A protocol to mitigate routing misbehaviour under mobile ad hoc networks

METEOR - The ’MisbEhavior deTEctor and enfORcer’: A Protocol to Mitigate Routing Misbehavior under Mobile Ad-Hoc Networks by Foo Chee Hiong, Ricky (B.Eng.(Hons.), NUS ) A THESIS SUBMITTED FOR THE DEGREE OF MASTER OF ENGINEERING DEPARTMENT OF ELECTRICAL AND COMPUTER ENGINEERING NATIONAL UNIVERSITY OF SINGAPORE SEPTEMBER 2005 c 2005 Foo Chee Hiong, Ricky ALL RIGHTS RESERVED ii ACKNOWLEDGEMENTS A dissertation is not a solitary endeavor First and foremost I want to thank my thesis advisor Dr Winston Seah Khoon Guan for his advice and excellent guidance throughout my M.Eng studies, for keeping me on my toes examplified by the biweekly meetings we had I am also fortunate to have I2 R’s Communications and Devices Division for providing me with an excellent work environment and simply for consisting of so many wonderful people It was a real pleasure to work with some of my colleagues in the Networking Department, namely Tan Seng Kee, Ge Yu, Tan Kean Soon, Chan Kwang Mien, Cheng Wong Cho, Lee Tong Hong, and Sukanta K Hazra I would also like to especially thank a couple of my former lab-mates whom have already graduated and moved onto better things in life They are Wu Min Tao, Zou Jia Yuan and Emanuel A.Yudanto I had great times hanging around with these guys My heartfelt gratitude goes out to my current lab-mates whom I see more often than my family members for the last half a year Special thanks to Inn Inn for being such an awesome lunch buddy without whom I would be having lonely meals most of the time Gratefulness goes to Chang Fu whose jovial and comical character has on many occasions helped to brighten up my gloomy days I am especially thankful to Liu Zheng, Kevin for the frequent and constructive discussions we had though its not necessary work-related always The times spent during the various outings and activities with the two Swiss interns, Thomas Lochmatter and Niccolo Quattropani, was fantastic Daily interactions with them have definitely added spices to the otherwise at times, mundane research work Lastly, to Hui Xian for her inspiring work ethnics and Trina for the element of fun she carried with her The workplace is never boring with both of them around Finally, I am immensely indebted and grateful to my family for their understanding, love and unshaken belief during the course of my studies Foo Chee Hiong, Ricky NUS, September 30, 2005 iii Contents Acknowledgements iii Table of Contents iv Summary vii List of Tables viii List of Figures ix Introduction 1.1 Motivation and Problem Statement 1.2 An Overview of Mobile Ad Hoc Networks 1.2.1 Key Characteristics of Ad Hoc Networks 1.2.2 Potential Usage Scenarios 1.2.3 Research Challenges 1.3 State of the Art 11 1.4 Contributions 12 1.5 Thesis Outline 13 Background Information 14 2.1 Brief Review of Network Security 14 2.2 Cooperation States across Protocol Stacks 16 2.3 Security, Vulnerabilities and Cooperation Issues under MANETs 18 2.3.1 Uncooperative Behavior Structure Definition 19 2.3.2 Difficulities of Enforcing Security under MANETs 21 iv 2.4 Network Routing Threats 22 2.5 The AODV Protocol 25 State of the Art 27 3.1 Existing Main Solution Approaches 28 3.2 Handling MAC Layer Misbehavior 28 3.3 Payment and Rewarding Based Systems 29 3.4 3.5 3.3.1 Requirements 30 3.3.2 Related Works 32 3.3.3 Open Issues and Limitations 37 Reputation, Detection and Response Systems 38 3.4.1 Related Works 39 3.4.2 Open Issues and Limitations 43 Unconventional Systems: Intrusion Detection 44 METEOR Protocol Description 4.1 4.2 4.3 4.4 48 Assumptions and Background 49 4.1.1 Terminologies 49 4.1.2 Assumptions 49 Protocol Walk-Through 50 4.2.1 Detection: Passive Monitoring 50 4.2.2 Watchdog Enhancement 53 4.2.3 Aided-Data-Rerouting: HELPER Nodes 54 4.2.4 Exclusion and Redemption: Heuristic 57 4.2.5 Locality Self-Awareness for Selfish Nodes 60 Protocol Components 61 4.3.1 Packet Behavior Tracker 61 4.3.2 Node Behavior Asserter 63 4.3.3 Route Manager 63 4.3.4 Message Signal Coordinator 63 Finite State Machine 65 v Performance Analysis 5.1 5.2 66 GloMoSim Simulation with AODV 66 5.1.1 Goals and Metrics 66 5.1.2 Simulation Setup 68 5.1.3 Factors and Parameters 69 Simulation Results 70 5.2.1 Throughput Measurement 70 5.2.2 Dropped Data Packets Measurement 73 5.2.3 Classification Ratio Measurement 78 5.2.4 Broken Links Measurement 