Node Attacks Research Articles

Securing AMI-IoT networks against multiple RPL attacks using ensemble learning IDS and light-chain based prediction detection and mitigation mechanisms

ABSTRACT Advanced Metering Infrastructure (AMI) is one of the Internet of Things (IoT) enabled smart applications of smart grids. The Routing Protocol for Low Power and Lossy network (RPL) has been accepted to facilitate effective routing services for the AMI. However, numerous RPL attacks appear in AMI due to resource scarcity and dubious wireless medium, which significantly impedes the successful deployment of AMI-RPL. To enable secure and reliable AMI-RPL, this work proposes a novel Intrusion Detection System (IDS) named AMI Attack-aware Intelligent Machine learning IDS (AIMS). The primary objectives of AIMS are to predict, detect, and mitigate different types of RPL security attacks in the AMI environment. To predict the RPL attacks using the Stacked Ensemble (SE) machine learning model, a novel AMI-RPL Attack Dataset (ARAD) is generated by the Cooja simulator with the suitable pre-processing and the Spider Monkey Optimization (SMO) based feature selection. The advanced prediction of attack nodes improves the performance and significantly diminishes the future damages of AMI. The attack detection is based on immutable blocks of a light-chain model, and the cryptocurrency-based mitigation model effectively isolates the attackers. AIMS mechanism amplifies RPL security with high reliability and maximizes the AMI network lifetime by delivering superior results.

Outlier detection based energy efficient and reliable routing protocol using deep learning algorithm

AbstractWireless sensor network have also played a vital role in the observation and management of agricultural land in terms of climate, water usage, crops, etc. Due to the open communication system and low battery power of sensors, the agricultural sector still faces issues with energy consumption, information forwarding, and privacy. Thus, an energy‐efficient routing during transmission in WSN‐based smart agriculture is suggested in this study applying a feed‐forward neural network to detect outliers. Outlier identification, CH‐selection, and Relay Node (RN) selection are the three phases of this suggested method. Outlier detection is performed in the deployed nodes for categorises attack nodes from the normal nodes. CH‐selection is performed using a chaotic moth‐flame optimization technique according to distance, node degree, centrality factor and residual energy level, these parameters determine which node will become a Cluster Head. Then reliable routing protocol is designed using NB‐based probability method for RN selection. MATLAB software is used to test the proposed Outlier Detection based Energy Efficient and Reliable Routing Protocol and verify its performance. The effectiveness of the proposed‐model is tested with some prior wireless sensor network routing protocols environment‐fusion multipath routing protocol, dynamic Multi‐hop Energy Efficient Routing Protocol, SEMantic CLustering, and Reliable and energy efficient routing protocol. Outlier Detection based Energy Efficient and Reliable Routing Protocol algorithm attained a 0.91 (%)Packet Delivery ratio, 0.08% of packet loss, 0.91% of Average residual energy, 2.8 (Mbps) throughput, and 26 (sec) Delay.

SDAA: Secure Data Aggregation and Authentication Using Multiple Sinks in Cluster-Based Underwater Vehicular Wireless Sensor Network.

Security is one of the major concerns while designing robust protocols for underwater sensor networks (UWSNs). The underwater sensor node (USN) is an example of medium access control (MAC) that should control underwater UWSN, and underwater vehicles (UV) combined. Therefore, our proposed method, in this research, investigates UWSN combined with UV optimized as an underwater vehicular wireless network (UVWSN) that can completely detect malicious node attacks (MNA) from the network. Thus, MNA that engages the USN channel and launches MNA is resolved by our proposed protocol through SDAA (secure data aggregation and authentication) protocol deployed in UVWSN. SDAA protocol plays a significant role in secure data communication, as the cluster-based network design (CBND) network organization creates a concise, stable, and energy-efficient network. This paper introduces SDAA optimized network known as UVWSN. In this proposed SDAA protocol, the cluster head (CH) is authenticated through the gateway (GW) and the base station (BS) to guarantee that a legitimate USN oversees all clusters deployed in the UVWSN are securely established for providing trustworthiness/privacy. Furthermore, the communicated data in the UVWSN network guarantee that data transmission is secure due to the optimized SDAA models in the network. Thus, the USNs deployed in the UVWSN are securely confirmed to maintain secure data communication in CBND for energy efficiency. The proposed method is implemented and validated on the UVWSN for measuring reliability, delay, and energy efficiency in the network. The proposed method is utilized for monitoring scenarios for inspecting vehicles or ship structures in the ocean. Based on the testing results, the proposed SDAA protocol methods improve energy efficiency and reduce network delay compared to other standard secure MAC methods.

