Misbehaving Nodes Research Articles

A statistical detection mechanism for node misbehaviours in wireless mesh networks

Wireless mesh networks (WMNs) have become an increasingly popular wireless networking technology for establishing the last-mile connectivity for home and neighbourhood networkings. In such networks, packet dropping may be due to either an attack, or normal loss events such as bad channel quality. Furthermore, in the route discovery phase, path stability is not always considered. We consider a special case of denial of service (DoS) attack in WMNs known as the greyhole attack. In this attack, a node selectively drops some packets which it has to forward along the path. To mitigate this attack, we propose a dropping detection mechanism allowing a mobile node to select a most reliable route to the destination. Our detection module detects misbehaving nodes by comparing the observed packet loss distribution of nodes to the expected ones when they are well-behaved. We validate the proposed approach via extensive simulations through R software and Matlab.

Intentional and unintentional misbehaving node detection and prevention in mobile ad hoc network

Intentional and unintentional misbehaving node detection and prevention in mobile ad hoc network

A Dummy Packet-Based Hybrid Security Framework for Mitigating Routing Misbehavior in Multi-Hop Wireless Networks

Wireless networks have emerged as a key enabling technology, expanding rapidly and offers numerous potential applications. The security issues have to be adequately addressed to realize the potential of multi-hop cooperative wireless network scenarios. The open nature of the wireless network is the opportunity for invaders launching various attacks with minimum effort owing to the multi-hop scenario of routing protocols. Routing protocols work based on the assumption that intermediate nodes are cooperating and well-behaving. Even in the presence of strong authentication mechanisms, detecting the continuous and selective packet dropping attack is a challenging process. This paper focuses on the design of a secure routing framework, and extend it to the routing protocols of various multi-hop wireless networks vulnerable to such attacks. The proposed hybrid security framework combats the routing misbehavior attacks in the presence of a wide range of malicious nodes. The proposed framework extends the hybrid security model adaptable to various multi-hop wireless networks with flexible routing overhead. The framework introduces a dummy packet based acknowledgment scheme that inserts dummy packets in the real payload traffic and masks the dummy traffic sequence through the dynamic traffic pattern. It optimizes the dummy packet generation based on the packet drop experienced and minimized the dummy traffic to balance the routing security and overhead. It confirms the presence of malicious nodes based on the dummy packet dropping and relies on the trust mechanism to eliminate the misbehaving nodes in the critical path. The use of subjective and fuzzy trust model validates the accuracy of uncertain evidence and contextual factors in the trust. The effectiveness of the framework is realized by applying it on various routing protocols in wireless networks. The performance evaluation confirms excellent packet delivery of the proposed hybrid framework over various networks in a highly vulnerable environment.

An efficient Intrusion Detection System against cyber-physical attacks in the smart grid

Without robust security mechanisms, the smart grid remains vulnerable to many attacks that can cause serious damages. Since state estimation is a critical entity to monitor and control electricity production and distribution, intruders are more attracted by this entity in order to disrupt the smart grid reliability. In this context, we propose an Intrusion Detection System (IDS) architecture to detect lethal attacks with a focus on two smart grid security issues: (i) Firstly, against integrity issue with price manipulation attack, we propose a Cumulative Sum (CUSUM) algorithm that detects this attack even with granular price changes; (ii) Secondly, the availability issue with Denial of Service (DoS) attack against which we develop an efficient method to monitor and detect any misbehaving node. Performance evaluations show the robustness of the proposed IDS system compared to existing mechanisms. The achieved detection rate is above 95% and the false positive rate is below 5%.

