Ad Hoc Networks : Technologies and Protocols - University of ...

Intrusion Detection Techniques 259
Cooperative detection can result in lower false alarm rate because local intrusion
report can be confirmed by others. It can also helps the investigation
and identification the compromised node(s) behind the intrusion. For example,
routing “blackhole” and network “partitioning” attacks usually result in anomalies
observable by multiple IDS agents, which can then share the information
to pinpoint the likely compromised node(s).
Local and Global Response. Intrusion response in MANET depends on
the type of intrusion, the help (if any) from other security mechanisms, and the
application-specific policy. An example response is to re-authenticate the nodes
and re-organize the network, e.g., by re-initializing communication channels
between the re-authenticated legitimate nodes, to exclude the compromised
node(s).
9.4.2 A Learning-Based Approach
Intrusion detection in MANET is a very challenging task because there are
many potential (and new) attacks, and because the distinction between intrusions
and legitimate conditions is not always obvious due to the dynamically
changing topology and volatile physical environment. In order to be effective
(i.e., highly accurate), an ID model must perform comprehensive analysis on
an extensive set of features.
One way to build such ID models is to use a learning-based approach for
automatically selecting and constructing appropriate features from audit data
and computing ID models. The main idea is to first start with a (broad) set of
features, perhaps enumerated using domain knowledge, then apply data mining
algorithms (e.g., [1] [27]) to compute temporal and statistical patterns describing
the correlations among the features and the co-occurring events. The consistent
patterns of normal activities and the unique patterns associated with intrusions
are then identified and analyzed to select the appropriate features or construct
additional features. Machine learning algorithms [29] (e.g., the RIPPER [11]
classification rule learner) are then used to compute the detection models.
In this approach, the selected and constructed features are seeded from domain
knowledge but are more empirical and objective because they are based on
patterns computed from audit data. The inductively learned ID rules are usually
more generalizable than hand-coded rules. That is, they tend to have better performance
against new variants of known normal behavior or intrusions. This is
because when there is more than one candidate model, classification algorithms
always produce the model with better performance on a hold-out dataset, which
is not used to produce the models and is intended to simulate the situation of
encountering unseen or future cases.
The learning-based approach toward ID models has been proved successful
in wired network environment [26]. It is therefore rational to believe that