The comparison of Chinese and Australian aviation networks under the most important node attacks

Air traffic plays an important role in the economy and daily life both in developing and developed countries, The shutdown of the crucial airport will lead to large financial losses. In this study, the data have been collected from Openflight.org with information of flights and routes. Then the characteristics of the Chinese aviation network and Australian aviation network have been computed. The results indicate that the Chinese aviation network and Australian aviation network are both scale-free networks of power-law degree distribution with long-tail attributes. Then, the centrality analysis of the top 10 airports in the Chinese aviation network and Australian aviation network have been assessed, such as betweenness centrality analysis and closeness centrality analysis. Lastly, the study looks into how the characteristics of the Chinese and American aviation networks have changed as a result of node attacks and offers helpful advice for both the Chinese and Australian aviation networks after the most important node attacks.

A multipath routing protocol for secure energy efficient communication in Wireless Sensor Networks

A Wireless Sensor Network (WSN) is comprised of a number of sensor nodes (SNs) that are randomly placed in an open, harsh environment for many applications. Due to the resource-constrained nature of SNs and hostile deployment environments, energy efficiency and security are considered two key factors in designing WSN routing protocols. This paper proposes an Energy Efficient Secure Multipath (EESM) routing protocol to securely construct efficient routes and transmit data packets between SNs and the base station (BS). EESM achieves energy efficiency through minimal task allocation among SNs whereas all computation-intensive tasks such as network information collection, routing table generation, and network maintenance are performed by the BS. The proposed protocol incorporates lightweight security mechanisms including a one-way hash chain, message authentication code, encryption, and clique-based coordinator selection and monitoring schemes to defend against numerous security attacks. Simulation results show that EESM can successfully detect and protect the network against various security attacks such as replay attacks, sybil attacks, sinkhole attacks, spoofing attacks, compromised node attacks, and so on. In terms of energy efficiency, the proposed protocol achieves an up to 37% increase in network lifetime and a 6% increase in throughput over Secure and Energy Efficient Multipath (SEEM) routing, Secure and Reliable Multipath Routing (SRMR), and Reliable and Multipath Encounter Routing (RMER) protocols. The paper implements the protocol in a real environment using Arduino motes to analyze security overheads and network setup time.

A secure lightweight fuzzy embedder based user authentication scheme for internet of medical things applications

The Internet of Medical Things (IoMT) is a network of medical devices, hardware infrastructure, and software that allows healthcare information technology to be communicated over the web. The IoMT sensors communicate medical data to server for the quick diagnosis. As, it handles private and confidential information of a user, security is the primary objective. The existing IoT authentication schemes either using two-factor(Username, password) or multi-factor (username, password, biometric) to authenticate a user. Typically the structural characteristics-based biometric trait like Face, Iris, Palm print or finger print is used as a additional factor. There are chances that these biometrics can be fabricated. Thus, these structural biometrics based authentication schemes are fail to provide privacy, security, authenticity, and integrity. The biodynamic-based bioacoustics signals are gained attention in the era of human-computer interactions to authenticate a user as it is a unique feature to each user. So, we use a frequency domain based bio-acoustics as a biometric input. Thus, this work propose a Secure Lightweight Bioacoustics based User Authentication Scheme using fuzzy embedder for the Internet of Medical Things applications. Also, the IoT sensors tends to join and leave the network dynamically, the proposed scheme adopts chinese remainder technique for generate a group secret key to protect the network from the attacks of former sensor nodes. The proposed scheme’s security is validated using the formal verification tool AVISPA(Automated Validation of Internet Security Protocols and Applications). The system’s performance is measured by comparing the proposed scheme to existing systems in terms of security features, computation and communication costs. It demonstrates that the proposed system outperforms existing systems.