80 5.2.5 Overheads Measurement 81 5.2.6 Effects of FORWARDED mechanism Measurement 83 Conclusions 86 6.1 Summary 86 6.2 Future Work 87 A METEOR Packet Formats 88 Bibliography 96 vi SUMMARY We proposed a new protocol known as METEOR (MisbEhavior deTEctor and enfORcer) that works on top of any Mobile Ad Hoc Network (MANET) reactive hop-based routing protocol such as Ad Hoc On-Demand Distance-Vector (AODV) in order to mitigate/prevent node misbehavior that will threaten the integrity of the entire network In open communities, there is a need for such mechanisms to ensure correct network operations since under those environments, there exists heterogeneous users with different goals sharing the resources of their devices such as battery power, CPU and I/O cycles, etc in order to ensure global network connectivity As a result, misbehavior can arise due to selfishness or greediness All previous works for such add-on schemes operated by assuming the underlying routing protocols are some kind of source-based routing protocol such as Dynamic Source Routing (DSR) Although they claimed that their schemes are able to work on top of any routing protocol, there has been no formal verification of any kind As a result, there are no current proven schemes designed specially for hop-based routing protocol It is also well a known fact that source-based routing protocol posed scalability problem as compared to hop-based routing protocol As a result, the applicability and performance of previous schemes will thus be limited as well Rather than allowing any misbehaving node to drop the data packets as in other previous schemes, METEOR incorporates an alternative route finding mechanism to aid in the re-diverting of current traffic stream around the suspected misbehaving node on the fly to reach the intended destination In addition, we also made enhancements to the normal watchdog monitoring mechanism to lower the false classification rate A second chance redemption mechanism was also proposed to allow misbehaving nodes back into the network after a randomly computed exclusion period has lapsed rather than totally isolating them from the network upon just a single detection Finally, we suggest a method to dynamically adjust the classification threshold and the exclusion time of misbehaving node by taking into account the current neighbors size of the excluder node and the number of previously noted misbehaving attempts by the misbehaving node vii List of Tables 4.1 Fields in the IP Header to Match for a Successful PACK 53 5.1 Fixed Simulation Parameters 69 5.2 Varying Parameters Used For Scenario 70 5.3 Varying Parameters Used For Scenario 72 5.4 Varying Parameters Used For Scenario 73 5.5 Varying Parameters Used For Scenario 74 5.6 Varying Parameters Used For Scenario 76 5.7 Varying Parameters Used For Scenario 77 5.8 Varying Parameters Used For Scenario 79 5.9 Varying Parameters Used For Scenario 80 5.10 Varying Parameters Used For Scenario 82 5.11 Varying Parameters Used For Scenario 10 83 5.12 Varying Parameters Used For Scenario 11 85 viii List of Figures 1.1 An Example of the Snow-Ball Effect of Node Misbehavior in a Campus Setting 1.2 An Example of a Heterogeneous MANET Environment 2.1 The Terminology of Elementary Cooperation 19 2.2 The Uncooperative Behavior Taxonomy 20 3.1 The SPRITE Architecture 33 3.2 Application of the Human Immune System to an Artificial Immune System 46 4.1 Sensing ranges for passive acknowledgment 52 4.2 The Watchdog mechanism: (i) Failure to observe a PACK (ii) Sending of FORWARDED packet back to the previous node 54 4.3 Routing paths: (i) Normal path (ii) Path that contains a selfish node 55 4.4 Activation of the DISTRESS mechanism: (i) Sending of DISTRESS packets (ii) Return of DISTRESS-REPLY packets 56 4.5 Sending RESULTS packets back to the original source node 57 4.6 Sending of pLink-Loss packets to a selfish node by its neighbors 59 4.7 METEOR Components 62 4.8 METEOR Architecture and Finite State Machine Within Each Node 65 5.1 Throughput vs Varying Pause Time 71 5.2 Throughput vs Varying Proportion of Misbehaving Nodes 72 5.3 Mean Number of Intentionally Dropped Data Packets vs Varying Pause Time 74 5.4 Proportion of Intentionally Dropped Data Packets vs Varying Pause Time 75 ix 5.5 Mean Number of Intentionally Dropped Data Packets vs Varying Proportion of Misbehaving Nodes 76 5.6 Mean Number of Intentionally