Wormhole attack detection in ad hoc network using machine learning technique

Abstract

In this paper, we explore the use of machine learning technique for wormhole attack detection in ad hoc network. This work has categorized into three major tasks. One of our tasks is a simulation of wormhole attack in an ad hoc network environment with multiple wormhole tunnels. A next task is the characterization of packet attributes that lead to feature selection. Consequently, we perform data generation and data collection operation that provide large volume dataset. The final task is applied to machine learning technique for wormhole attack detection. Prior to this, a wormhole attack has detected using traditional approaches. In those, a Multirate-DelPHI is shown best results as detection rate is 90%, and the false alarm rate is 20%. We conduct experiments and illustrate that our method performs better resulting in all statistical parameters such as detection rate is 94% and false alarm rate is 15.5%. Furthermore, we have also shown results on various statistical parameters such as Precision, F-measure, MCC, and Accuracy.

An enhanced detection system against routing attacks in mobile ad-hoc network

“…We have extended detection schemes [8,9] with many changes such as compress the datasets, machine learning techniques, reduce self signal from the dataset, different numbers of normal and malicious nodes, etc. Table 1 shows the related works that detect blackhole, wormhole, and other attacks in MANETs.…”

“…Two attackers in the network try to maintain their locations strategically. They capture the RREQ packets and send RREP to the sender with min hop count [9,10] and max sequence numbers. A malicious node attracts data packets and tunnels them other-end.…”

“…These malicious nodes (in Fig. 2b) tunnel the data packets and replay at other ends without addressing them-self as a part of the path [9]. When multiple malicious nodes are not in the range; then, it does not create a tunnel, only dropping the data packets.…”

“…The cryptographic or key management-based techniques are first-line defense mechanisms that work efficiently; however, these methods are not compatible with the MANETs environment [6,7]. Blackhole attack drops the packets [8], and the wormhole attack tunnels the packets [9]; whenever they also drop or tunnel the encrypted packets. These attacks are not easy to handle using cryptography techniques.…”

Unsupervised feature selection and cluster center initialization based arbitrary shaped clusters for intrusion detection

“…Data collection from real-world-enterprise of MANETs for IDS is not easy work. Therefore, we simulated wormhole attack for the MANET environment using Network Simulator (NS-3), that is presented in [Prasad et al, 2019]. Simulation is performed on 20 normal and 5 malicious nodes, 250-meter radio range, random movement of nodes, 1000*1000 m 2 topology space, and 300 seconds simulation time, which has generated high volume dataset.…”