Network Layer Attacks Research Articles

Auto metric graph neural network optimized with woodpecker mating algorithm for detecting network layer attacks in mobile ad hoc networks

ABSTRACT Nowadays, Mobile Ad hoc Network (MANET) gains more attraction due to its seamless and dynamic use. The existing methods in MANET are plagued by some weaknesses, like higher computation time, undermining their real-time responsiveness. Whereas, lower accuracy in intrusion detection compromises the reliability of these systems, potentially leading to missed threats posing a challenge for effective security measures in dynamic MANET environments. To mitigate these weaknesses, an Auto Metric Graph Neural Network optimized with Woodpecker Mating Algorithm is proposed in this paper for detecting Network Layer Attack in MANET (AGNN-WMA-DNLA-MANET). Initially, the data are gathered from CIC-IDS 2019 dataset. The gathered data undergoes pre-processing to eliminate redundancy and missing values replacement using the Local Least Squares method. Afterward, the preprocessing output is fed to AGNN for classification, which classifies the attack as active, passive, or normal. Then, Woodpecker Mating Algorithm (WMA) is proposed to optimize the AGNN weight parameters to ensure the accurate classification. The proposed technique is executed in NS2 tool. The metrics, like accuracy, false positive rate (FPR) and attack detection rate (ADR), computation time, and RoC is analyzed. The proposed AGNN-WMA-DNLA-MANET approach provides 14.68%, 7.142%, and 4.65% higher accuracy for active attack, 15.19%, 2.77%, and 9.85% higher accuracy for passive attack and 38.18%, 12.02%, and 7.59% better accuracy for normal compared with existing methods, such as Dependable intrusion detection scheme under deep convolutional neural network (DCNN-MANET), deep learning-based intrusion detection scheme for MANET (AE-DNN-MANET), and Benchmarking of machine learning for anomaly based intrusion detection scheme (ML-MANET), respectively.

Methodology of intrusion detection of network layer attack for MANET

Methodology of intrusion detection of network layer attack for MANET

ProvLink-IoT: A novel provenance model for Link-Layer Forensics in IoT networks

Provenance has been instrumental in networked systems to solve issues related to data trustworthiness, network diagnostics, security, and forensic analysis. Existing provenance based solutions for the Internet of Things (IoT) are either device-centric or platform-centric, which address only application layer attacks. Whereas any stealthy attacks performed at MAC, network, and other sub-layers which alter the behavior of IoT devices often go undetected. Provenance based forensic solutions offer effective mechanisms for investigating link and network layer attacks in IoT networks. Realizing this potential, we propose ProvLink-IoT, a novel provenance model for link-layer forensic analysis in IoT networks. ProvLink-IoT employs PROV-DM and PROV-TEMPLATE standards to model the provenance of the network. Provenance graphs are generated under both benign and attack scenarios based on the provenance logs and network traffic collected from the network. ProvLink-IoT is implemented in a simulated environment with a case study on the 6TiSCH protocol stack. We implemented three link-layer attacks on TSCH and the 6top layers of the 6TiSCH network to study their impact and perform forensic analysis. Link-IoT, a comprehensive link-layer dataset, is generated from the network provenance, which can be used in the further incident and forensic analysis. The performance impact of ProvLink-IoT on IoT network is analyzed in terms of provenance growth rate and storage overhead. Experimental results showed the efficacy of the proposed solution in correlating evidence during incident analysis and its relevance to real-time scenarios.

Packet Inspection to Identify Network Layer Attacks Using Machine Learning

Abstract: With the advent of technology, computer networks have become an integral part of our lives. However, with the increase in the use of computer networks, network attacks have also increased. Network attacks can cause serious harm to network infrastructure, resulting in loss of data, financial loss, and reputation damage. In this paper, we propose a machine learning algorithm to analyze network packets to detect malicious activities that are aimed at disrupting the normal functioning of a network. Network layer attacks typically target the underlying infrastructure of a network, which includes the IP layer, transport layer, and network access layer. These attacks can cause various problems such as denial of service, data theft, and network downtime. To detect network layer attacks, the proposed approach involves extracting features from network packets. Features refer to the attributes or characteristics of a packet, such as the source and destination IP addresses, protocol type, payload size, etc. These features are then used to train a machine learning model to identify various network layer attacks such as DDoS, ARP spoofing, and ICMP attacks. The machine learning model uses these features to learn the patterns and behaviours of these attacks and uses this knowledge to detect them in real-time. The proposed approach is evaluated using various metrics such as accuracy, precision, recall, and F1-score. The evaluation results demonstrate that the proposed approach is effective in detecting network layer attacks and outperforms existing approaches. The proposed approach can be used to enhance network security and prevent network attacks.