Secure routing in mobile Ad hoc networks: a predictive approach

In recent years, wireless technologies have gained enormous popularity and used vastly in a variety of applications. Mobile Ad hoc Networks (MANETs) are temporary networks which are built for specific purposes; they do not require any pre-established infrastructure. The dynamic nature of these networks makes them more utilizable in ubiquitous computing. These autonomous systems of wireless mobile nodes can be set up anywhere and anytime. However, due to high mobility, absence of centralized authority and open media nature, MANETs are more vulnerable to various security threats. As a result, they are prone to more security issues as compared to the traditional networks. Ad hoc networks are highly susceptible to various types of attacks. Sequence number attacks are such hazardous attacks which greatly diminish the performance of the network in different scenarios. Sequence number attacks suck some or all data packets and discard them. In past few years, various researchers proposed different solutions for detecting the sequence number attacks. In this paper, first we review notable works done by various researchers to detect sequence number attacks. The review thoroughly presents distinct aspects of the proposed approach. In addition, we propose a proactive predictive approach to mitigate sequence number attacks which discovers misbehaving nodes during route discovery phase. The proposed approach suggests modifications in Ad hoc on-demand distance vector (AODV) routing protocol.

Probability Model for Intrusion Detection System in Mobile Adhoc Network

Wireless technologies increasingly exist everywhere in advanced networks; however, this new innovation accompanies its own set of challenges. The nodes in the wireless network are characteristically ‘open’ and viewable by all network scanners. Networks are protected using many firewalls and encryption software’s. Firewalls restrict access between networks to prevent intrusion and do not indicate an attack within the network. An Intrusion Detection System (IDS) is required which monitors the network, detects misbehavior or anomalies and notifies other nodes in the network to avoid or punish the misbehaving nodes. In this paper, we propose a probability based IDS model that provides generalized solution to detect set of malicious nodes to improve the detection speed and accuracy.

Misbehavior detection of nodes in mobile ad-hoc networks using cluster overheads

In this paper we mainly discuss about the problem of identifying the misbehaving nodes in a multi hop ad-hoc network. Misbehaving nodes identification is done using co-operative incentive based approaches. We are considering a cluster based system for identifying misbehaving nodes in a network. A cluster overhead is selected in each cluster for communicating with other clusters. Proposed system is capable of detecting misbehaving nodes using the cluster formation and also the degradation of network lifetime is decreased when compared to the existing protocol. By selecting the cluster over-head we have marginally reduced the time-delay and packet loss ratio in (network simulator 2) simulation environment. Acknowledgement schemes are used to identify selective packet droppers.

Decision tree rule learning approach to counter burst header packet flooding attack in Optical Burst Switching network

An Optical Bust Switching (OBS) network is vulnerable to a range of issues. One of the most significant issues is Burst Header Packet (BHP) flooding attacks, which can negatively impact on the Quality of Service (QoS) and create more urgent issues such as Denial of Service (DoS). Existing techniques for countering BHP flood attacks usually display a low accuracy in detecting misbehaving nodes leading to BHP attacks. By contrast, Machine Learning (ML) is a widely adopted and powerful data analysis technique which has showed a high degree of predictive performance in multiple application domains due to its ability to discover beneficial knowledge for decision-making. This study investigates the use of predictive ML to counter the risk of BHP flooding attacks experienced in OBS networks, proposing a decision tree-based architecture as an appropriate solution. This contains a learning algorithm that extracts novel rules from tree models using data processed from several simulation runs. The results show that the rules derived from our learning algorithm will accurately classify 93% of the BHP flooding attacks into either Behaving (B) or Misbehaving (M) classes. Moreover, the rules can further classify the Misbehaving edge nodes into four sub-class labels with 87% accuracy, including: Misbehaving-Block (Block), Behaving-No Block (No Block), Misbehaving-No Block (M-No Block), and Misbehaving-Wait (M-Wait). The results clearly show that our proposed decision tree model is a viable solution compared to decisions undertaken by expert domains or human network administrators.