Searching High-value Edges Attack sequence through deep Reinforcement learning

It is of great significance to search high-value attack sequence in complex networks, which help us easily destroy the harmful network such as crime network. Most research focuses on searching high-value nodes attack sequence, while the edge is more fragile and difficult to defend. In this paper, we deem the attacking process as a Markov process, and design a framework SHEAR (Searching High-value Edges Attack sequence through deep Reinforcement learning). During training, in the encoding module, considering that the edges are numerous and more difficult to measure, Graph neural network (GNN) is applied to automatically obtain the node embedding, and then, according to the mechanism of edge connection in the network, we propose and verify a mapping function: Hadamard, which can enlarge the similar dimensions between nodes and reduce the different dimensions between nodes, so as to retain more network information. Then the edge vector and network vector are used as the input of deep reinforcement learning (DRL). In the decoding module, we approximate the state–action value function with Q network. SHEAR can be trained on the same type of small networks and then the same model can be migrated to a wide variety of scenarios with extraordinary performance and fast speed. Compared with the best results obtained by the other four classical methods, in scenarios where attack cost is not considered, the performance of SHEAR can be improved by 33.52% in synthetic networks and 30.74% in real networks. In scenarios where removal costs are equal to edge betweenness value, SHEAR can be improved by 56.53% in synthetic networks and 38.93% in real networks. For networks with random edge weights, SHEAR can be improved by 53.87% in synthetic networks and 29.30% in real networks. In addition, we conducted further experiments to evaluate the impact of the use of graph neural networks and reinforcement learning on model performance, and found that improvements in graph representation capabilities and decision-making capabilities lead to better model performance.

Optimized deep neural network based DDoS attack detection and bait mitigation process in software defined network

SummaryThe software‐defined network (SDN) is a new network design with an operating system that allows better network quality control. The controller's primary role in an SDN network is to divide the control and forwarding planes in order to provide essential network power. The backup controller in an SDN may confront a variety of obstacles during a DDoS attack. It disrupts the flow of the network by attacking the service nodes hence obstructing the legitimate users from getting service. To overcome these issues, this work introduces a DDoS attack detection model that will aid in removing the attacker from the network. Initially, the input data is sent into the detection phase, which identifies the existence and kind of attacks. The presence of an attack is determined based on the data flow, and statistical features. With the reference of the extracted features, the optimized deep neural network (DNN) will decide the existence of attacker in the network. To make the decision more precise, the training of DNN will be carried out by self‐improved moth flame optimization (SIMFO) Algorithm via tuning the optimal weights. Once an attacker's presence has been identified, it is critical to remove the attacker's node from the network.

Analyzing the Impact of Active Attack on the Performance of the AMCTD Protocol in Underwater Wireless Sensor Networks.

The exponentially growing concern of cyber-attacks on extremely dense underwater sensor networks (UWSNs) and the evolution of UWSNs digital threat landscape has brought novel research challenges and issues. Primarily, varied protocol evaluation under advanced persistent threats is now becoming indispensable yet very challenging. This research implements an active attack in the Adaptive Mobility of Courier Nodes in Threshold-optimized Depth-based Routing (AMCTD) protocol. A variety of attacker nodes were employed in diverse scenarios to thoroughly assess the performance of AMCTD protocol. The protocol was exhaustively evaluated both with and without active attacks with benchmark evaluation metrics such as end-to-end delay, throughput, transmission loss, number of active nodes and energy tax. The preliminary research findings show that active attack drastically lowers the AMCTD protocol's performance (i.e., active attack reduces the number of active nodes by up to 10%, reduces throughput by up to 6%, increases transmission loss by 7%, raises energy tax by 25%, and increases end-to-end delay by 20%).

The under-loading cascading failure model: a tool for assessing the vulnerability of SME cooperation networks

PurposeThe behavior of the entities in a small and medium-sized enterprise (SME) cooperation network is influenced by the core enterprise. Addressing the problem of how the network vulnerability changes when the core enterprise is attacked is a challenging topic. The purpose of this paper is to reveal the failure process of SME cooperation networks caused by the failure of the core SME from the perspective of cascading failure.Design/methodology/approachAccording to the Torch High Technology Industry Development Center, Ministry of Science & Technology in China, 296 SMEs in Jiangsu province were used to construct an SME cooperation network of technology-based SMEs and an under-loading cascading failure model. The weight-based attack strategy was selected to mimic a deliberate node attack and was used to analyze the vulnerability of the SME cooperation network.FindingsSome important conclusions are obtained from the simulation analysis: (1) The minimum boundary of node enterprises has a negative relationship with networks' invulnerability, while the breakdown probability has an inverted-U relationship with networks' invulnerability. (2) The combined effect of minimum boundary and breakdown probability indicates that the vulnerability of networks is mainly determined by the breakdown probability; while, minimum boundary helps prevent cascading failure occur. Furthermore, according to the case study, adapting capital needs and resilience in the cooperation network is the core problem in improving the robustness of SME cooperation networks.Originality/valueThis research proposed an under-loading cascading failure model to investigate the under-loading failure process caused by the shortage of resources when the core enterprise fails or withdraws from the SME cooperation network. Two key parameters in the proposed model—minimum capacity and breakdown probability—could serve as a guide for research on the vulnerability of SME cooperation networks. Additionally, practical meanings for each parameter in the proposed model are given, to suggest novel insights regarding network protection to facilitate the robustness and vulnerability in real SME cooperation networks.