A Novel Method of Enhancing Security Solutions and Energy Efficiency of IoT Protocols

Mobile Ad-hoc Networks (MANET’s) are wireless networks that are capable of operating without any fixed infrastructure. MANET routing protocols must adhere to strict secrecy, integrity, availability and non-repudiation criteria. In MANETs, attacks are roughly categorised into two types: active and passive. An active attack attempts to modify or remove data being transferred across a network. On the other hand, passive attack does not modify or erase the data being sent over the network. The majority of routing protocols for MANETs were built with little regard for security and are therefore susceptible to a variety of assaults. Routing technologies such as AODV and dynamic source routing are quite common. Both however are susceptible to a variety of network layer attacks, including black holes, wormholes, rushing, byzantine, information disclosure. The mobility of the nodes and the open architecture in which the nodes are free to join or leave the network keep changing the topology of the network. The routing in such scenarios becomes a challenging task since it has to take into account the constraints of resources of mobile devices. In this an analysis of these protocols indicates that, though proactive routing protocols maintain a route to every destination and have low latency, they suffer from high routing overheads and inability to keep up with the dynamic topology in a large sized network. The reactive routing protocols in contrast have low routing overheads, better throughput and higher packet delivery ratio. AODVACO-PSO-DHKE Methodology boosts throughput by 10% while reducing routing overhead by 7%, latency by 8% and energy consumption by 5%. To avoid nodes always being on, a duty cycle procedure that's also paired with the hybrid method is used ACO-FDR PSO is applied to a 100-node network and NS-3 is used to measure various metrics such as throughput, latency, overhead, energy consumption and packet delivery ratio.

A Novel Method of Enhancing Security Solutions and Energy Efficiency of IoT Protocols

Mobile Ad-hoc Networks (MANET’s) are wireless networks that are capable of operating without any fixed infrastructure. MANET routing protocols must adhere to strict secrecy, integrity, availability and non-repudiation criteria. In MANETs, attacks are roughly categorised into two types: active and passive. An active attack attempts to modify or remove data being transferred across a network. On the other hand, passive attack does not modify or erase the data being sent over the network. The majority of routing protocols for MANETs were built with little regard for security and are therefore susceptible to a variety of assaults. Routing technologies such as AODV and dynamic source routing are quite common. Both however are susceptible to a variety of network layer attacks, including black holes, wormholes, rushing, byzantine, information disclosure. The mobility of the nodes and the open architecture in which the nodes are free to join or leave the network keep changing the topology of the network. The routing in such scenarios becomes a challenging task since it has to take into account the constraints of resources of mobile devices. In this an analysis of these protocols indicates that, though proactive routing protocols maintain a route to every destination and have low latency, they suffer from high routing overheads and inability to keep up with the dynamic topology in a large sized network. The reactive routing protocols in contrast have low routing overheads, better throughput and higher packet delivery ratio. AODVACO-PSO-DHKE Methodology boosts throughput by 10% while reducing routing overhead by 7%, latency by 8% and energy consumption by 5%. To avoid nodes always being on, a duty cycle procedure that's also paired with the hybrid method is used ACO-FDR PSO is applied to a 100-node network and NS-3 is used to measure various metrics such as throughput, latency, overhead, energy consumption and packet delivery ratio.

Detection of Network Layer Attacks in Wireless Sensor Network

The Wireless Sensor Network (WSN) technology is being used in a huge number of monitoring applications. It consists of a large number of sensor nodes with limited battery life. These sensor devices are deployed randomly in a sensor zone to collect the data. But these are threatened and attacked by several malicious behaviors caused by some nodes, which result in security attacks. Several security attacks occur in different layers of the wireless sensor network. Due to these attacks, confidential information can be stolen by attackers or unauthorized users, which can cause several problems for authorized users. Cyber-attacks by sending large data packets that deplete computer network service resources by using multiple computers when attacking are called wormhole and Sybil attacks. It is important to identify these attacks to prevent further damage. To overcome these problems, we use a prediction module that consists of various machine learning algorithms to find the best-performing algorithm. we use XGBoost, Adaboost, Random Forest, and KNN algorithms. To train these algorithms, we have used the WHASA dataset which contains 10 different attacks of the VANET environment and benign (normal) class. By using these algorithms classification of attacks can be done which occur on the computer network service that is " normal " access or access under " attack " by Wormhole and Sybil attack as an output.

