Mobile Ad hoc Networks (MANET) have been highly vulnerable to attacks due to the dynamic nature of its network infrastructure. Among these attacks, routing attacks have received considerable attention since it could cause the most devastating damage to MANET. Even though there exist several intrusion response techniques to mitigate such critical attacks, existing solutions typically attempt to isolate malicious nodes based on binary or naı¨ve fuzzy response decisions. However, binary responses may result in the unexpected network partition, causing additional damages to the network infrastructure, and naı¨ve fuzzy responses could lead to uncertainty in countering routing attacks in MANET. In this paper, we propose a risk-aware response mechanism to systematically cope with the identified routing attacks. Our risk-aware approach is based on an extended Dempster-Shafer mathematical theory of evidence introducing a notion of importance factors. In addition, our experiments demonstrate the effectiveness of our approach with the consideration of several performance metric

BABU, P.

JASMINE, SK.

SUBBARAO, CH.

English

Interscience Research Network

International Journal of Communication Networks and Security Volume 2 Issue 1 Article 15 January 2013 MINIMIZATION OF MOBILE AD HOC NETWORKS ROUTING ATTACKS USING DS MATHEMATICAL THEORY SK. JASMINE QCET, Nellore,India, SK.JASMINE@gmail.com CH. SUBBARAO QCET, Nellore,India, CHSUBBARAO@gmail.com P. BABU QCET, Nellore,India, P.BABU@gmail.com Follow this and additional works at: https://www.interscience.in/ijcns  Part of the Computer Engineering Commons, and the Systems and Communications Commons Recommended Citation JASMINE, SK.; SUBBARAO, CH.; and BABU, P. (2013) "MINIMIZATION OF MOBILE AD HOC NETWORKS ROUTING ATTACKS USING DS MATHEMATICAL THEORY," International Journal of Communication Networks and Security: Vol. 2 : Iss. 1 , Article 15. DOI: 10.47893/IJCNS.2013.1072 Available at: https://www.interscience.in/ijcns/vol2/iss1/15 This Article is brought to you for free and open access by the Interscience Journals at Interscience Research Network. It has been accepted for inclusion in International Journal of Communication Networks and Security by an authorized editor of Interscience Research Network. For more information, please contact sritampatnaik@gmail.com. International Journal of Communication Network Security ISSN: 2231 – 1882, Volume-2, Issue-1, 2013 66 MINIMIZATION OF MOBILE AD HOC NETWORKS ROUTING ATTACKS USING DS MATHEMATICAL THEORY  SK. JASMINE1, CH. SUBBARAO2, P.BABU3  1PG student, QCET, 2,3Associate Professor, QCET, Nellore    Abstract- Mobile Ad hoc Networks (MANET) have been highly vulnerable to attacks due to the dynamic nature of its network infrastructure. Among these attacks, routing attacks have received considerable attention since it could cause the most devastating damage to MANET. Even though there exist several intrusion response techniques to mitigate such critical attacks, existing solutions  typically attempt to isolate malicious nodes based on binary or naı¨ve fuzzy response decisions. However, binary responses may result in the unexpected network partition, causing additional damages to the network infrastructure, and naı¨ve fuzzy responses could lead to uncertainty in countering routing attacks in MANET. In this paper, we propose a risk-aware response mechanism to systematically cope with the identified routing attacks. Our risk-aware approach is based on an extended Dempster-Shafer mathematical theory of evidence introducing a notion of importance factors. In addition, our experiments demonstrate the effectiveness of our approach with the consideration of several performance metrics   I. INTRODUCTION  A Wireless Sensor Network (WSN) is a collection of spatially deployed wireless sensors by which to monitor various changes of environmental conditions (e.g., forest fire, air pollutant concentration, and object moving) in a collaborative manner without relying on any underlying infrastructure support .Recently, a number of research efforts have been made to develop sensor hardware and network architectures in order to effectively deploy WSNs for a variety of applications. Due to a wide diversity of WSN application requirements, however, a general-purpose WSN design cannot fulfill the needs of all applications. Many network parameters such as sensing range, transmission range, and node density have to be carefully considered at the network design stage, according to specific applications. To achieve this, it is critical to capture the impacts of network parameters on network performance with respect to application specifications. Intrusion detection (i.e., object tracking) in a WSN can be regarded as a monitoring system for detecting the intruder that is invading the network domain.   