Malicious Packet Dropping Research Articles

A security-friendly privacy-preserving solution for federated learning

Federated learning is a privacy-aware collaborative machine learning method where the clients collaborate on constructing a global model by performing local model training using their training data and sending the local model updates to the server. Although it enhances privacy by letting the clients collaborate without sharing their training data, it is still prone to sophisticated privacy attacks because of possible information leakage from the local model updates sent to the server. To prevent such attacks, generally secure aggregation protocols are proposed so that the server will not be able to access the individual local model updates but the aggregated result. However, such secure aggregation approaches may not allow the execution of security mechanisms against some security attacks to model training, such as poisoning and backdoor attacks, because the server cannot access the individual local model updates and; therefore, cannot analyze them to detect anomalies resulting from these attacks. Thus, solutions that satisfy privacy and security at the same time or new privacy-preserving solutions that allow the server to execute some analysis on the local model updates without violating privacy are needed for federated learning. In this paper, we introduce a novel security-friendly privacy solution for federated learning based on multi-hop communication to hide clients’ identities. Our solution ensures that the forwardee clients in the path between the source client and the server cannot execute malicious activities by altering model updates and contributing to the global model construction with more than one local model update in one FL round. We then propose two different approaches to make the solution also robust against possible malicious packet drop behaviors by the forwardee clients.

Secure routing for LEO satellite network survivability

Secure routing algorithm plays an important role in the performance of LEO satellite network survivability. However, due to the instability, openness and exposure of inter-satellite links, the internal routing of LEO satellite network is vulnerable to malicious attacks. Considering that trust management has a better performance in solving the internal attacks, this paper proposes a secure routing algorithm based on node trust for LEO satellite network, called SLT. The SLT is based on the distributed trust evaluation model, which is used to calculate the direct trust, indirect trust and aggregate trust value between satellite nodes through D-S evidence theory. Then, combining the low cost OPSPF routing protocol with the trust evaluation, the SLT algorithm is designed. Through timely detection and isolation of malicious nodes in the satellite network, STL algorithm can reduce the impact of malicious packet dropping caused by internal attacks. Finally, the simulations verifies that SLT algorithm has an average increase of 27% in packet delivery rate and an average decrease of 70% in packet loss rate, compared with OPSPF.

Unknown Input Observers for Discretized Systems With Application to Networked Systems Corrupted by Sparse Malicious Packet Drops

Digital estimators for networked systems are proposed where the plant output measurements and control signals are corrupted by independent sparse malicious packet drop errors. The estimators comprise output sparse error approximators and unknown input observers (UIOs). The advantage of using digital estimators is that in many cases the condition for the existence of an UIO fails for continuous-time (CT) plants while it holds for discretized plants. A class of CT systems for which the existence condition for the UIO holds in the discrete-time (DT) domain is characterized. The proposed digital estimators are tested on a nonlinear networked control system (NCS). As part of our analysis, we study the existence of unknown input observers for discretized systems and show that discretization does not negatively impact the existence of UIOs and in some cases can facilitate the construction of UIOs when they do not exist for the CT systems.

Preventing Malicious Packet Drops in MANETs by Counter Based Authenticated Acknowledgement

Preventing Malicious Packet Drops in MANETs by Counter Based Authenticated Acknowledgement

Efficient Intrusion Detection System to prevent the Packet Dropping nodes from Infrastructure Less Networks

Mobile ad hoc networks is wireless infrastructure free networks. It consist of heterogeneous mobile nodes. These nodes are distributed in wireless communication area. The characteristics of the network are adaptation, autonomous and self-formation and distributed peer to peer network. Applications of the network are military, health care and disaster recovery. Characteristics and applications of MANET demands reliable efficient communication. Multi hop communication is enable in the network by cooperation of the intermediate nodes. The intermediate nodes drop the packets due to either system fault or malicious behavior. Different way of packets drop due to system fault is recognized and isolated from malicious packet dropping nodes during the communication in existing “secure knowledge algorithm”. However, it does not prevent the packet drop due to system fault in the network and it is very essential to enhance the performance and reliability of the communication. Thus the paper design “Efficient Intrusion Detection System to Avoid the Packet Dropping Nodes from Communication Route”. Performance of the proposed IDS is tested in the simulator NS-2 and compare the results with existing work. Results are clearly indicating that the proposed IDS out perform in comparison with existing work in terms of reliability and packet delivery.

