In-Band Wormholes and Countermeasures in OLSR Networks

Abstract

In a wormhole attack, colluding nodes create connecting the purported neighbors using a covert the illusion that two remote regions of a MANET are communication mechanism. The wormhole undermines directly connected through nodes that appear to be shortest path routing calculations, allowing the attacking neighbors, but are actually distant from each other. This nodes to attract traffic from other parts of the network so it is undermines shortest-path routing calculations, allowing routed through them. The wormhole thus creates two artificial the attacking nodes to attract traffic, which can then be traffic choke points that are under the control of the attacker manipulated. Prior research has concentrated on out-of-and can be utilized at an opportune future time to degrade or band wormholes, which covertly connect the purported analyze the traffic stream.neighbors via a separate wireline network or RF channel.Prior research on wormholes in MANETs has concentratedWe present a detailed description of in-band wormholes in primarily on out-of-band wormholes, which covertly connect OLSR networks. These connect the purported neighbors purported neighbors via a separate communication via covert, multi-hop tunnels. In-band wormholes are an mechanism, such as a wireline network or additional RF important threat because they do not require specialized channel that is not generally available throughout the network hardware and can be launched by any node in the [HU03] [HONG05]. This paper describes in detail, in-band MANET. Moreover, unlike out-of-band wormholes, in-wormholes, which covertly connect the purported neighbors band wormholes consume network capacity, inherently via multi-hop tunnels through the primary link layer. In-band degrading service. We explain the conditions under which wormholes are important for several reasons. First, because an in-band wormhole will collapse and how it can be made they do not require additional specialized hardware, they can collapse resilient. We identify the self-contained and be launched from any node in the network; as a result, they extended forms of in-band wormholes and present may be more likely to be used by real adversaries. Second, wormhole gravitational analysis, a technique for comparing unlike out-of-band wormholes, which actually add channel the effect of wormholes on the network. Finally, we identify potential countermeasures for preventing and capacit toth network, in-an wormholes tinualy consume network ca acity i.e. waste bandwidth) thereby detecting in-band wormholes based on packet loss rates, .y ..y packet delays, and topological characteristics, and we inhermen asurs service degrandaton. Thrd athough describe the results of initial laboratory experiments to cout-of-band wormhols sem toodepend assess theireffectiveness, on out-of-band mechanisms such as geographic position assess their effectiveness. information or highly synchronized clocks, countermeasures Index Terms-Computer network security, routing, for in-band wormholes may not. mobile communications, re...

Analysis of wormhole intrusion attacks in MANETS

“…They cannot identify the intermediate tunnel nodes that knowingly or unknowingly participate in forming a wormhole tunnel. Kruus et al [9] proposed several countermeasures for wormhole detection and prevention. These countermeasures include 1) OLSR protocol extensions that incorporate link quality in routing decisions, 2) higher protocol layer measurements of packet loss and round-trip delays over 1-hop and 3-hop routing paths, and 3) monitoring for the presence of asymmetric links and other potential indicators.…”

Countering False Accusations and Collusion in the Detection of In-Band Wormholes

“…The research we present here builds on our prior work, which provided the first detailed description of in-band wormholes in OLSR networks [14] [11]. We introduced the terms extended wormhole for attacks in which the wormhole link appears between unsuspecting benign nodes and self-contained wormhole for attacks in which the wormhole link appears between two attacking nodes.…”

“…An in-band wormhole can fall victim to its own success, as the disruption in network routing can also affect the routing of traffic through the wormhole tunnel, causing the wormhole to collapse [14]. An inband wormhole collapses when its tunnel endpoints cannot continue to forward control messages between remote network regions.…”

“…We examine these issues in the context of an inband wormhole attack on the OLSR routing protocol [14]. In this attack, a collection of colluding attackers creates the illusion that a single-hop "short cut", (a layer 2 link) exists between two nodes in distant parts of the network.…”

“…Building on our prior research [14], we describe a prototype intrusion detection system that detects and localizes wormholes by measuring and analyzing roundtrip delay times on multi-hop paths. Before concluding that an attack is underway, the detector requires agreement, by a majority of independent pairs of nodes, that a common link in these paths exhibits anomalous delays.…”