Dropped Data Packets vs Varying Node Population 77 5.7 Classification Ratio vs Varying Pause Time 79 5.8 Number of Broken Links vs Varying Pause Time 81 5.9 Overheads Ratio vs Varying Pause Time 83 5.10 Throughput vs Varying Pause Time 84 5.11 Mean Number of Intentionally Dropped Data Packets vs Varying Pause Time 85 A.1 Packet format for METEOR Options Header 88 A.2 Packet format for PEER-SELFISHNESS-REQUEST packet 89 A.3 Packet format for the PEER-SELFISHNESS-REPLY packet 90 A.4 Packet format for the pLINK-LOSS packet 91 A.5 Packet format for the DISTRESS packet 92 A.6 Packet format for the DISTRESS-REPLY packet 93 A.7 Packet format for the RESULTS packet 94 A.8 Packet format for the FORWARDED packet 95 x Appendix A METEOR Packet Formats The different types of specialize packet formats utilized by METEOR are as shown below Common METEOR Packet Options Header 3 9 METEOR ID Payload Length Reserved Options Figure A.1: Packet format for METEOR Options Header METEOR ID: 8-bit unsigned integer ID to identify packets belonging to the METEOR protocol Payload Length: 16-bit unsigned integer The length of the METEOR Options header excluding the 4-octet fixed portion The value of this field indicates the total length of all options carried in the METEOR Options header Reserved : Unused for the moment MUST be sent as and will be ignored on reception 88 89 Options: A variable length field The length of this field is specified by the Payload Length field in this METEOR Options header It contains one or more pieces of optional information (METEOR Options) which is encoded in the typelength-value (TLV) format The PEER-SELFISHNESS-REQUEST Packet 3 9 Option Type Opt Data Len Identification Host Source Address Target Destination Address Figure A.2: Packet format for PEER-SELFISHNESS-REQUEST packet Option Type: 8-bit unsigned integer Nodes that not understand this option will ignore the packet Opt Data Len: 8-bit unsigned integer It stores the length of the option, in octets, excluding the Option Type and Opt Data Len fields Identification: 16-bit unsigned integer A unique value is generated by the original sender of the packet A new value is used for each new request Host Source Address: MUST be set to the address of the node originating this packet Target Destination Address: The address of the node from which the host source node wish to obtain the SELFISH-NODE-DECLARATION list The PEER-SELFISHNESS-REPLY Packet Option Type: 8-bit unsigned integer Nodes that not understand this option will ignore the packet 90 3 9 Option Type Opt Data Len Identification Host Source Address Target Destination Address Returned Selfish Address [1] Returned Selfish Address [2] Returned Selfish Address [n] Figure A.3: Packet format for the PEER-SELFISHNESS-REPLY packet Opt Data Len: 8-bit unsigned integer It stores the length of the option, in octets, excluding the Option Type and Opt Data Len fields Identification: 16-bit unsigned integer A unique value is generated by the original sender of the packet A new value is used for each new request Host Source Address: MUST be set to the address of the node originating this packet Target Destination Address: The address of the node from which the PEERSELFISHNESS-REQUEST packet was received from This field is copied from the Host Source Address field of the PEER-SELFISHNESS-REQUEST packet Returned Selfish Address [1 n] : Address [i] is the address of the selfish node which is stored in the SELFISH-NODE-DECLARATION list of the Host Source Address node The number of addresses present in this field is calculated by using the value in Opt Data Len (n = (Opt Data Len - 10) / 4) Each new address adds octets to the Opt Data Len value 91 3 9 Option Type Opt Data Len Identification Discriminating Source Address Discriminated Target Destination Address Figure A.4: Packet format for the pLINK-LOSS packet The pLINK-LOSS Packet Option Type: 8-bit unsigned integer Nodes that not understand this option will ignore the packet Opt Data Len: 8-bit unsigned integer It stores the length of the option, in octets, excluding the Option Type and Opt Data Len fields Identification: 16-bit unsigned integer A new, unique value generated by the sending node for different pLINK-LOSS packet Discriminating Source Address: The address of the sending node of the pLINK-LOSS packet Discriminated Target Destination Address: The address of the receiving