Detection of malicious packet dropping attacks in RPL-based internet of things

The routing protocol for low-power and lossy networks (RPL) is an IPv6-based routing protocol optimised for internet of things (IoT) environments. However, it is susceptible to malicious packet dropping attacks. If a node with a lower rank that is closer to the root node attempts a malicious packet dropping, it may disrupt basic data transmission or even the entire IoT application service. In this paper, we present a novel detection method for malicious packet dropping attacks against RPL-based networks. The proposed method is based on the anomaly intrusion detection system and detects malicious packet dropping in the presence of normal packet losses. We evaluate the performance of the method on Contiki's network simulator, Cooja. The evaluation results show that the method has good performance in detecting malicious packet dropping attacks. In every case, the successful detection rate is greater than 94% and the false alarm rate is less than 3%.

QoS Aware Routing Protocol Through Cross-layer Approach in Asynchronous Duty-Cycled WSNs

The growing usage of wireless sensor networks (WSNs) in different scenarios makes the Quality-of-Service (QoS) a paramount issue in WSN-based applications. We are especially interested in the QoS aware of asynchronous duty-cycled WSNs in the light of designing routing protocol, whereby waiting for latency and malicious packet dropping are critical to the network performance. We first propose an optimized detection mechanism for malicious packet dropping attack. Then, based on sleep latency and queue length, a method for congestion degree measurement is proposed under asynchronous duty-cycled low power listening (LPL) modes. Last but not least, we introduce related QoS aware metrics for the design of QoS aware routing protocol, which can enhance the QoS performance in throughput, delay, and packet losses (TDL). Experimental results demonstrate that the QoS performance of our TDL-based routing protocol is better than those of the CTP-Watchdog protocol and the CTP-Optimized protocol, especially in terms of higher-throughput, lower-delay, and less-loss rate. By optimized threshold, the detection accuracy of our detection mechanism is improved much more than that of the traditional watchdog technology. Furthermore, we evaluate that the preferred optimization factor can help to make a tradeoff between the false negative rate and the false positive rate. Our TDL-based routing protocol is implemented under the component-based architecture by a cross-layer approach, which provides a practicable solution for the design of QoS-aware routing protocol in asynchronous duty-cycled WSNs.

Detection of selective forwarding attacks based on adaptive learning automata and communication quality in wireless sensor networks

Wireless sensor networks face threats of selective forwarding attacks which are simple to implement but difficult to detect. It is difficult to distinguish between malicious packet dropping and the normal packet loss on unstable wireless channels. For this situation, a selective forwarding attack detection method is proposed based on adaptive learning automata and communication quality; the method can eliminate the impact of normal packet loss on selective forwarding attack detection and can detect ordinary selective forwarding attack and special cases of selective forwarding attack. The current and comprehensive communication quality of nodes are employed to reflect the short- and long-term forwarding behaviors of nodes, and the normal packet loss caused by unstable channels and medium-access-control layer collisions is considered. The adaptive reward and penalty parameters of a detection learning automata are determined by the comprehensive communication quality of the node and the voting of its neighbors to reward normal nodes or punish malicious ones. Simulation results indicate the effectiveness of the proposed method in detecting ordinary selective forwarding attacks, black-hole attacks, on-off attacks, and energy exhaustion attacks. In addition, the communication overhead of the method is lower than that of other methods.