The intrusion detection application concerns how fast the intruder can be detected by the WSN. If sensors are deployed with a high density so that the union of all sensing ranges covers the entire network area, the intruder can be immediately detected once it approaches the network area. However, such a high-density deployment policy increases the network investment and may be even unaffordable for a large area. In fact, it is not necessary to deploy so many sensors to cover the entire WSN area in many applications, since a network with small and scattered void areas will also be able to detect a moving intruder within a certain intrusion distance. In this case, the application can specify a required intrusion distance within which the intruder should be detected. As shown in Fig. 1, the intrusion distance is referred as D and defined as the distance between the points the intruder enters the WSN, and the point the intruder is detected by the WSN system. This distance is of central interest to a WSN used for intrusion detection. In this paper, we derive the expected intrusion distance and evaluate the detection probability in different application scenarios.. For example, given an expected detection distance EðDÞ, we can derive the node density with respect to sensors’ sensing range, thereby knowing the total number of sensors required for WSN deployment.  In a WSN, there are two ways to detect an object (i.e., an intruder): single-sensing detection and multiple-sensing detection. In the single-sensing detection, the intruder can be successfully detected by a single sensor. On the contrary, in the multiple-sensing detection, the intruder can only be detected by multiple collaborating sensors .In some applications, the sensed information provided by a single sensor might be inadequate for recognizing the intruder. It is because individual sensors can only sense a portion of the intruder. For example, the location of an intruder can only be determined from at least three sensors’ sensing.  In view of this, we analyze the intrusion detection problem under two application scenarios: single-sensing detection and multiple-sensing detection. According to the capability of sensors, we consider two network types: homogeneous and heterogeneous WSNs We define the sensor capability in terms of the sensing range and the transmission range. In a heterogeneousWSN some sensors have a larger sensing range and more power to achieve a longer transmission range. In this paper, we show that the heterogeneous WSN increases the detection probability for a given intrusion detection distance. This motivates us to analyze the network connectivity Minimization of Mobile Ad hoc Networks routing attacks using DS mathematical theory International Journal of Communication Network Security ISSN: 2231 – 1882, Volume-2, Issue-1, 2013 67 in this paper. Furthermore, in a heterogeneous WSN, high capability sensors usually undertake more important tasks (i.e., broadcasting power management information or synchronization information to all the sensors in the network),it is also desirable to define and examine the broadcast reachability from high-capability sensors. The network connectivity and broadcast reachability are important conditions to ensure the detection probability in WSNs. They are formally defined and analyzed in this paper. To the best of our knowledge, our effect is the first to address this issue in a heterogeneous WSN.  We present an example scenario where _nding a route with speci_c security attributes or trust levels is more relevant than _nding the shortest route (or any route) between two nodes. We focus on a high-risk ad hoc network; wireless communication devices in a battle_eld, where malicious adversaries can intercept and alter mission critical information.  In Figure 1, two generals establish a route to communicate among themselves, using a generic on-demand ad-hoc routing protocol. During the mission, the generals detect that some of the privates have defected. The generals decide that they can only trust nodes owned by oÆcers to route their packets. Relaying these messages using potentially compromised nodes can leak information to untrusted entities and jeopardize the mission. Even if the generals encrypt the   Figure 1: Security-aware Routing - Motivation  Existing System: Several work addressed the intrusion response actions in MANET by isolating uncooperative nodes based on the node reputation derived from their behaviors. Such a simple response against malicious nodes often neglects possible negative side effects involved with the response actions. In MANET scenario, improper countermeasures may cause the unexpected network partition, bringing additional damages to the network infrastructure. To address the above-mentioned critical issues, more flexible and adaptive response should be investigated. The notion of risk can be adopted to support more adaptive responses to routing attacks in MANET. Subjective knowledge could be retrieved from previous experience and objective evidence could be obtained from observation while logical reasoning requires a formal foundation. Wang et al. proposed a naı¨ve fuzzy cost-sensitive intrusion response solution for MANET. Their cost model took subjective knowledge and objective evidence into account but omitted a seamless combination of two properties with logical reasoning.  Proposed System:  We formally propose an extended D-S evidence model with importance factors and articulate expected properties for Dempster’s rule of combination with importance factors (DRCIF). Our Dempster’s rule of combination with importance factors is nonassociative and weighted, which has not been addressed in the literature.  