cross.rar_wireless networks_行业发展研究下载-pudn.com

<html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta charset="utf-8"> <meta name="generator" content="pdf2htmlEX"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <link rel="stylesheet" href="https://static.pudn.com/base/css/base.min.css"> <link rel="stylesheet" href="https://static.pudn.com/base/css/fancy.min.css"> <link rel="stylesheet" href="https://static.pudn.com/prod/directory_preview_static/625f96ae8cbeb85d5766461a/raw.css"> <script src="https://static.pudn.com/base/js/compatibility.min.js"></script> <script src="https://static.pudn.com/base/js/pdf2htmlEX.min.js"></script> <script> try{ pdf2htmlEX.defaultViewer = new pdf2htmlEX.Viewer({}); }catch(e){} </script> <title></title> </head> <body> <div id="sidebar" style="display: none"> <div id="outline"> </div> </div> <div id="pf1" class="pf w0 h0" data-page-no="1"><div class="pc pc1 w0 h0"><img class="bi x0 y0 w1 h1" alt="" src="https://static.pudn.com/prod/directory_preview_static/625f96ae8cbeb85d5766461a/bg1.jpg"><div class="t m0 x1 h2 y1 ff1 fs0 fc0 sc0 ls0 ws0">A Cross-layer based Intrusion Detection Approach</div><div class="t m0 x2 h2 y2 ff1 fs0 fc0 sc0 ls0 ws0">for Wireless Ad hoc Networks</div><div class="t m0 x3 h3 y3 ff1 fs1 fc0 sc0 ls0 ws0">Geethapriya Thamilarasu</div><div class="t m0 x4 h4 y4 ff2 fs2 fc0 sc0 ls0 ws0">1</div><div class="t m0 x5 h3 y3 ff1 fs1 fc0 sc0 ls0 ws0">, Aruna Balasubramanian</div><div class="t m0 x6 h4 y4 ff2 fs2 fc0 sc0 ls0 ws0">2</div><div class="t m0 x7 h3 y3 ff1 fs1 fc0 sc0 ls0 ws0">, Sumita Mishra</div><div class="t m0 x8 h4 y4 ff2 fs2 fc0 sc0 ls0 ws0">2</div><div class="t m0 x9 h3 y3 ff1 fs1 fc0 sc0 ls0 ws0">and Ramalingam Sridhar</div><div class="t m0 xa h4 y4 ff2 fs2 fc0 sc0 ls0 ws0">1</div><div class="t m0 xb h4 y5 ff2 fs2 fc0 sc0 ls0 ws0">1</div><div class="t m0 xc h5 y6 ff1 fs1 fc0 sc0 ls0 ws0">University at Buffalo, Buffalo, NY 14260-2000; {gt7, rsridhar}@cse.buffalo.edu</div><div class="t m0 xd h4 y7 ff2 fs2 fc0 sc0 ls0 ws0">2</div><div class="t m0 xe h5 y8 ff1 fs1 fc0 sc0 ls0 ws0">CompSys Technologies Inc., Amherst, NY 14228 ; {arunab, mishra}@compsystech.com</div><div class="t m0 xf h6 y9 ff4 fs4 fc0 sc0 ls0 ws0">Abstract— Wireless ad-hoc networks are vulnerable to various</div><div class="t m0 x10 h7 ya ff5 fs4 fc0 sc0 ls0 ws0">kinds of security threats and attacks due to relative ease of access</div><div class="t m0 x10 h7 yb ff5 fs4 fc0 sc0 ls0 ws0">to wireless medium and lack of a centralized infrastructure. In</div><div class="t m0 x10 h7 yc ff5 fs4 fc0 sc0 ls0 ws0">this paper, we seek to detect and mitigate the Denial of Service</div><div class="t m0 x10 h7 yd ff5 fs4 fc0 sc0 ls0 ws0">(DoS) attacks that prevent authorized users from gaining access</div><div class="t m0 x10 h7 ye ff5 fs4 fc0 sc0 ls0 ws0">to the networks. These attacks affect the service availability</div><div class="t m0 x10 h7 yf ff5 fs4 fc0 sc0 ls0 ws0">and connectivity of the wireless networks and hence reduce the</div><div class="t m0 x10 h7 y10 ff5 fs4 fc0 sc0 ls0 ws0">network performance. To this end, we propose a novel Cross-</div><div class="t m0 x10 h7 y11 ff5 fs4 fc0 sc0 ls0 ws0">layer based Intrusion Detection System (CIDS) to identify the</div><div class="t m0 x10 h7 y12 ff5 fs4 fc0 sc0 ls0 ws0">malicious node(s). Exploiting the information available across</div><div class="t m0 x10 h7 y13 ff5 fs4 fc0 sc0 ls0 ws0">different layers of the protocol stack by triggering multiple levels</div><div class="t m0 x10 h7 y14 ff5 fs4 fc0 sc0 ls0 ws0">of detection, enhances the accuracy of detection. We validate</div><div class="t m0 x10 h7 y15 ff5 fs4 fc0 sc0 ls0 ws0">our design through simulations and also demonstrate lower</div><div class="t m0 x10 h7 y16 ff5 fs4 fc0 sc0 ls0 ws0">occurrence of false positives.