QSec-RPL: Detection of version number attacks in RPL based mobile IoT using Q-Learning

Internet of Things (IoT) has revolutionized the networking by connecting the real world entities to the Internet. IoT connects the communication devices and has an incredible impact on perspective analytics on the massive volume of data produced every day. An attacker may exploit vulnerabilities of IoT entities and compromise users’ security and privacy. Development of solutions to address security and privacy issues of IoT is in premature stage and considered as challenge. This challenge becomes more critical when the devices in the network are resource-constrained in terms of energy, processing and memory. The IPv6 over Low-Power Wireless Personal Area Networks (6LoWPAN) has emerged in recent years as an adaptation layer to carry IPv6 packets over IEEE 802.15.4. Many IoT applications use Routing Protocol for Low Power and Lossy Networks (RPL) as a network layer protocol developed for routing in 6LoWPAN. Security is challenging in resource constrained environment where encryption may not be a viable solution. Version number attack is one of the most common network layer attacks against RPL based 6LoWPAN. The RPL specification does not address the integrity of the version number and therefore leaves version number mechanism as a weak point in terms of security. This paper investigates the impact of version number attack in RPL networks while considering mobility of the sensor nodes. We propose a solution that utilizes Q-Learning strategy to detect the malicious nodes that are performing version number attack. The proposed approach detects malicious nodes with reasonable accuracy while imposing significantly less overhead on the nodes of low power and lossy networks. There are other approaches too like Message Authentication Codes (MAC) based on symmetric keys but these techniques have memory and communication overhead. So we propose different approach Q-Learning to detect the attacker nodes.

An optimised QoS-based clustering with multipath secure routing protocol for wireless sensor networks

Recent advances in wireless technology with networking capabilities have generated a lot of interest to design secure routing protocol for wireless sensor networks (WSNs). Generally, residual energy of sensors in sink coverage area is drained very quickly compared to other area nodes in WSNs. The proposed optimised QoS-based clustering with multipath secure routing protocol (OQoS-CMSRP) for WSNs reduces the energy consumption in sink coverage area and solving hot spot problem. The proposed protocol is used to find near optimal multi-hop communication path from sink to sensors for selecting the next hop neighbour nodes. An enhanced (k, n)-threshold secret sharing scheme is required to make n shares and recover the secret by using k shares based on Hermite's interpolating polynomial. The proposed protocol is to provide end-to-end security from different network layer attacks and to provide an efficient service for transmitting data in secure and reliable manner.

Analytical modeling of attacks in wireless sensor networks for attack detection

The article comprises issues of analytical modeling of attacks in wireless sensor networks. A proposed attack model specifies possible types of unauthorized influences at the network level aimed at compromising network nodes, data transmitted over the network, and information services provided by the wireless sensor network. A developed graph-based analytical model of a wireless sensor network aims at detecting network layer attacks by processing actual events received from network nodes and deciding whether the network is running under an attack. The correctness of the models is confirmed by their testing by using an example of a scenario for detecting a wormhole attack aimed at disrupting routing processes in a wireless sensor network.

Cyber Secured Internet of Things-Enabled Additive Manufacturing: Industry 4.0 Perspective

The multitude of nodes, sensors and other devices in internet of things enables manufacturing systems to create security challenges for engineers and researchers. In particular, the nodes’ mobility, the mobile robots in the internet of things-based nodes increase the vulnerability of the device and sensors in the manufacturing network. In this paper, the encryption scheme is implemented to secure an internet of things-based additive manufacturing nodes against the network layer attack. To this end, the paper considers the black hole attack as a network layer attack and modifies the routing protocol to mitigate the black hole attack. The RSA encryption technique is used to encrypt and decrypt the routing messages between the manufacturing nodes using the public and private keys. The public key is used for encrypting the route request messages from manufacturing nodes while the private key is utilized for decrypting the messages at the receiver node. The proposed scheme is simulated using network simulator NS-2 and its performances are compared.

Performance Analysis of Machine Learning-based Detection of Sinkhole Network Layer Attack in MANET

This paper proposes an Intrusion Detection System (IDS) against Sinkhole attacks in Mobile Adhoc Networks (MANET) with mobile sinks. A sinkhole attack is where a hacked node advertises a false routing update to draw network traffic. One effect of a sinkhole attack is that it may be used to launch further attacks, such as drops or changed routing information. Sinkhole nodes attempt to forge the source–destination routes to attract the surrounding network traffic. For this purpose, they modify routing control packets to publish fake routing information that makes sinkhole nodes appear as the best path to some destinations. Several machine learning techniques, including Decision Tree (DT), K-Nearest Neighbor (KNN), Convolution neural network (CNN), and Support Vector Machine (SVM), are used to do the categorization. Furthermore, the MANET’s node’s characteristics, particularly speed, are used for feature extraction. Totally 3997 unique samples, including 256 malicious samples and 3604 normal samples are collected. The categorization results demonstrate the accuracy of DT, KNN, CNN, and SVM at 98.4%, 96.7%, 98.6%, and 97.8%, respectively. The CNN approach is more accurate than other methods, at 98.6%, based on the data. After that, Priority, SVM, KNN, and CNN, in that order, each denotes excellent accuracy.

