Page 2 Lecture Notes in Computer Science 2865 Edited by G. Goos ...

152 M. Just, E. Kranakis, and T. Wancan easily join the network or capture a mobile node and then starts to disrupt networkcommunication by silently dropping packets. It is also a threat to the Internet since thevarious software vulnerabilities would allow attackers to gain remote control of routerson the Internet. If malicious packet dropping attack is used along with other attackingtechniques, such as shorter distance fraud, it can create more powerful attacks (i.e.,black hole [12]) which may completely disrupt network communication.Current network protocols do not have the capability to detect the malicious packetdropping attack. Network congestion control mechanisms do not apply here since packetsare not dropped due to congestion. Link layer acknowledgment, such as IEEE 802.11MAC protocol [1], can detect link layer break, but cannot detect forwarding level break.Although upper layer acknowledgment, such as TCP ACK, allows for detecting end-toendcommunication break, it can be inefficient and it does not indicate the node at whichthe communication breaks. Moreover such mechanism is not available in connectionlesstransport layer protocols, such as UDP. Therefore, it is important to develop mechanismsto render networks the robustness for resisting the malicious packet droppingattack.In this paper, we present a proactive distributed probing technique to detect andmitigate the malicious packet dropping attack. In our approach, every node proactivelymonitors the forwarding behavior of other nodes. Suppose node A wants to know ifnode B performs its forwarding functions, it will send a probe message to a node onehop away from node B, let us say to node C. C is supposed to respond to the probe messageby sending back an acknowledgment to A. If A can receive the acknowledgmentwithin a certain time period, it acts as a confirmation that node B forwarded the probemessage to C. With the assumption that a probe message is indistinguishable from anormal data packet, A knows that B will forward all the other packets.Our experiments demonstrate that in a moderately changing network, the probingtechnique can detect most of the malicious nodes with a relatively low false positiverate. The packet delivery rate in the network can also be increased if the detected maliciousnodes are bypassed from network communication. We argue that the probingtechnique is of practical significance since it can be implemented in the applicationlayer and does not require the modification of underlying routing protocols.The remainder of the paper is organized as follows. In Section 2, we analyze theDoS attacks against a network infrastructure and review the corresponding preventionmechanisms. In Section 3, we define frequently used notation and terminology. In Section4, we present our solution for monitoring wireless ad hoc networks. In section 5,we describe the implementation and simulation of our solution. We conclude the paperin the last section.2 DoS Attacks on Routing InfrastructureWireless ad hoc networks are vulnerable to various types of DoS attacks, such as signalinjection, battery drain, among others. This paper focuses on the DoS attacks on itsrouting infrastructure. Based on the types of traffic transmitted in a network, we canclassify these DoS attacks into two categories: DoS attacks on routing traffic and DoSattacks on data traffic. Such classification is also applicable to the Internet.