</div><div class="t m0 xf h6 y17 ff4 fs4 fc0 sc0 ls0 ws0">Index Terms— Denial of Service (DoS) attacks, Intrusion de-</div><div class="t m0 x10 h7 y18 ff5 fs4 fc0 sc0 ls0 ws0">tection, Cross-layer design</div><div class="t m0 x11 h8 y19 ff1 fs5 fc0 sc0 ls0 ws0">I. INTRODUCTION</div><div class="t m0 xf h8 y1a ff1 fs5 fc0 sc0 ls0 ws0">Wireless networks have become an important facet in our</div><div class="t m0 x10 h8 y1b ff1 fs5 fc0 sc0 ls0 ws0">everyday lives as they are increasingly deployed in numerous</div><div class="t m0 x10 h8 y1c ff1 fs5 fc0 sc0 ls0 ws0">applications. However, their growing popularity is challenged</div><div class="t m0 x10 h8 y1d ff1 fs5 fc0 sc0 ls0 ws0">by insecure environment and characteristics of these networks.</div><div class="t m0 x10 h8 y1e ff1 fs5 fc0 sc0 ls0 ws0">The inherent nature of the wireless medium makes it sus-</div><div class="t m0 x10 h8 y1f ff1 fs5 fc0 sc0 ls0 ws0">ceptible to variety of security attacks ranging from passive</div><div class="t m0 x10 h8 y20 ff1 fs5 fc0 sc0 ls0 ws0">eavesdropping to active interference.</div><div class="t m0 xf h8 y21 ff1 fs5 fc0 sc0 ls0 ws0">Moreover, in a truly ad hoc wireless network domain,</div><div class="t m0 x10 h8 y22 ff1 fs5 fc0 sc0 ls0 ws0">network services such as routing are provided by the nodes</div><div class="t m0 x10 h8 y23 ff1 fs5 fc0 sc0 ls0 ws0">themselves. In such a scenario, a malicious entity (apart</div><div class="t m0 x10 h8 y24 ff1 fs5 fc0 sc0 ls0 ws0">from compromising a node), can deny network services by</div><div class="t m0 x10 h8 y25 ff1 fs5 fc0 sc0 ls0 ws0">dropping packets that need to be forwarded, by misrouting</div><div class="t m0 x10 h8 y26 ff1 fs5 fc0 sc0 ls0 ws0">packets or by launching other attacks. Such attacks, called</div><div class="t m0 x10 h8 y27 ff1 fs5 fc0 sc0 ls0 ws0">Denial of Service (DoS) attacks [1] affect the availability of</div><div class="t m0 x10 h8 y28 ff1 fs5 fc0 sc0 ls0 ws0">the nodes signiﬁcantly thereby disrupting the entire network.</div><div class="t m0 x10 h8 y29 ff1 fs5 fc0 sc0 ls0 ws0">Fortifying the wireless infrastructure against intrusion is more</div><div class="t m0 x10 h8 y2a ff1 fs5 fc0 sc0 ls0 ws0">challenging than in the case of wired networks as the wired</div><div class="t m0 x10 h8 y2b ff1 fs5 fc0 sc0 ls0 ws0">network based access control mechanisms such as ﬁrewalls are</div><div class="t m0 x10 h8 y2c ff1 fs5 fc0 sc0 ls0 ws0">ineffective in these networks due to their dynamically varying</div><div class="t m0 x10 h8 y2d ff1 fs5 fc0 sc0 ls0 ws0">topology.