On identifying malicious nodes in ad hoc networks

Abstract

Route falsification attacks are easy to launch in mobile ad hoc networks with on demand routing protocols that employ network-wide flooding of control packets for route discoveries. To mitigate this attack, we propose a p-hop crosscheck mechanism that requires nodes p, p ≥ 2, hops apart to authenticate and verify route reply packets using pair-wise shared keys. The crosscheck can detect route falsification by non-colluding malicious nodes on-the-fly; furthermore, it can identify a group of at most p+1 nodes that contain the malicious nodes that caused the route falsification. Unlike intrusion detection techniques, which require extensive monitoring and sampling, the proposed crosscheck mechanism is light-weight and fast. Therefore, the proposed crosscheck mechanism can be used to augment the existing secure routing protocols and improve intrusion detection capability. We implemented 2-hop crosscheck for AODV in the Glomosim simulator. Using simulations, we show that 2-hop crosscheck mitigates attacks by multiple malicious nodes with negligible performance impact.