destination node which is also marked as selfish by the packet sending node Other nodes that picked up this packet will ignore it if the Discriminated Target Destination Address does not match their own address The DISTRESS Packet Option Type: 8-bit unsigned integer Nodes that not understand this option will ignore the packet Opt Data Len: 8-bit unsigned integer It stores the length of the option, in octets, excluding the Option Type and Opt Data Len fields 92 3 9 Option Type Opt Data Len Identification Host Source Address Destination Address Problematic Node Address Figure A.5: Packet format for the DISTRESS packet Identification: 16-bit unsigned integer The value for each session is the same for all the packets Host Source Address: The address of the node originating the DISTRESS packet Destination Address: The address to which the packet is to be delivered to This field will be filled with a broadcast value of 255.255.255.255 Problematic Node Address: The address of the node responsible for the link breakage which is upstream of the node that sent out the DISTRESS packet The DISTRESS-REPLY Packet Option Type: 6-bit unsigned integer Nodes that not understand this option will ignore the packet Helper Bit (H): 1-bit field Set to indicate if the node is willing to act as a HELPER node provided the conditions are fulfilled A value of indicates the YES and means NO If the value is 1, the Helper Path Address fields will be filled with the relevant values Selfish Bit (S): 1-bit field Set to indicate if the ”Problematic Node Address” field of the DISTRESS packet received matches any of the address under its SELFISHNODE-DECLARATION A value of indicates the node is selfish 93 3 9 Option Type H S Opt Data Len Identification Host Source Address Target Destination Address Problematic Node Address Current Battery Level Hop Count to Original Destination Figure A.6: Packet format for the DISTRESS-REPLY packet Opt Data Len: 8-bit unsigned integer It stores the length of the option, in octets, excluding the Option Type and Opt Data Len fields Identification: 16-bit unsigned integer This value is to be copied from the identification field of the received DISTRESS packet Host Source Address: The address of the node originating the DISTRESSREPLY packet Target Destination Address: The address of the destination node to which the packet is to be delivered to The value should be copied from the Host Source Address field of the DISTRESS packet Problematic Node Address: The address of the node responsible for the link breakage which is upstream of the node that sent out the DISTRESS packet Current Battery Level : The current remaining battery level of the node that sent out this packet This aids in the HELPER node decision making process by the node that is going to receive the packet 10 Hop Count to Original Destination: The hop count to the original destination node from this node This aids in the HELPER node decision making process by the node that is going to receive the packet 94 The RESULTS Packet 3 9 Option Type R Opt Data Len Identification Host Source Address Target Destination Address Rouge Node Address Figure A.7: Packet format for the RESULTS packet Option Type: 7-bit unsigned integer Nodes that not understand this option will ignore the packet Result Bit (R): 1-bit unsigned integer Indicates if a HELPER node has been found upstream If yes, a value of would signal to the node receiving this packet to resend data If not, a value of would then mean the node has to re-initiate a new route discovery to the original destination node Opt Data Len: 8-bit unsigned integer It stores the length of the option, in octets, excluding the Option Type and Opt Data Len fields Identification: 16-bit unsigned integer A new value is generated for every instance of the packet Host Source Address: The address of the node originating the NEUTRAL packet Target Destination Address: The address of the node to which this packet is directed to Rouge Node Address: The address of the node that is responsible for the original link breakage 95 The FORWARDED Packet 3 9 Option Type Opt Data Len Identification Route Source Address Route Destination Address Originating Node Address Figure A.8: Packet format for the FORWARDED packet Option Type: 8-bit unsigned integer Nodes that not understand this option will ignore the packet Opt Data Len: 8-bit unsigned integer It stores the