A Lightweight Anomaly Detection System for Black Hole Attack

Mobile ad hoc networks (MANETs) are now key in today’s new world. They are critically needed in many situations when it is crucial to form a network on the fly while not having the luxury of time or resources to configure devices, build infrastructure, or even have human interventions. Ad hoc networks have many applications. For instance, they can be used in battlefields, education, rescue missions, and many other applications. Such networks are characterized by high mobility, low resources of power, storage, and processing. They are infrastructure-less; this means that they don’t use infrastructure equipment for communication. These networks rely instead on each other for routing and communication. MANETs use a hopping mechanism where each node in a network finds another node within its communication range and use it as a hop for delivering the message through another node and so on. In standard networks, there is dedicated equipment for specific functions such as routers, servers, firewalls, etc., while in ad hoc networks, every node performs multiple functions. For example, the routing function is performed by nodes. Hence, they are more vulnerable to attacks than standard networks. The main goal of this paper is to propose a solution for detecting black hole attacks using anomaly detection based on a support vector machine (SVM). This detection system aims at analyzing the traffic of the network and identifying anomalies by checking node behaviors. In the case of black hole attacks, the attacking nodes have some behavioral characteristics that are different from normal nodes. These characteristics can be effectively detected using our lightweight detection system. To experiment with the effectiveness of this solution, an OMNET++ simulator is used to generate traffic under a black hole attack. The traffic is then classified into malicious and non-malicious based on which the malicious node is identified. The results of the proposed solution showed very high accuracy in detecting black hole attacks.

Naïve Bayes Supervised Learning based Physical Layer Authentication: Anti-Spoofing techniques for Industrial Radio Systems

Physical Layer Security (PLS) based authentication schemes are an alternative to conventional security schemes such as e.g. certificates or Message Authentication Codes (MACs). They can provide a more lightweight solution compared to traditional cryptography in order to meet the requirement of secure data transmission. However, errors in Physical Layer Authentication (PLA) techniques can occur due to adverse influences resulting from PLS schemes such as receiver noise or fading channels. Skillfull methods are therefore required in order to detect anormal system behaviour. One promising solution are supervised classification schemes. The application of Naïve Bayes (NB) classifiers for PLA is therefore proposed and evaluated within this work. Prior to that, we analyse the resource efficiency within typical Ultra Reliable Low Latency Communication (URLLC) applications and conduct a security overhead analysis. We propose strategies in order to overcome the problem of missing training data from either the URLLC user or attacker node. A real world Software Defined Radio (SDR) based testbed using OFDM (Orthogonal Frequency Division Multiplexing) is implemented in order to evaluate the performance of NB based PLA. The measurements are conducted within the german campus network frequency band (LTE band 43). Further, we conduct a hyperparameter optimization (HPO) based on random search. The investigated classifiers show promising results in terms of authentication accuracy and Receiver Operating Characteristic (ROC) curve performance.

DOIDS: An Intrusion Detection Scheme Based on DBSCAN for Opportunistic Routing in Underwater Wireless Sensor Networks.

In Underwater Wireless Sensor Networks (UWSNs), data should be transmitted to data centers reliably and efficiently. However, due to the harsh channel conditions, reliable data transmission is a challenge for large-scale UWSNs. Thus, opportunistic routing (OR) protocols with high reliability, strong robustness, low end-to-end delay, and high energy efficiency are widely applied. However, OR in UWSNs is vulnerable to routing attacks. For example, sinkhole attack nodes can attract traffic from surrounding nodes by forging information such as the distance to the sink node. In order to reduce the negative impact of malicious nodes on data transmission, we propose an intrusion detection scheme (IDS) based on the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) clustering algorithm for OR (DOIDS) in this paper. DOIDS is based on small-sample IDS and is suitable for UWSNs with sparse node deployment. In DOIDS, the local monitoring mechanism is adopted. Every node in the network running DOIDS can select the trusted next hop. Firstly, according to the behavior characteristics of common routing attack nodes and unreliable underwater acoustic channel characteristics, DOIDS selected the energy consumption, forwarding, and link quality information of candidate nodes as the detection feature values. Then, the collected feature information is used to detect potential abnormal nodes through the DBSCAN clustering algorithm. Finally, a decision function is defined according to the time decay function to reduce the false detection rate of DOIDS. It makes a final judgment on whether the potential abnormal node is malicious. The simulation results show that the algorithm can effectively improve the detection accuracy rate (3% to 15% for different scenarios) and reduce the false positive rate, respectively.