A Survey on Layer-Wise Security Attacks in IoT: Attacks, Countermeasures, and Open-Issues

Security is a mandatory issue in any network, where sensitive data are transferred safely in the required direction. Wireless sensor networks (WSNs) are the networks formed in hostile areas for different applications. Whatever the application, the WSNs must gather a large amount of sensitive data and send them to an authorized body, generally a sink. WSN has integrated with Internet-of-Things (IoT) via internet access in sensor nodes along with internet-connected devices. The data gathered with IoT are enormous, which are eventually collected by WSN over the Internet. Due to several resource constraints, it is challenging to design a secure sensor network, and for a secure IoT it is essential to have a secure WSN. Most of the traditional security techniques do not work well for WSN. The merger of IoT and WSN has opened new challenges in designing a secure network. In this paper, we have discussed the challenges of creating a secure WSN. This research reviews the layer-wise security protocols for WSN and IoT in the literature. There are several issues and challenges for a secure WSN and IoT, which we have addressed in this research. This research pinpoints the new research opportunities in the security issues of both WSN and IoT. This survey climaxes in abstruse psychoanalysis of the network layer attacks. Finally, various attacks on the network using Cooja, a simulator of ContikiOS, are simulated.

Network Attack Classification in IoT Using Support Vector Machines

Machine learning (ML) techniques learn a system by observing it. Events and occurrences in the network define what is expected of the network’s operation. It is for this reason that ML techniques are used in the computer network security field to detect unauthorized intervention. In the event of suspicious activity, the result of the ML analysis deviates from the definition of expected normal network activity and the suspicious activity becomes apparent. Support vector machines (SVM) are ML techniques that have been used to profile normal network activity and classify it as normal or abnormal. They are trained to configure an optimal hyperplane that classifies unknown input vectors’ values based on their positioning on the plane. We propose to use SVM models to detect malicious behavior within low-power, low-rate and short range networks, such as those used in the Internet of Things (IoT). We evaluated two SVM approaches, the C-SVM and the OC-SVM, where the former requires two classes of vector values (one for the normal and one for the abnormal activity) and the latter observes only normal behavior activity. Both approaches were used as part of an intrusion detection system (IDS) that monitors and detects abnormal activity within the smart node device. Actual network traffic with specific network-layer attacks implemented by us was used to create and evaluate the SVM detection models. It is shown that the C-SVM achieves up to 100% classification accuracy when evaluated with unknown data taken from the same network topology it was trained with and 81% accuracy when operating in an unknown topology. The OC-SVM that is created using benign activity achieves at most 58% accuracy.

Level Based Rank Attack Detection Technique (LEACE)

Internet of Things (IoT) prevails in the technological world among various technologies. The creation of IoT brings about a renaissance in the smart connected world. The security issues in IoT have risen alarmingly in recent years. These security issues are inalienable in IoT network. Particularly, attacks in IoT network layer exploit the entire IoT system. The most common attack which makes a big impacts on RPL based IoT network is rank attack. The impacts of rank attack could be reduced by providing efficient technique to identify and mitigate the rank attack. In this paper, a technique “LEACE” is proposed to identify and mitigate rank attack based on the level of the nodes in the network. Rank and level of the nodes are corresponded in the IoT system. For identifying rank attack, the level and rank of the nodes are checked whether the nodes’ rank are corresponded with their level. The proposed technique outperforms the VeRa technique. It provides better results than the VeRa in terms of packet delivery ratio, detection accuracy and throughput.

A Review on Network Layer Attacks in Wireless Sensor Networks

International Journal of Computer Sciences and Engineering (A UGC Approved and indexed with DOI, ICI and Approved, DPI Digital Library) is one of the leading and growing open access, peer-reviewed, monthly, and scientific research journal for scientists, engineers, research scholars, and academicians, which gains a foothold in Asia and opens to the world, aims to publish original, theoretical and practical advances in Computer Science,Information Technology, Engineering (Software, Mechanical, Civil, Electronics & Electrical), and all interdisciplinary streams of Computing Sciences. It intends to disseminate original, scientific, theoretical or applied research in the field of Computer Sciences and allied fields. It provides a platform for publishing results and research with a strong empirical component. It aims to bridge the significant gap between research and practice by promoting the publication of original, novel, industry-relevant research.