length of the option, in octets, excluding the Option Type and Opt Data Len fields Identification: 16-bit unsigned integer The value for each session is the same for all the packets Route Source Address: The initial source address of the route Route Destination Address: The final destination address of the route Originating Node Address: The address of the node originating the FORWARDED packet Bibliography [1] Q Zhang and D P Agrawal, “Impact of selfish nodes on route discovery in mobile ad hoc networks,” IEEE Global Telecommunications Conference (GLOBECOM ’04), vol 5, pp 2914–2918, 29 Nov-3 Dec 2004 [2] B Zhang, O Shagdar, and M N Shirazi, “Performance analysis of cooperation over mobile ad hoc networks,” ICICS-PCM 2003, Singapore, Dec 15-18, 2003 [3] M Hollick, J Schmitt, C Seipl, and R Steinmetz, “On the effect of node misbehavior in ad hoc networks,” Proceedings of IEEE International Conference on Communications, ICC’04, vol 6, pp 3759–3763, Paris, France, June 2004 [4] B Shadpour, S Valaee, and B Li, “A self-organized approach for stimulating cooperation in mobile ad hoc networks,” Proceedings of the 22nd Biennial Symposium on Communications, Queen’s University, Kingston, Ontario, Canada, May 31 - June 3, 2004 [5] H Miranda and L Rodrigues, “Friends and foes: Preventing selfishness in open mobile ad hoc networks,” Proceedings of the First Intl Workshop on Mobile Distributed Computing (MDC03), Providence, RI, USA 2003 [6] J Hu, “Cooperation in mobile ad hoc networks,” Tech Rep TR-050111, Florida State University, January 11, 2005 [7] K Lai, M Feldman, I Stoica, and J Chuang, “Incentives for cooperation in peerto-peer networks,” Proceedings of the First Workshop on Economics of Peer-to-Peer Systems, Berkeley, California, USA June 2003 96 97 [8] J Shneidman and D C Parkes, “Rationality and self-interest in peer-to-peer networks,” Proceedings of 2nd International Workshop on Peer-to-Peer Systems (IPTPS 03), Berkeley, CA, USA, February 2003 [9] P Golle, K Leyton-Brown, and I Mironov, “Incentives for sharing in peer-to-peer networks,” Procedings of the 2001 ACM Conference on Electronic Commerce, 2001 [10] T Moreton and A Twigg, “Trading in trust, tokens, and stamps,” Workshop on Economics of Peer-to-Peer Systems, June 2003 Berkeley, CA [11] S Yi, P Naldurg, and R Kravets, “Security-aware ad-hoc routing for wireless networks,” MobiHOC Poster Session, 2001 [12] M Conti, “Body, personal, and local wireless ad hoc networks,” in The Handbook of Ad Hoc Wireless Networks (M Ilyas, ed.), ch 1, pp 3–24, CRC Press Inc, New York, 2003 [13] Y Wang, V C Giruka, and M Singhal, “A fair distributed solution for selfish nodes problem in wireless ad hoc networks,” Ad-Hoc, Mobile, and Wireless Networks: Third International Conference, ADHOC-NOW 2004, pp 211–224, Vancouver, Canada, July 22-24, 2004 [14] M Conti, E Gregori, and G Maselli, “Cooperation issues in mobile ad hoc networks,” in 24th International Conference on Distributed Computing Systems Workshops - W6: WWAN (ICDCSW’04), pp 803–808, Mar 23-24, 2004, Hachioji, Tokyo, Japan [15] K Wrona, “Distributed security: Ad hoc networks and beyond,” in Ad Hoc Networks Security Pampas Workshop, Rhul, Sept 16-17, 2002, London [16] J.-P Hubaux, L Buttyan, and S Capkun, “The quest for security in mobile ad hoc networks,” in Proceedings of the 2nd ACM International Symposium on Mobile Ad Hoc Networking and Computing (MobiHOC 2001), pp 146–155, 2001, Long Beach, CA, USA [17] A Khalili and W A Arbaugh, “Security of wireless ad-hoc networks.” in submission to the ACM Computing Surveys, 2004 98 [18] M Jakobsson, S Wetzel, and B Yener, “Stealth attacks on ad-hoc wireless networks,” Proceedings of VTC, Orlando, Florida, USA, Oct 4-9, 2003 [19] S Capkun, J.-P Hubaux, and L Buttyan, “Mobility helps security in ad hoc networks,” Proceedings of the 4th ACM Symposium on Mobile Ad Hoc Networking and Computing (MobiHOC 2003), pp 46–56, Annapolis, Maryland, USA, 2003 [20] P Obreiter, B K¨onig-Ries, and M Klein, “Stimulating cooperative behavior of autonomous devices - an analysis of requirements and existing approaches,” Second International Workshop on Wireless Information Systems (WIS2003), Angers (France), April 23-26, 2003 [21] E Altman, A A Kherani, P Michiardi, and R Molva, “Non cooperative forwarding in ad hoc networks,” Proceedings of the 15th IEEE PIMRC Symposium, Barcelona, Spain, 5-8 September, 2004 [22] M