A Federated Learning Multi-Task Scheduling Mechanism Based on Trusted Computing Sandbox.

At present, some studies have combined federated learning with blockchain, so that participants can conduct federated learning tasks under decentralized conditions, sharing and aggregating model parameters. However, these schemes do not take into account the trusted supervision of federated learning and the case of malicious node attacks. This paper introduces the concept of a trusted computing sandbox to solve this problem. A federated learning multi-task scheduling mechanism based on a trusted computing sandbox is designed and a decentralized trusted computing sandbox composed of computing resources provided by each participant is constructed as a state channel. The training process of the model is carried out in the channel and the malicious behavior is supervised by the smart contract, ensuring the data privacy of the participant node and the reliability of the calculation during the training process. In addition, considering the resource heterogeneity of participant nodes, the deep reinforcement learning method was used in this paper to solve the resource scheduling optimization problem in the process of constructing the state channel. The proposed algorithm aims to minimize the completion time of the system and improve the efficiency of the system while meeting the requirements of tasks on service quality as much as possible. Experimental results show that the proposed algorithm has better performance than the traditional heuristic algorithm and meta-heuristic algorithm.

QSec-RPL: Detection of version number attacks in RPL based mobile IoT using Q-Learning

Internet of Things (IoT) has revolutionized the networking by connecting the real world entities to the Internet. IoT connects the communication devices and has an incredible impact on perspective analytics on the massive volume of data produced every day. An attacker may exploit vulnerabilities of IoT entities and compromise users’ security and privacy. Development of solutions to address security and privacy issues of IoT is in premature stage and considered as challenge. This challenge becomes more critical when the devices in the network are resource-constrained in terms of energy, processing and memory. The IPv6 over Low-Power Wireless Personal Area Networks (6LoWPAN) has emerged in recent years as an adaptation layer to carry IPv6 packets over IEEE 802.15.4. Many IoT applications use Routing Protocol for Low Power and Lossy Networks (RPL) as a network layer protocol developed for routing in 6LoWPAN. Security is challenging in resource constrained environment where encryption may not be a viable solution. Version number attack is one of the most common network layer attacks against RPL based 6LoWPAN. The RPL specification does not address the integrity of the version number and therefore leaves version number mechanism as a weak point in terms of security. This paper investigates the impact of version number attack in RPL networks while considering mobility of the sensor nodes. We propose a solution that utilizes Q-Learning strategy to detect the malicious nodes that are performing version number attack. The proposed approach detects malicious nodes with reasonable accuracy while imposing significantly less overhead on the nodes of low power and lossy networks. There are other approaches too like Message Authentication Codes (MAC) based on symmetric keys but these techniques have memory and communication overhead. So we propose different approach Q-Learning to detect the attacker nodes.

Robustness assessments of urban rail transit networks based on user equilibrium with time compensation mechanism

Urban rail transit has become an important mode of urban public transportation and has been paid more attention in the past two decades due to the advantages of low pollution and high efficiency. However, traffic incidents frequently occur in urban rail transit, therefore the robustness must be investigated to improve operation safety. In this paper, the user equilibrium with time compensation mechanism is adopted to study the robustness of urban rail transit networks (URTNs) subjected to failures, and Shanghai metro network is considered as an example to prove the feasibility and effectiveness of the proposed scheme. Meanwhile, the average travel time, the average link-flow and the demand–supply ratio are used to assess the characteristic changes of URTNs subjected to three attack modes. Moreover, the critical nodes and links can be discovered based on the proposed model, and the attacks to these critical nodes and links can greatly decrease the robustness of URTNs. The simulation results show that URTNs have better robustness when suffering the node attack and the link-demand attack and possess worse robustness when suffering the overall-demand attack, and we find that the uneven distribution of passenger flow results in the low network utilization.