Path Reconstruction and Effective Routing with Advanced Congestion Diversity in Wireless Adhoc Networks

Link error and malicious packet dropping are two sources for packet losses in multi-hop wireless ad hoc network. In this paper, while observing a sequence of packet losses in the network, we are interested in determining whether the losses are caused by link errors only, or by the combined effect of link errors and malicious drop. We are especially interested in the insider-attack case, whereby malicious nodes that are part of the route exploit their knowledge of the communication context to selectively drop a small amount of packets critical to the network performance. Because the packet dropping rate in this case is comparable to the channel error rate, conventional algorithms that are based on detecting the packet loss rate cannot achieve satisfactory detection accuracy. To improve the detection accuracy, we propose to exploit the correlations between lost packets. Furthermore, to ensure truthful calculation of these correlations, we develop a homomorphic linear authenticator (HLA) based public auditing architecture that allows the detector to verify the truthfulness of the packet loss information reported by nodes. This construction is privacy preserving, collusion proof, and incurs low communication and storage overheads. To reduce the computation overhead of the baseline scheme, a packet-block based mechanism is also proposed, which allows one to trade detection accuracy for lower computation complexity. Through extensive simulations, we verify that the proposed mechanisms achieve significantly better detection accuracy than conventional methods such as a maximum-likelihood based detection.

Preventing malicious packet dropping nodes in MANET using IFHM based SAODV routing protocol

MANETs have grown into a usually used network for countless applications. Mostly, a transmission medium perspective undergoes with thoughtful security worries, which may be focused to packet dropping. In the network, when packet forward the drooping of valuable packets may occur due to the presence of malicious nodes. The major sources in MANET for packet losses are malicious packet dropping and link error. A node can perform unkindly and could harm the process of sending the packet. In order to overcome the issues and to have an efficient detection process of malicious drop with better secure performances, the improved failure aware third party Auditor (IFTPA) based homomorphism linear authenticator (HLA) mechanism (IFHM) is proposed with the secured ad hoc on demand distance vector (SAODV). The proposed approach permitsthe trustworthiness verification of packet loss information and malicious node detection by dropping identifying of routing and data packet. Packet dropping is because of the both link error and occurrence of malicious nodes, which can identify by SAODV. To make certain efficiency, the authentication service is implemented in the protocol. However, to succeed storage scalability, the protocol implements the pseudo random function (PRF) in the system to fix the secret key of a client to its uniqueness using the secret key of its server.

Efficient Analysis of Malicious Packet Dropping and Privacy in MANET using FHM

Nowadays, detection scheme of packet loss and link error is placing a key role for efficient access and analysis in multi-hop wireless ad hoc network. In this paper, for avoiding the dropping of packet and the link error while observing the network an enhanced approach is implemented. In order to have an efficient process of detecting malicious drop and better performances the Failure aware Third Party Auditor (FTPA) based Homomorphism Linear Authenticator (HLA) mechanism (FHM) is proposed. The proposed approach allows reliability verification of information of packet loss and provides preserving process by ensuring the correct estimation of the system. The simulation of the proposed system outcome provides accurate detection, better computation of the system complexity and efficient tasks of multiple auditing. Also, provides a random generating of the approach procedure by using the pseudo random function (PRF). It provides simultaneous process of auditing and improvement in performance than the existing system.

Forensic Analysis of Packet Losses in Wireless Networks

Due to the lossy nature of wireless links, it is difficult to determine if packet losses are due to wireless-induced effects or from malicious discarding. Many prior efforts on detecting malicious packet drops rely on evidence collected via passive monitoring by neighbor nodes. However, they do not analyze the cause of packet losses. In this paper, we ask: 1) Given certain macroscopic parameters of the network (like traffic intensity and node density) what is the likelihood that evidence exists with respect to a transmission? 2) How can these parameters be used to perform a forensic analysis of the reason for the losses? Toward answering the above questions, we first build an analytical framework that computes the likelihood that evidence (we call this transmission evidence, or TE for short) exists with respect to transmissions, in terms of a set of network parameters. We validate our analytical framework via both simulations as well as real-world experiments on two different wireless testbeds. The analytical framework is then used as a basis for a protocol within a forensic analyzer to assess the cause of packet losses and determine the likelihood of forwarding misbehaviors. Through simulations, we find that our assessments are close to the ground truth in all examined cases, with an average deviation of 2.3% from the ground truth and a worst case deviation of 15.0%.