Conti, E Gregori, and G Maselli, “Towards reliable forwarding for ad hoc networks,” Proceedings of Personal Wireless Communications (PWC 03), vol LNCS 2775, pp 790–804, Sept 2003, Venice, Italy [23] P Yau and C J Mitchell, “Security vulnerabilities in ad hoc networks,” in Proceedings of ISCTA ’03, 7th International Symposium on Communications Theory and Applications, pp 99–104, July 13-18, 2003, Ambleside, Lake District, UK [24] N Nisan, “Algorithms for selfish agents,” in Proceedings of the Symposium on Theoretical Aspects of Computer Science, LNCS 1563, pp 1–17, 1999 [25] C Perkins, E Belding-Royer, and S Das, “Ad hoc on-demand distance vector (AODV) routing,” RFC, Mobile Ad Hoc Network (MANET) Working Group, IETF, July 2003 [26] P Kyasanur and N Vaidya, “Detection and handling of MAC layer misbehavior in wireless networks,” in International Conference on Dependable Systems and Networks (DSN’03), p 173, June 22-25, 2003, San Francisco, California 99 [27] P Kyasanur and N H Vaidya, “Selfish MAC layer misbehavior in wireless networks.” accepted for publication in IEEE Transactions on Mobile Computing, April 2004 [28] N B Salem, L Buttyan, J.-P Hubaux, and M Jakobsson, “A charging and rewarding scheme for packet forwarding in multi-hop cellular networks,” Proceedings of the 4th ACM International Symposium on Mobile Ad Hoc Networking and Computing (MobiHoc03), June 1-3, 2003, Annapolis, Maryland, USA [29] L Buttyan and J P Hubaux, “Enforcing service availability in mobile ad-hoc WANs,” Proceedings of IEEE/ACM Workshop on Mobile Ad Hoc Networking and Computing (MobiHOC), Boston, MA, USA, August, 2000 [30] L Buttyan and J P Hubaux, “Stimulating cooperation in self-organizing mobile ad hoc networks,” ACM/Kluwer Mobile Networks and Applications, vol 8, no 5, pp 579–592(14), October 2003 [31] S Zhong, J Chen, and Y Yang, “Sprite: A simple, cheat-proof, credit-based system for mobile ad-hoc networks,” IEEE INFOCOM 2003 - The Conference on Computer Communications, no 1, pp 1987–1997, San Francisco, CA, April 2003 [32] E Huang, J Crowcroft, and I Wassell, “Rethinking incentives for mobile ad hoc networks,” Proceedings of the ACM SIGCOMM Workshop on Practice and Theory of Incentives in Networked Systems, pp 191–196, Portland, Oregon, USA Aug 30 - Sept 03, 2004 [33] J Crowcroft, R Gibbens, F Kelly, and S Ostring, “Modelling incentives for collaboration in mobile ad hoc networks,” in Proceedings of WiOpt’03, 2003 [34] V Srinivasan, P Nuggehalli, C Chiasserini, and R R Rao, “Cooperation in wireless ad hoc networks,” Proceedings of IEEE INFOCOM’03, pp 808–817, April 2003, San Francisco, CA, USA [35] M Felegyhazi, L Buttyan, and J.-P Hubaux, “Equilibrium analysis of packet forwarding strategies in wireless ad-hoc networks - the static case,” Personal Wireless Communications (PWC 2003), Venice, Italy, Sept 23-25, 2003 100 [36] M Felegyhazi, J.-P Hubaux, and L Buttyan, “Equilibrium analysis of packet forwarding strategies in wireless ad-hoc networks - the dynamic case,” Tech Rep IC/2003/68, EPFL, Switzerland, November 2003 [37] M Felegyhazi, J.-P Hubaux, and L Buttyan, “The effect of mobility on cooperation in ad hoc networks,” Proceedings of WiOpt ’04, Cambridge, UK, March 2004 [38] P Michiardi and R Molva, “Making greed work in mobile ad hoc networks,” Tech Rep RP-02-069, Institut Eurecom, March 2002 [39] L Buttyan and J.-P Hubaux, “Nuglets: A virtual currency to stimulate cooperation in self-organized mobile ad-hoc networks,” Tech Rep DSC/2001/001, EPFL, Switzerland, January 2001 [40] L Anderegg and S Eidenbenz, “Ad hoc VCG: A truthful and cost-efficient routing protocol for mobile ad hoc networks with selfish agents,” Proceedings of the 9th Annual International Conference on Mobile Computing and Networking (Mobicom), pp 245–259, San Diego, CA, USA, September 2003 [41] A A Pirada and C McDonald, “Establishing trust in pure ad-hoc networks,” Proceedings of 27th Australasian Computer Science Conference (ACSC’04), vol 26(1), pp 47–54, January 2004 [42] S Buchegger and J.-Y L Boudec, “A robust reputation system for P2P and mobile ad-hoc networks,” Second Workshop on the Economics of Peer-to-Peer Systems (P2PEcon 2004), Harvard University, Cambridge MA, U.S.A., June 2004 [43] S Buchegger and J.