CERTIFICATE REVOCATION SCHEME BASED ON WEIGHTED VOTING GAME AND RATIONAL SECURE MULTIPARTY COMPUTING

The Mobile Adhoc Network consists of deployed mobile nodes which lead to the frequent changes in network topology. Due to topology changes, required infrastructure is unavailable for communication. Moreover, malicious nodes present in MANET make use of this modification and can easily launch highly vulnerable attacks on the routing path of the network. Hence, Security issue such as removing misbehaving nodes is the primary issue in MANET. Effective certificate revocation scheme was introduced to identify and eliminate the node with malicious activities in the network based on the weighted voting game (ECR-WVG) approach. In this approach, weights and quota were two factors, determined for an effective revocation of malicious nodes certificates. However, security during multiparty transmission was not taken into account in ECR-WVG. In Effective Certificate Revocation Scheme based on Weighted Voting Game and Rational Secure Multi-Party Computing (ECR-WVG-RSMPC) method, rational secret sharing scheme is introduced along with ECR-WVG approach for securing multiparty transmission. Performance evaluation can be done between ECR-WVG and ECR-WVG-RSMPC in terms of false revocation, malicious node revocation, normalized time for revocation and revocation accuracy ratio.

An Efficient DSR Protocol to Detect Blackhole Attacks in WMN Using Cross Layer Approach

Constructing an efficient and secured Wireless Mesh Network is a challenging issue due to its physical channel vulnerability and dynamic change of topology. In this network, attacks on network layer have vital significance since they may lead to disabling of larger scale network services. Secured Routing Protocol plays a major role in providing seamless network services. A Modified DSR protocol is proposed in this paper to overcome the blackhole attacks by detecting malicious nodes in the network. The proposed work computes the trust level of the path in the network layer by calculating the capability of the links. The link forwarding capability of the links is calculated at the link layer and node forwarding capability is calculated at network layer based on the behavior of the nodes. The nodes operate in the promiscuous mode to detect the misbehaving nodes. The performance of the modified DSR protocol is compared with DSR protocol and the simulation results show that the throughput and packet delivery ratio for the proposed work is better than DSR even in the presence of malicious nodes with minimal network overhead.

Real-Time Misbehavior Detection and Mitigation in Cyber-Physical Systems Over WLANs

In cyber-physical system (CPS) over IEEE 802.11e-based wireless local area networks (WLANs), a misbehaving node can gain significant advantage over other normal nodes in terms of resource sharing by deliberately manipulating its protocol parameters. Due to the random spectrum-access nature of the protocol, it is challenging to detect the misbehaving node accurately and in real-time. Moreover, many existing misbehavior detectors, primarily designed for traditional IEEE 802.11 networks, become inapplicable in IEEE 802.11e networks with heterogeneous network configurations. In this paper, we propose novel real-time and light-weight countermeasures including a hybrid-share misbehavior detector and a packet-dropping-based misbehavior mitigation mechanism for IEEE 802.11e-based CPS. We develop mathematical models for the performance of the proposed detector and mitigation mechanisms. Extensive simulation results show that the proposed mechanisms can achieve a high detection rate and punish a misbehaving node with a high packet dropping rate.

IBFWA: Integrated Bloom Filter in Watchdog Algorithm for hybrid black hole attack detection in MANET

ABSTRACTIn recent days, the Mobile Ad-hoc Network (MANET) has gained more attention and popularity due to its dynamic nature. However, it is highly vulnerable to attacks due to its wireless nature and lack of central authority. This affects the overall performance of the network. To solve this problem, the Watchdog protocol was developed for attack detection. However, if it receives a false report from a misbehaving node, it fails to detect the attack. To overcome this problem, the Integrated Bloom Filter with Watchdog Algorithm (IBFWA) is proposed in this article to avoid packet loss. Here, the Certificate Authority (CA) validates the node through the process of key generation. Then, it checks whether the node is normal or attacker; if it is a black hole node, it will be blocked and communication through this node is avoided. If a node is compromised and revoked as a normal node, it is added to the network and communication through the node is enabled. The experimental results evaluate the performance of the proposed attack detection system in terms of lower node outage, residual energy, end-to-end delay, high detection probability, throughput, packet transfer rate and packet delivery ratio.