IPv6 기반의 사물인터넷 환경에서 악성 노드의 패킷 유실 공격 탐지 및 우회 기법 분석

IPv6 기반의 사물인터넷 환경에서 악성 노드의 패킷 유실 공격 탐지 및 우회 기법 분석

Detecting Packet Dropping Attack in Wireless Ad Hoc Network

In wireless ad hoc network, packet loss is a serious issue. Either it is caused by link errors or by malicious packet dropping. The malicious nodes in a route can intentionally drop the packets during the transmission from source to destination. It is difficult to distinct the packet loss due to link errors and malicious dropping. Here is a mechanism which will detect the malicious packet dropping by using the correlation between packets. An auditing architecture based on homomorphic linear authenticator can be used to ensure the proof of reception of packets at each node. Also to ensure the forwarding of packets at each node, a reputation mechanism based on indirect reciprocity can be used.

Trust based Data Plane Security Mechanism for a Mobile Ad hoc Network through Acknowledgement Reports

Malicious packet drop attack over the data plane in a MANET involves malicious nodes dropping the data packets after the route formation. In this paper, a security mechanism has been proposed to detect those nodes which exhibit the malicious behavior by dropping the data packets during the data transmission phase after participating in the route establishment phase without exhibiting any malicious behavior. The detection is done based upon a trust management framework employing the Dempster Shafer Theory to represent the trust. The design of the trust management framework has been covered in earlier works and the current work focuses upon its application for the design of a novel security mechanism. Trust is computed based upon the forwarding behavior represented by acknowledgement reports submitted to the source node. The composition of the report ensures that the source node can verify its authenticity. Trust updates upon intermediate nodes are done by the source node at the end of a session which facilitates the secure route formation through the proposed mechanism. The efficiency and accuracy of the proposed security mechanism is validated using the network simulator ns2 and the experimental results show that the proposed mechanism outperforms the other schemes. General Terms Mobile Ad hoc Networks, Data Plane Security.

A model of data forwarding in MANETs for lightweight detection of malicious packet dropping

This work introduces a model of data forwarding in MANETs which is used for recognizing malicious packet dropping behaviors. First, different legitimate packet discard situations are modeled, such as those generated by collisions, channel errors or mobility related droppings. Second, we propose an anomaly-based IDS system based on an enhanced windowing method to carry out the collection and analysis of selected cross-layer features. Third, a real deployment of the IDS is also considered by suggesting a methodology for the collection of the selected features in a distributed manner. We evaluate our proposal in a simulation framework and the experimental results show a considerable enhancement in detection results when compared with other approaches in the literature. For instance, our scheme shows a 22% improvement in terms of true positives rate and a remarkable 83% improvement in terms of false positives rate when compared to previous well-known statistical solutions. Finally, it is notable the simplicity and lightweightness of the proposal.

Privacy-Preserving and Truthful Detection of Packet Dropping Attacks in Wireless Ad Hoc Networks

Link error and malicious packet dropping are two sources for packet losses in multi-hop wireless ad hoc network. In this paper, while observing a sequence of packet losses in the network, we are interested in determining whether the losses are caused by link errors only, or by the combined effect of link errors and malicious drop. We are especially interested in the insider-attack case, whereby malicious nodes that are part of the route exploit their knowledge of the communication context to selectively drop a small amount of packets critical to the network performance. Because the packet dropping rate in this case is comparable to the channel error rate, conventional algorithms that are based on detecting the packet loss rate cannot achieve satisfactory detection accuracy. To improve the detection accuracy, we propose to exploit the correlations between lost packets. Furthermore, to ensure truthful calculation of these correlations, we develop a homomorphic linear authenticator (HLA) based public auditing architecture that allows the detector to verify the truthfulness of the packet loss information reported by nodes. This construction is privacy preserving, collusion proof, and incurs low communication and storage overheads. To reduce the computation overhead of the baseline scheme, a packet-block-based mechanism is also proposed, which allows one to trade detection accuracy for lower computation complexity. Through extensive simulations, we verify that the proposed mechanisms achieve significantly better detection accuracy than conventional methods such as a maximum-likelihood based detection.