-Y L Boudec, “Coping with false accusations in misbehavior reputation systems for mobile ad hoc networks,” Tech Rep IC/2003/31, EPFL, Switzerland, 2003 [44] S Marti, T Giuli, K Lai, and M Baker, “Mitigating routing misbehavior in mobile ad hoc networks,” Proceedings of Mobicom 2000, pp 255–265, Boston, August 2000 [45] S Buchegger and J L Boudec, “Performance analysis of the CONFIDANT protocol (cooperation of nodes: Fairness in dynamic ad-hoc networks),” Proceedings of 101 IEEE/ACM Symposium on Mobile Ad Hoc Networking and Computing (MobiHOC), pp 80–91, Lausanne, Switzerland, June 9-11, 2002 [46] P Michiardi and R Molva, “CORE: A COllaborative REputation mechanism to enforce node cooperation in mobile ad hoc networks,” in Communications and Multimedia Security, IFIP TC6/TC11 Sixth Joint Working Conference on Communications and Multimedia Security, September 26-27, 2002, Portoroz, Slovenia [47] P Brutch and C Ko, “Challenges in intrusion detection for wireless ad-hoc networks,” 2003 Symposium on Applications and the Internet Workshops (SAINT’03 Workshops), p 368, January 27-31, 2003 Orlando, Florida [48] Y Zhang and W Lee, “Intrusion detection in wireless ad-hoc networks,” Proceedings of The Sixth International Conference on Mobile Computing and Networking (MobiCom 2000), pp 275–283, Boston, Massachusetts, United States, August 2000 [49] Y an Huang and W Lee, “A cooperative intrusion detection system for ad hoc networks,” Proceedings of the 1st ACM Workshop on Security of Ad Hoc and Sensor Networks, October 31, 2003, Fairfax, Virginia [50] C.-Y Tseng, P Balasubramanyam, C Ko, R Limprasittiporn, J Rowe, and K Levitt, “A specification-based intrusion detection system for AODV,” Proceedings of the 1st ACM Workshop on Security of Ad Hoc and Sensor Networks (SASN03), Fairfax, Virginia 2003 [51] F Kargl, A Klenk, S Schlott, and M Weber, “Advanced detection of selfish or malicious nodes in ad hoc network,” Proceedings of 1st European Workshop on Security in Ad-Hoc and Sensor Networks (ESAS 2004), Springer Lecture Notes in Computer Science, pp 152–165, Heidelberg, Sept 2004 [52] Y an Huang, W Fan, W Lee, and P S Yu, “Cross-feature analysis for detecting ad-hoc routing anomalies,” Proceedings of the 23rd International Conference on Distributed Computing Systems (ICDCS), vol 00, p 478, Providence, Rhode Island, 23rd May 2003 102 [53] J.-Y L Boudec and S Sarafijanovic, “An artificial immune system approach to misbehavior detection in mobile ad-hoc networks,” Proceedings of Bio-ADIT 2004 (The First International Workshop on Biologically Inspired Approaches to Advanced Information Technology), pp 96–111, January 29-30, 2004, Lausanne, Switzerland [54] S Sarafijanovic and J.-Y L Boudec, “An artificial immune system approach with secondary response for misbehavior detection in mobile ad-hoc networks,” Tech Rep IC/2003/65, EPFL, Switzerland, November 2003 [55] U Aickelin, J Greensmith, and J Twycross, “Immune system approaches to intrusion detection - a review,” Proceedings ICARIS-2004, 3rd International Conference on Artificial Immune Systems, LNCS 3239, pp 316–329, Springer-Verlag, Catania, Italy, 2004 [56] S Sarafijanovic and J.-Y L Boudec, “An artificial immune system for misbehavior detection in mobile ad hoc networks with both innate, adaptive subsystems and with danger signal,” Proceedings of AISB 2004 Symposium on The Immune System and Cognition (ImmCog-2004), pp 45–46, Leeds, UK, 30-31 Mar 2004 [57] S Sarafijanovic and J.-Y L Boudec, “An artificial immune system for misbehavior detection in mobile ad-hoc networks with virtual thymus, clustering, danger signal, and memory detectors,” ICARIS, LNCS 3239, Springer-Verlag Berlin Heidelberg, pp 342–356, 2004 [58] S Buchegger, C Tissieres, and J Y L Boudec, “A test-bed for misbehavior detection in mobile ad-hoc networks - how much can watchdogs really do?,” Sixth IEEE Workshop on Mobile Computing Systems and Applications (WMCSA’04), pp 102– 111, Lake District National Park, United Kingdom, December 2004 [59] X Zeng, R Bagrodia, and M Gerla, “GloMoSim: A library for parallel simulation of large-scale wireless networks,” Proceedings of the 12th Workshop on Parallel and Distributed Simulations - PADS ’98, May 26-29, 1998 in Banff, Alberta, Canada [...]