Ad Hoc Networks : Technologies and Protocols - University of ...

256 Security in Mobile Ad-Hoc Networks
9.4 Intrusion Detection Techniques
Although much attention in building a secure mobile ad-hoc network is still
focused on prevention techniques as shown in the previous section, researchers
have begun to investigate detection and response schemes as well. Partridge et
al. [31] report that basic signal processing techniques can be used to perform
traffic analysis on packet streams, even if the data is encrypted. Marti et al. [28]
propose to use “watchdog” to identify nodes with routing misbehavior and to
avoid such nodes in the route used. It also uses “pathrater” to choose better path
based on the reputation of intermediate nodes if multiple paths are available.
CONFIDANT [8] further extends these approaches to evaluate the level of
trust of alert reports and to include a reputation system to rate each node.
Hsin et al. [16] study a static sensor network and propose a power-efficient
distributed neighbor monitoring mechanism where alarms are transmitted back
to a control center. Bucegger et al. [7] propose a routing protocol extension
that detects and isolates nodes that do not cooperate in routing and forwarding
due to selfishness. Finally, Zhang et al. [43] were the first to discuss the need
for a general intrusion detection framework in MANET. A follow-up work [44]
focuses on a preliminary investigation of anomaly detection approaches for
MANET.
The primary assumptions of intrusion detection are: user and program activities
are observable, for example via system auditing mechanisms; and more
importantly, normal and intrusion activities have distinct behavior. Intrusion
detection therefore involves capturing audit data and reasoning about the evidence
in the data to determine whether the system is under attack. Based on the
type of audit data used, intrusion detection systems (IDSs) can be categorized as
network-based or host-based. A network-based IDS normally runs at the gateway
of a network and “captures” and examines network packets that go through
the network hardware interface. A host-based IDS relies on operating system
audit data to monitor and analyze the events generated by programs or users
on the host. The same methodology can be applied to intrusion detection in
MANET, but it must be adapted to the new environment and new requirements.
9.4.1 Architecture Overview
Due to the dynamic nature of MANET, intrusion detection and response
in MANET must be distributed and cooperative [43]. In this architecture, as
shown in Figure 9.1, “monitoring nodes” throughout the network each runs
an IDS agent. In the “every node” scheme, every node can be the monitoring
node for itself. Alternatively a “clustering-based” scheme can be derived for
better efficiency, where a cluster of neighboring nodes can elect a node to be
the monitoring node for the neighborhood.