Boycott based enhanced correction scheme for mac layer misbehavior in wireless networks

In IEEE 802.11 standard, the wireless LAN Medium Access Control (MAC) provides transmission fairness to nodes in a network, but some nodes that called misbehaving nodes (MNs) can take advantage and modify its MAC parameters to improve its own performance at the expense of other nodes (honest nodes HNs). Many solutions have been proposed to solve this problem, but most of these solutions are based on the assumption that MNs misbehave just one time. Therefor, in this paper, we propose a boycott based enhanced correction scheme for mac layer misbehavior in wireless networks to correct and react against MNs and increasing the HNs throughput.To correct these MNs, HNs collectively react and correct the MNs. When the misbehavior is detected for the first time, HNs react in an appropriate way by decreasing the throughput of MNs, but if MNs misbehave for the second time HNs start to react aggressively and consequently decrease MNs throughput dramatically. In the third misbehavior, HNs boycott the MNs and reject all messages that came from these nodes. Simulation result shows the efficiency of our proposed scheme to improve HNs throughput and boycott MNs.

An extended AODV routing protocol for secure MANETs based on node trust values

In MANETs, various QoS problems exist such as high error rates, handling node mobility, inefficient routing, power conservation, and limited processing capabilities of network devices. To obtain secure ad hoc routing, misbehaving or malicious nodes should be detected and isolated. Otherwise, the overall network performance will be decreased. The participating nodes should establish a network with an acceptable level of trust relationships among themselves. This problem is solved with the adoption of a trust management framework and by extending the conventional routing protocol. This paper proposes a new routing protocol (TRUST_AODV) that extends the AODV routing protocol by incorporating a trust algorithm that detects misbehaving nodes. For each node, the proposed algorithm computes the weighted trust by taking into account the packet delivery ratio, energy consumption rate and buffer length. TRUST_AODV secures the MANET against potential packet drop attacks and denial-of-service attacks. It also improves the network performance under heavy network load conditions. The simulation results demonstrate that it supports secure routing and optimised performance.

Trust aware cooperative optimised link state routing protocol

Optimised link state routing OLSR protocol is a popular proactive routing protocol for wireless ad-hoc networks WANETs. The functionality of OLSR protocol such as selection of multi-point relays, controlling the flooding of link state information and preparation of the routing table is depending upon the cooperation among the nodes in the network. However, open and decentralised network operations of WANETs introduce various security vulnerabilities to disrupt the routing process. To this end, this paper proposes a reputation-based trust model to enhance the cooperation among nodes in the routing process. The proposed trust model calculates the consolidate trust value CTV using direct and indirect observations. This CTV is used in the OLSR process to identify and isolate the misbehaving nodes from the routing path without having additional overhead. The simulation results show the effectiveness of the proposed method.

On-demand Misbehavior Detection for Vehicular Ad Hoc Network

Maintaining communication links of an established communication path that extends between source and destination nodes is a significant challenge in Vehicular Ad Hoc Networks due to movement of the vehicles. Operations of Vehicular Ad Hoc Network rely on the collaboration of participating nodes to route data for each other. A critical requirement on the nodes is to cooperate with each other for successful data transmission. Thus, the impact of malicious and selfish users must be detected to ensure the operations of Vehicular Ad Hoc Network. In this article, we proposed On-demand Misbehavior Detection technique for vehicle-to-vehicle communication. We adapt two location-based routing protocols, Contention-Based Forwarding and Connectionless Approach for Streets, to our On-demand Misbehavior Detection. Various experiments are conducted to show the effectiveness and efficiency of the proposed On-demand Misbehavior Detection technique. The simulation and analytical results showed that the proposed technique is very effective in detecting misbehaving nodes.

