.

RAPID: Traffic-agnostic intrusion detection for resource-constrained wireless mesh networks

“…Some existing solutions address specific attacks (e.g., Man-in-the-Middle and Wormhole Attacks [16], Grayhole attack [17], message fabrication attack [13], and scheduling in WMN [18]). Other solutions are general IDS solutions for mesh networks, which consider memory, processing [11,14,19], and energy [10] constraints for performing off-the-shelf IDS tools on WMN devices. The later group of IDS solutions aim at addressing the challenges associated with monitoring mechanisms for intrusion detection in WMN, as opposed to the former group which addresses specific attacks in such networks.…”

“…This approach is inefficient primarily because of redundant monitoring on multi-hop traffic that causes unnecessary resource consumption (e.g., resources that can be allocated to other networking services). The aforementioned inefficiency triggered major research on optimal monitoring for intrusion detection systems [8][9][10][23][24][25]. In optimal monitoring solutions, a minimum subset of nodes is selected to perform IDS functions and monitor the entire network traffic.…”

“…However, it is shown [10] that link-coverage can achieve a higher link/path coverage ratio in infrastructureless wireless networks. Hence, in addition to the nodes located on each routing path, other nodes can also participate in traffic monitoring if they can monitor at least one link of that path.…”

“…Monitoring node solutions [8][9][10] select a subset of nodes (called monitoring nodes), assign each selected node the same set of IDS functions for monitoring a distinct part of network (i.e., either communication links [10] or WMN nodes [9]). These solutions, however, suffer from high false negative rates because some IDS functions cannot be activated on monitoring nodes due to limited resources (e.g., memory and processing power).…”

“…Thus, traffic-agnostic solutions are more complex than traffic-aware solutions since all of WMN nodes must be considered in the optimal IDS function distribution problem (as opposed to traffic-aware solutions that only consider few nodes on the routing paths). Our proposed IDS mechanism is based on traffic-agnostic and link-coverage approaches inspired by the PRIDE [14] and EEMON [10] intrusion detection systems. Our solution, irrespective to the changes in WMN traffic paths, is able to monitor the entire WMN traffic, at the price, however, of putting IDS load on all WMN nodes instead of those located only along routing paths.…”