We propose an adaptive risk-aware response mechanism with the extended D-S evidence model, considering damages caused by both attacks and countermeasures. The adaptiveness of our mechanism allows us to systematically cope with MANET routing attacks.  We evaluate our response mechanism against representative attack scenarios and experiments. Our results clearly demonstrate the effectiveness and scalability of our risk-aware approach.  Modules:  Evidence collection  Risk assessment  Decision making  Intrusion response  Routing table recovery  1) Evidence collection  In this step, Intrusion Detection System (IDS) gives an attack alert with a confidence value, and then Routing Table Change Detector (RTCD) runs to figure out how many changes on routing table are caused by the attack.  2) Risk assessment   Alert confidence from IDS and the routing table changing information would be further considered as independent evidences for risk calculation and combined with the extended D-S theory. Risk of countermeasures is calculated as well during a risk assessment phase. Based on the risk of attacks and the risk of countermeasures, the entire risk of an attack could be figured out. 3) Decision making  The adaptive decision module provides a flexible response decision-making mechanism, Minimization of Mobile Ad hoc Networks routing attacks using DS mathematical theory International Journal of Communication Network Security ISSN: 2231 – 1882, Volume-2, Issue-1, 2013 68 which takes risk estimation and risk tolerance into account. To adjust temporary isolation level, a user can set different thresholds to fulfill her goal.  4) Intrusion response  With the output from risk assessment and decision-making module, the corresponding response actions, including routing table recovery and node isolation, are carried out to mitigate attack damages in a distributed manner.  5) Routing table recovery  Routing table recovery is an indispensable response and should serve as the first response method after successful detection of attacks. In proactive routing protocols like OLSR, routing table recovery does not bring any additional overhead since it periodically goes with routing control messages. Also, as long as the detection of attack is positive, this response causes no negative impacts on existing routing operations.  RESULT   We have proposed a risk-aware response solution for mitigating MANET routing attacks. Especially, our approach considered the potential damages of attacks and countermeasures. In order to measure the risk of both attacks and countermeasures, we extended Dempster-Shafer theory of evidence with a notion of importance factors. Based on several metrics, we also investigated the performance and practicality of our approach and the experiment results clearly demonstrated the effectiveness and scalability of our riskaware approach. Based on the promising results obtained through these experiments, we would further seek more systematic way to accommodate node reputation and attack frequency in our adaptive decision model.  REFERENCES  [1]   Y. Sun, W. Yu, Z. Han, and K. Liu, “Information Theoretic Framework of Trust Modeling and Evaluation for Ad Hoc Networks,” IEEE J. Selected Areas in Comm., vol. 24, no. 2, pp. 305-317, Feb. 2006. [2]   M. Refaei, L. DaSilva, M. Eltoweissy, and T. Nadeem, “Adaptation of Reputation Management Systems to Dynamic Network Conditions in Ad Hoc Networks,” IEEE Trans. Computers, vol. 59, no. 5, pp. 707-719, May 2010. [3]  P. Cheng, P. Rohatgi, C. Keser, P. Karger, G. Wagner, and A. Reninger, “Fuzzy Multi-Level Security: An Experiment on Quantified Risk-Adaptive Access Control,” Proc. 28th IEEE Symp. Security and Privacy, 2007. [4]   S. Wang, C. Tseng, K. Levitt, and M. Bishop, “Cost-Sensitive Intrusion Responses for Mobile Ad Hoc Networks,” Proc. 10th Int’l Symp. Recent Advances in Intrusion Detection (RAID ’07), pp. 127- 145, 2007. [5]   G. Shafer, A Mathematical Theory of Evidence. Princeton Univ., 1976. [6]   L. Sun, R. Srivastava, and T. Mock, “An Information Systems Security Risk Assessment Model under the Dempster-Shafer Theory of Belief Functions,” J. Management Information Systems, vol. 22, no. 4, pp. 109-142, 2006. [7]   C. Mu, X. Li, H. Huang, and S. Tian, “Online Risk Assessment of Intrusion Scenarios Using D-S Evidence Theory,” Proc. 13th European Symp. Research in Computer Security (ESORICS ’08), pp. 35-48, 2008. [8]   K. Sentz and S. Ferson, “Combination of Evidence in Dempster-Shafer Theory,” technical report, Sandia Nat’l Laboratories, 2002. [9]  L. Zadeh, “Review of a Mathematical Theory of Evidence,” AI Magazine, vol. 5, no. 3, p. 81, 1984. [10]   R. Yager, “On the Dempster-Shafer Framework and New Combination Rules_1,” Information Sciences, vol. 41, no. 2, pp. 93- 137, 1987.   

MINIMIZATION OF MOBILE AD HOC NETWORKS ROUTING ATTACKS USING DS MATHEMATICAL THEORY

https://www.interscience.in/cgi/viewcontent.cgi?article=1072&context=ijcns

MINIMIZATION OF MOBILE AD HOC NETWORKS ROUTING ATTACKS USING DS MATHEMATICAL THEORY

Abstract

Similar works

Full text

Available Versions

Interscience Research Network