... issues remain and one which has taken caught the attend of researchers in recent times concerns the behavior of individual nodes operating under Mobile Ad Hoc Networks (MANETs) As nodes in mobile ad hoc network may spread over a large geographical range than the communication signal can reach, they may have to communicate over multi-hops As a result, the dependability of the routing operations in MANETs... possible attacks in traditional networks and further additional considerations for MANETs 1 Authentication: Authentication is needed in order to be certain about the actual identity of the sender or the receiver of a message The attack that is performed on this metric is known as masquerading, which is to pass off as somebody else As there is no central authority available in MANETs to store certificates and... summarized as follows: 1 We have proposed a simple protocol that works on a reactive hop-based routing protocol such as AODV Existing add-on misbehavior mitigation schemes are designed for source-based routing protocol such as DSR 2 We have made enhancements to the normal watchdog mechanism to lower the rate of false classification while maintaining the level of true classification 3 We have presented a method... route information update Examples of proactive protocols are Destination-Sequenced Distance-Vector (DSDV), ClusterheadGateway Switching Routing (CGSR), Wireless Routing Protocol (WRP), Fisheye State Routing (FSR) and etc Examples of reactive protocols are Dynamic Source Routing (DSR), Ad Hoc On-Demand Distance-Vector (AODV), Temporally Ordered Routing Algorithm (TORA) and etc The key is perhaps to find... our protocol to address these shortcomings 1.2 An Overview of Mobile Ad Hoc Networks MANETs represent a new class of communication networks that have emerged in recent years Rooted at the research of military network in the U.S., ad hoc networks have become increasingly important in commercial applications Composed of either stationary or free roaming wireless mobile nodes that may vary in capabilities... periodically Reactive protocols will search for a feasible route on a demand basis only upon request The pros of proactive protocols is that they give shorter end -to- end delay since the route information is always available and up -to- date as compared to their reactive counterparts However, the downside is that they are rather resources consuming since a considerable amount of overheads are incurred at every... defense applications (army, navy, air force), healthcare, academic institutions and corporate conventions/meetings We will discuss below in greater details on the key characteristics of ad hoc networks, their potential usages in our daily lives and the research challenges faced Figure 1.2: An Example of a Heterogeneous MANET Environment 1.2.1 Key Characteristics of Ad Hoc Networks Due to the totally different... nodes Analogously, node of this nature can be viewed as nodes that have infiltrated the opposite enemy camps entrusted with the role of sabotaging 2.5 The AODV Protocol The Ad Hoc On-demand Distance Vector (AODV) routing protocol was one of the earliest routing protocol developed for routing in MANETs and was proposed by Perkins, Royer and Das [25] It is currently one of the only few that have already... An Example of the Snow-Ball Effect of Node Misbehavior in a Campus Setting Such behavior may be exacerbated by the operations of MANETs routing protocols: some protocols use caches to accelerate route discoveries As a result, those caches are more likely to contain routes containing cooperative nodes, omitting misbehaving nodes Thus cooperative users are likely to have their battery drained at a faster... encryption algorithm cannot be implemented and utilized Security attacks fall under two types: passive and active In a passive attack, a malicious node either ignores operations assigned to it (e.g silent discard, partial routing information hiding), or listens to the channel, attempting to retrieve valuable information This type of attack does not require a malicious node injecting any message to the ... Yu, Tan Kean Soon, Chan Kwang Mien, Cheng Wong Cho, Lee Tong Hong, and Sukanta K Hazra I would also like to especially thank a couple of my former lab-mates whom have already graduated and moved... behavior of individual nodes operating under Mobile Ad Hoc Networks (MANETs) As nodes in mobile ad hoc network may spread over a large geographical range than the communication signal can reach,... foreseeable and profitable application is multi-player gaming Home Networks: Rather than restricting network access at a single spot, ad hoc networking allows them to be available at virtually anywhere