Investigating the effects of security attacks on the performance of TCP variants and routing protocols in MANET

In mobile ad hoc networks MANET, security attack due to malicious nodes can affect normal operation of routing protocols, performance of transmission control protocol TCP, and the network at large. This paper has investigated the effects of packet drop attack on the performance of TCP variants and routing protocols. Simulation was conducted by adding different percentage of malicious nodes in the network. Results have shown that from TCP variants, Vegas outperformed Newreno and SACK with 0% malicious nodes. However, as the percentage of malicious nodes added in the network increases from 5% to 50%, Newreno and SACK performed better than Vegas. Moreover, ad hoc on-demand AODV is more robust to packet drop attack than dynamic source routing DSR. Finally, we have proposed TCP-PLDR Packet Loss Detection and Response technique, which differentiate packet loss due to congestion or malicious packet drop attack. Experimental results have shown that TCP-PLDR performed better than TCP-SACK.

Watchdog: A Study on Examining and Eliminating Misbehaviour

ABSTARCTis a mechanism which is widely deployed for data monitoring in industrial, commercial and many other fields (like military etc.). Many of research have generally focused on making the network feasible and as useful as possible, but in the advent of this the security was given a very less priority and no attention was given to its security. These WSN networks face a wide variety of threats like the wormholes, grey hole attack, message tampering and selective forwarding etc. WSN are mainly attacked by the malicious packet drops. Now talking about the MANET (Mobile Ad hoc Networking) which is defined as the collection of wireless mobile nodes. MANET forms a network without using any of the infrastructures. The algorithm used to overcome this problem is the watchdog algorithm, but the watchdog algorithm has a partial drop problem, in this partial drop problem the attacker can manipulate the packet dropping rate below the threshold. Watchdog does not consider the traffic situations; these situations include congestion and collision. Through this article we have tried to eliminate the drawbacks of the watchdog algorithm. This paper proposes four theories for eliminating drawbacks of the watchdog.

An Extension to Secure Hybrid Routing Protocol to Combat Malicious Packet Dropping in a MANET

Communication in a Mobile ad hoc network is accomplished in a multi-hop fashion wherein the nodes themselves act as routers as well as source. MANET is vulnerable to a variety of insider as well as outsider attacks because of it’s inherent characteristics like dynamically changing topology, limited power and no centralized authority to monitor the behaviour of the nodes . Most of the secure routing protocols focus on the control plane attacks targeting the different elements of the routing protocol but data plane attacks are more difficult to handle for which we need to ensure secure data forwarding since certain adversarial nodes may launch a number of attacks on the data transmission by simply dropping the packets without forwarding them. The current paper is an extension to our earlier work where we addressed one of the most difficult data plane attacks namely, the packet dropping attack. In our earlier work, we had proposed a secure hybrid routing protocol which combats the packet dropping attack carried on by an individual / colluding adversaries and elaborated upon the first two phases of Secure Least Cost route establishment and Detection of individual node / colluding nodes maliciously dropping packets. Once a node has been identified as an adversary, we need to work upon the remedial action to prevent the future routes from involving adversarial nodes. In the current paper, we elaborate upon the last two phases namely: Punishing the adversarial nodes upon misbehaviour detection and Propagation of information about node misbehaviour and good behaviour. The current paper extends our earlier work by considering an additional colluding adversarial model consisting of consecutive nodes on the route from source to destination acting as colluding adversaries. Finally the protocol results in the establishment of a route including those nodes with good packet forwarding behaviour.