AMD: Audit-Based Misbehavior Detection in Wireless Ad Hoc Networks

We address the problem of identifying and isolating misbehaving nodes that refuse to forward packets in multi-hop ad hoc networks. We develop a comprehensive system called Audit-based Misbehavior Detection (AMD) that effectively and efficiently isolates both continuous and selective packet droppers. The AMD system integrates reputation management, trustworthy route discovery, and identification of misbehaving nodes based on behavioral audits. Compared to previous methods, AMD evaluates node behavior on a per-packet basis, without employing energy-expensive overhearing techniques or intensive acknowledgment schemes. Moreover, AMD can detect selective dropping attacks even if end-to-end traffic is encrypted and can be applied to multi-channel networks or networks consisting of nodes with directional antennas. We show via simulations that AMD successfully avoids misbehaving nodes, even when a large portion of the network refuses to forward packets.

Lightweight trust model for the detection of concealed malicious nodes in sparse wireless ad hoc networks

A sparse wireless sensor network for forest fire detection is considered. It is assumed that two types of malicious nodes can exist in this network. The malicious behaviors are assumed to be concealed through some statistical behavior. A lightweight centralized trust-based model is proposed to detect malicious or misbehaving nodes. We assume that all nodes contribute to this process through the gathering of statistical data related to communication with their neighbors. These data are periodically sent to a base station, where all trust functions are executed. A simulation model is built to evaluate system performance, and the results show that the proposed model is efficient in detecting all types of considered malicious nodes.

Designing an Algorithm to Improve the Trust and Reputation of the Gaussian in Wireless Sensor Networks

Background/Objectives: A wireless sensor network, from the large number of nodes (which may reach to thousands of nodes) has been formed. These nodes, each are called a sensor that can sense a special feature of the environment (temperature, humidity, pressure, etc.) and to send to its neighbours. Trust level algorithms are often based on conditions and criteria of current environment in a particular application of wireless sensor networks are defined. The ultimate goal of these algorithms is reach to a network, responding to functional and economic needs of operating environments in wireless sensor networks. Methodology: Each node from two sources is used to obtain trust values of its neighbouring nodes. At first obtained the known value of direct trust of intended node; next, of indirect trust that by the rest of the common node in the radio range of the two nodes is obtained. Then by combination of direct and indirect trust, a total trust value for each node is calculated. Findings: For simulation, the MATLAB software is used; the number of 30 nodes are at interval of 500500 meters randomly. A subnet of 5 nodes with node numbers of 10, 12, 15, 16 and 19 are examined to broadcast reports in specified time intervals. Neighbouring nodes view these reports and perform calculations and simulation continues for100 seconds. This simulation both for different scenarios such as: the presence of 5% misbehaving node in the neighbourhood, 10% misbehaving node in the neighbourhood, 20% of misbehaving node in the neighbourhood, being carried out. Applications/Improvements: Since the energy consumption is still low and scalability is also intermediate, according to this proposed method, it did not make changes in other parameters and by keeping them fixed increased the reliability. It is clear that the proposed method is more successful than other methods.

A Secure Routing Protocol with Trust and Energy Awareness for Wireless Sensor Network

Nodes in most of the deployments of Wireless Sensor Networks (WSNs) remain un-administered and exposed to variety of security attacks. Characterized by constrained resources and dynamically changing behavior of sensor nodes, reliable data delivery in WSNs is nontrivial. To counter node misbehavior attacks, traditional cryptographic and authentication based solutions have proved to be inappropriate due to high cost and incapability factors. Recently, trust based solutions have appeared to be viable solutions to address nodes' misbehavior attacks. However, the existing trust based solutions incur high cost in trust estimation and network-wide dissemination which significantly increases traffic congestion and undermines network lifetime. This paper presents a Trust and Energy aware Secure Routing Protocol (TESRP) for WSN that exploits a distributed trust model for discovering and isolating misbehaving nodes. TESRP employs a multi-facet routing strategy that takes into consideration the trust level, residual energy, and hop-counts of neighboring nodes while making routing decisions. This strategy not only ensures data dissemination via trusted nodes but also balances out energy consumption among trusted nodes while traversing through shorter paths. Demonstrated by simulation results in NS-2, TESRP achieves improved performance in terms of energy consumption, throughput and network lifetime as compared to existing solutions.