Optimal Multilevel Link Extend Umpiring Routing Based Secure Routing Protocol for Improving Privacy Standard in Wireless Sensor Networks

Generally wireless sensor networks (WSN) are connected via a wireless medium to form a large amount of cooperative sensor nodes. Monitoring control is an important aspect of monitoring users in monitoring applications, such as wireless sensor networks, because of security. There are countless applications to pay for themselves but at the same time, their special properties offer a number of challenges, such as security and surveillance, control, and operation and complex system maintenance. WSN has already seen it on the Internet, from face-to-face security attacks. To propose an Optimal Multilevel Link extend umpiring routing (OML-EUR) based secure routing protocol for improving privacy standard in wireless sensor networks. Secure communication is also important in providing accurate and resource constraints at the sensor node at the moment. In this study, there are three of our contributions. Initially it monitors the neighbor network layer attacks for browsing the WSN on the transmission medium. Followed subscription a link establishment to monitoring the request packets through key transmission of WSN with secure routing protocols. By finding the secure communication as qualities of service verification among the modes to authenticate to transfer. The proposed system produce high secure performance by the result proves energy consumption and communication overhead as higher efficient than previous system.

Probabilistic Hardware Trojan Attacks on Multiple Layers of Reconfigurable Network Infrastructure

Over the past decades, there has been an exponential growth in the number of connected devices, often without well-thought out security mechanisms in place for the relevant network standards and protocols. As a result, security loopholes have been discovered and widely exploited for these vulnerable connected devices, often with devastating consequences. As a countermeasure to these attacks, subsequently some of these original network standards have been enhanced with addition of security features, e.g., the original insecure Ethernet protocol (IEEE 802.3) was supplemented by the IEEE 802.1AE Media Access Control Security (MACSec) standard. In this paper, we present a network packet redirection attack on reconfigurable network devices, specifically a MACSec-enabled NetFPGA-SUME based Ethernet switch, as well as on a NetFPGA-SUME based IPv4 router, by means of Hardware Trojan (HT) insertion. Our HT design is probabilistic in its functionality, with multi-level trigger mechanism. In the MAC layer attack, an activated HT redirects a frame to an incorrect port leading to possible eavesdropping by a malicious attacker as well as denial-of-service, while in the network layer attack, upon activation it forwards all IP packets through a sub-optimal router port causing a denial-of-service attack on the receiver. The proposed HT evades most state-of-the-art HT detection schemes, while having very low resource footprint. We present the complete architecture, detailed description of the mode of operation, and implementation of the HT, with promising experimental results.

ANALYSIS OF BLACK HOLE ATTACK DURING ROUTE DISCOVERY PHASE OF AODV IN MANET

MANET (Mobile ad hoc networks) is a collection of wireless mobile nodes dynamically forming an infrastructure less network. Several routing protocols are designed for routing of packets in MANET. One of them is AODV (Ad hoc on demand Distance Vector) protocol whose performance is better for higher mobile nodes. It is more vulnerable to black hole attack by the malicious node. Black hole attack is a network layer attack in MANET that tries to hamper the routing process. During route discovery phase it sends false reply to the nodes and dropped data packets. In this paper, first we have implemented black hole attack in AODV and then analyzed the impact of black hole attack under deferent metrics like throughput, packet delivery ratio and packet loss. Simulator NS-2.35 is used for implementation and result analysis.

Beeware Routing Scheme for Detecting Network Layer Attacks in Wireless Sensor Networks

In wireless sensor networks identifying the optimal path is a complex task, it requires some effective routing schemes to handle the issues in networks. To provide such environment for carrying effective routing for data forwarding is nightmare for the traditional methods. In this paper, we propose a bio inspired based secure routing scheme with the help of bee algorithms. The proposed routing mechanism consists of two important metrics known as primary scout bee and secondary scout bee for carrying routing and security mechanism. It provides better data efficiency with security in many scenarios. Here we use three kinds of routing attacks, to evaluate the proposed scheme such as flood attack, spoof attack and Sybil attack. The final verdict of adopting this technique is to derive a secure routing path for carrying the message in WSN environment. The simulation result shows that, the proposed Beeware routing scheme provides a better result compared to other mechanism.