PeerRemove: An adaptive node removal strategy for P2P botnet based on deep reinforcement learning

Botnets have become one of the major intrusion threats to cybersecurity. P2P botnets have high concealment and resilience because of their distributed structure, which are difficult to be completely dismantled and destroyed. Existing methods based on traffic statistics and vulnerability tracing cannot effectively solve the problem of P2P botnet disintegration. Although P2P networks emphasize that each node is peer-to-peer, the difference in processing power, resource distribution, and node bandwidth can lead to a certain heterogeneity. The critical nodes bridge the underlying bot nodes and the upper control server. Traditional methods for ranking the importance of nodes mainly relies on classical graph-theoretic feature statistics method, such as degree, betweenness, clustering coefficient, feature vector centrality, PageRank, etc. In this paper, botnet defense strategies are investigated from the perspective of complex network graph theory, and graph embedding and deep reinforcement learning combination optimization methods are adopted to handle the critical nodes identification problem of P2P botnets. Then, a novel adaptive node removal model called PeerRemove is proposed. The model uses Structure2vec graph embedding to characterize the network structure information as a low-dimensional embedding space, and it uses n-step Q-learning to train the model to learn complex topological patterns to find the critical nodes that effectively disintegrate the network. To evaluate the effectiveness of the proposed method, the Area Under the Curve (AUC) of the Largest Connected Component (LCC) size during node removal is used as an evaluation indicator, and six different types real or synthetic P2P botnets are selected, namely Sality, ZeroAccess, NSIS, Mozi, Gnutella, and Peer sampling service. Experiments are conducted on many real and model networks with node sizes reaching thousands and tens of thousands, and our method is compared with five classical static or dynamic node attack methods of HAD, PageRank, CI, BPD, and HPRA. The experimental results show that the overall AUC curve of the PeerRemove method is lower than that of the benchmark method, which can minimize botnet resiliency at a small cost. The proposed method is superior to the existing node removal methods and shows good robustness and feasibility. To demonstrate the generality of this method, it is tested on a centralized topological dataset and good experimental results are obtained.

Modeling failure propagation to analyze the vulnerability of the complex electromechanical systems under network attacks

Since the complex electromechanical system (CMES) is a complex integration of multiple minimum maintenance units (MMUs), a single faulty MMU can trigger multi-step failures and eventually damage a substantial portion of the CMES. To investigate the failure propagation process and analyze the impact of the CMES under MMU attacks, we first abstract the system as a directed network composed of MMUs, machine-electricity-information connections, and functional properties. Subsequently, a fault propagation model is constructed based on the fault occurrence probability and matrix transformation, which considers the topological and functional attributes of the system. Then, we build the attack graphs to evaluate the faulty edges on the system’s vulnerability and propose some vulnerable indices based on the node attack strategies to quantify the attack impact of the malfunctioning nodes on the CMES network. Finally, a bogie system of the high-speed train is selected as a case study to verify the validity of the proposed method. Based on the findings, we can clarify the failure propagation behavior and quantify the impact of the faulty nodes and edges on the CMES network. Furthermore, the critical connections and nodes that significantly impact system vulnerability can be identified. Hence, our work can provide guiding significance for developing maintenance strategies to reduce losses and optimize the management scheme.

Analysis of the effect of node attack method on cascading failures in multi-layer directed networks

In order to avoid large-scale cascading failures, we propose a cascading failure model with adjustable parameters in multi-layer directed dependent networks with target nodes. The model sets the initial load and limit capacity, designs load delay judgment mechanism, constructs a load distribution strategy, and analyzes the cascading failure conditions. Finally, the simulation comparison between our method and other four redistribution methods shows that our method can improve the robustness and efficiency of the network. Based on our redistribution method, the same number of nodes are attacked by four attack methods, showing that the cost of attacking the driver node set is small, but can cause cascading failure on a large scale.

Node Intrusion Tendency Recognition Using Network Level Features Based Deep Learning Approach

Adhoc network is highly susceptible for intrusion attacks due to the simplified accesscontrol and compacted network stack. Malicious node recognition in Mobile adhocnetwork (MANET) is challengeable due to nodes mobility and limited coverageof nodes. Thus, link may keep fluctuating throughout the communication period.In this paper, deep analytic model is made for extracting attacker node behaviorsfrom networking point of view. Attributed such as link durations, re-healing timeand number of received packets (by attacker) was the main features of this work.Later, deep learning paradigm is integrated to perform attacker node recognition. Dataobtained from network analytical model is used to train three different models namelyFeed forward neural network (FFNN), Cascade backpropagation neural network(CBPNN) and Convolutional neural network (CNN). Attacker node recognitionaccuracy of 85.5