On the Anomaly Intrusion-Detection in Mobile Ad Hoc Network Environments

Puttini, Ricardo Staciarini; Hanashiro, Maíra; Miziara, Fábio; Sousa, Rafael de; Villalba, Luis Javier García; Barenco, C. J.

doi:10.1007/11872153_16

Cited by 17 publications

(8 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In anomaly detection, the goal is to find objects that differ from most other objects in a group (see related work in [38]- [48] and references therein). Anomalous objects, also known as outliers, usually lie far away from other data points in the feature space.…”

Section: B Anomaly Detection Enginementioning

confidence: 99%

ARBA: Anomaly and Reputation Based Approach for Detecting Infected IoT Devices

et al. 2020

View full text Add to dashboard Cite

Today, cyber attacks are constantly evolving and changing, which makes them harder to detect. In particular, detecting attacks in large-scale networks is very challenging because they require high detection rates under real-time resource constraints. In this paper, we focus on detecting infected Internet of Things (IoT) hosts from domain name system (DNS) traffic data. IoT hosts, such as streaming cameras, printers, air conditioners, are hard to protect, unlike PCs and servers. Enterprises are often unaware of the devices which are connected to the network, their types, makes, and vulnerabilities. Since IoT hosts make use of the DNS protocol, analyzing DNS data can give a broad view of malicious activities, because they abuse the DNS protocol and leave fingerprints as part of their attack vector. In this collaborative research between Ben-Gurion University, and IBM, we establish a novel algorithm to detect infected IoT hosts in large-scale DNS traffic, named Anomaly and Reputation Based Algorithm (ARBA). Its novelty resides in developing a framework that combines host classification and domain reputation in a real-time production environment. ARBA is highly computational efficient and meets real-time requirements in terms of run time and computational complexity. By contrast to existing algorithms, it does not require a massive traffic volume for training, which is of significant interest in detecting infected hosts in real-time. The research was conducted on real live streaming data from IBM internal network traffic, and confirm the algorithm's strong performance in a real-time production environment. INDEX TERMS Cyber security, anomaly detection, domain name system (DNS), detection algorithms, real-time algorithms.

show abstract

Section: B Anomaly Detection Enginementioning

confidence: 99%

ARBA: Anomaly and Reputation Based Approach for Detecting Infected IoT Devices

et al. 2020

View full text Add to dashboard Cite

show abstract

“…A local agent is responsible for broadcasting alerts in its zone. Moreover, a special gateway zone is defined that aggregates locally generated alerts and [28] Mobile Agent Signature DoS N Buchegger and Le Boudec [66] Reputation Signature Packet Dropping Huang and Lee [67] Hierarchical Anomaly Routing, DoS Kachirski and Guha [68] Hierarchical Anomaly Packet Dropping † Michiardi and Molva [23] Reputation Anomaly Node Selfishness Patcha and Park [69] Game Theory Signature DoS † Puttini et al [70] Statistical Detection Anomaly Routing Disruption N Rao and Kesidis [71] Statistical Detection Signature Routing Disruption N Shakshuki et al [72] Machine Learning Signature Routing Disruption N Sterne et al [73] Hierarchical Hybrid Packet Dropping, Node Capture † Sun et al [74] Hierarchical Anomaly Routing Disruption N Zhang and Lee [75] Mobile Agent Anomaly DoS N Zhang et al [18] Mobile Agent Anomaly Routing Misdirection, Packet Dropping N † Suited for IoT networks with some stations without energy limitations that can act as cluster heads.…”

Section: Manetsmentioning

confidence: 99%

Recent Advancements in Intrusion Detection Systems for the Internet of Things

Khan

Herrmann

2019

Security and Communication Networks

View full text Add to dashboard Cite

Many Internet of Things (IoT) systems run on tiny connected devices that have to deal with severe processor and energy restrictions. Often, the limited processing resources do not allow the use of standard security mechanisms on the nodes, making IoT applications quite vulnerable to different types of attacks. This holds particularly for intrusion detection systems (IDS) that are usually too resource-heavy to be handled by small IoT devices. Thus, many IoT systems are not sufficiently protected against typical network attacks like Denial-of-Service (DoS) and routing attacks. On the other side, IDSs have already been successfully used in adjacent network types like Mobile Ad hoc Networks (MANET), Wireless Sensor Networks (WSN), and Cyber-Physical Systems (CPS) which, in part, face limitations similar to those of IoT applications. Moreover, there is research work ongoing that promises IDSs that may better fit to the limitations of IoT devices. In this article, we will give an overview about IDSs suited for IoT networks. Besides looking on approaches developed particularly for IoT, we introduce also work for the three similar network types mentioned above and discuss if they are also suitable for IoT systems. In addition, we present some suggestions for future research work that could be useful to make IoT networks more secure.

show abstract

“…The presented algorithm was tested against four kinds of network attacks Some other studies utilized data obtained from SNMP-MIB for the purpose of intrusion detection in wireless networks [23], [24]. In [23], authors proposed a multi agent based intrusion detection system to detect the intrusion locally in mobile wireless networks using information from SNMP-MIB data, also Puttini et al [24]. A Bayesian classification was used to detect anomalous in network traffic in Mobile Ad Hoc Networks (MANET) using SNMP-MIB variables.…”

Section: Related Workmentioning

confidence: 99%

Exploiting SNMP-MIB Data to Detect Network Anomalies Using Machine Learning Techniques

Al‐Naymat

Alkasassbeh

Al-Hawari

2018

Advances in Intelligent Systems and Computing

View full text Add to dashboard Cite

The exponential increase in the number of malicious threats on computer networks and Internet services due to a large number of attacks makes the network security at continuous risk. One of the most prevalent network attacks that threaten networks is Denial of Service (DoS) flooding attack. DoS attacks have recently become the most attractive type of attacks to attackers and these have posed devastating threats to network services. So, there is a need for effective approaches, which can efficiently detect any intrusion in the network. This paper presents an efficient mechanism for network attacks detection and types of attack classification using the Management Information Base (MIB) database associated with the Simple Network Management Protocol (SNMP) through machine learning techniques. This paper also investigates the impact of SNMP-MIB data on network anomalies detection. Three classifiers, namely, Random Forest, AdaboostM1 and MLP are used to build the detection model. The use of different classifiers presents a comprehensive study on the effectiveness of SNMP-MIB data in detecting different types of attack. Empirical results show that the machine learning techniques were quite successful in detecting and classifying the attacks with a high detection rate.

show abstract

On the Anomaly Intrusion-Detection in Mobile Ad Hoc Network Environments

Cited by 17 publications

References 12 publications

ARBA: Anomaly and Reputation Based Approach for Detecting Infected IoT Devices

ARBA: Anomaly and Reputation Based Approach for Detecting Infected IoT Devices

Recent Advancements in Intrusion Detection Systems for the Internet of Things

Exploiting SNMP-MIB Data to Detect Network Anomalies Using Machine Learning Techniques

Contact Info

Product

Resources

About