</div><div class="t m0 xf h8 y2e ff1 fs5 fc0 sc0 ls0 ws0">In the presence of malicious nodes, traditionally, intrusion</div><div class="t m0 x10 h8 y2f ff1 fs5 fc0 sc0 ls0 ws0">prevention mechanisms such as secret key and encryption</div><div class="t m0 x10 h8 y30 ff1 fs5 fc0 sc0 ls0 ws0">are used. However, these authentication mechanisms are not</div><div class="t m0 x10 h8 y31 ff1 fs5 fc0 sc0 ls0 ws0">effective against insider attacks as the physical compromise</div><div class="t m0 x10 h8 y32 ff1 fs5 fc0 sc0 ls0 ws0">of a node could compromise the secret key. In order to</div><div class="t m0 x10 h8 y33 ff1 fs5 fc0 sc0 ls0 ws0">secure wireless networks, we need a second line of defense to</div><div class="t m0 x10 h8 y34 ff1 fs5 fc0 sc0 ls0 ws0">detect the intrusions [2]. For this purpose, Intrusion Detection</div><div class="t m0 x10 h8 y35 ff1 fs5 fc0 sc0 ls0 ws0">Systems (IDS) are deployed to identify any set of actions that</div><div class="t m0 x10 h8 y36 ff1 fs5 fc0 sc0 ls0 ws0">compromise the integrity, conﬁdentiality and availability of</div><div class="t m0 x12 h8 y37 ff1 fs5 fc0 sc0 ls0 ws0">resources. Misuse and anomaly detection are common IDS</div><div class="t m0 x12 h8 y38 ff1 fs5 fc0 sc0 ls0 ws0">techniques that are used to study the abnormalities in the</div><div class="t m0 x12 h8 y39 ff1 fs5 fc0 sc0 ls0 ws0">system to detect if an intrusion has occurred. The intrusion</div><div class="t m0 x12 h8 y3a ff1 fs5 fc0 sc0 ls0 ws0">detection mechanisms complement the intrusion prevention</div><div class="t m0 x12 h8 y3b ff1 fs5 fc0 sc0 ls0 ws0">measures and help enhance the security of the networks. The</div><div class="t m0 x12 h8 y3c ff1 fs5 fc0 sc0 ls0 ws0">intrusion, in the case of DoS attacks is often manifested</div><div class="t m0 x12 h8 y3d ff1 fs5 fc0 sc0 ls0 ws0">as non-availability of the network infrastructure. In order to</div><div class="t m0 x12 h8 y3e ff1 fs5 fc0 sc0 ls0 ws0">detect DoS attacks, conventional systems use a network IDS</div><div class="t m0 x12 h8 y3f ff1 fs5 fc0 sc0 ls0 ws0">that resides in a gateway node and monitors the network for</div><div class="t m0 x12 h8 y40 ff1 fs5 fc0 sc0 ls0 ws0">abnormal network behavior. In a wireless ad hoc network, a</div><div class="t m0 x12 h8 y41 ff1 fs5 fc0 sc0 ls0 ws0">dedicated gateway node cannot be assumed because of the</div><div class="t m0 x12 h8 y42 ff1 fs5 fc0 sc0 ls0 ws0">transient nature of the network.</div><div class="t m0 x13 h8 y43 ff1 fs5 fc0 sc0 ls0 ws0">Additionally, it is difﬁcult to identify intrusions in these</div><div class="t m0 x12 h8 y44 ff1 fs5 fc0 sc0 ls0 ws0">networks as nodes may fail to provide services due to genuine</div><div class="t m0 x12 h8 y45 ff1 fs5 fc0 sc0 ls0 ws0">reasons such as network congestion, link failure or topology</div><div class="t m0 x12 h8 y46 ff1 fs5 fc0 sc0 ls0 ws0">changes, thus causing high false positives. For example, a</div><div class="t m0 x12 h8 y47 ff1 fs5 fc0 sc0 ls0 ws0">node could drop a packet due to collision attack caused by</div><div class="t m0 x12 h8 y48 ff1 fs5 fc0 sc0 ls0 ws0">a malicious entity or simply due to poor channel conditions.</div><div class="t m0 x12 h8 y49 ff1 fs5 fc0 sc0 ls0 ws0">Also, DoS attacks could be launched at multiple layers of the</div><div class="t m0 x12 h8 y4a ff1 fs5 fc0 sc0 ls0 ws0">protocol suite (Table I). By detecting abnormal behavior at</div><div class="t m0 x12 h8 y4b ff1 fs5 fc0 sc0 ls0 ws0">different layers and using information across layers, we can</div><div class="t m0 x12 h8 y4c ff1 fs5 fc0 sc0 ls0 ws0">detect malicious nodes with increasing accuracy.</div><div class="t m0 x13 h8 y4d ff1 fs5 fc0 sc0 ls0 ws0">In this paper, we provide a host based IDS that resides in</div><div class="t m0 x12 h8 y4e ff1 fs5 fc0 sc0 ls0 ws0">every host and monitors its local neighborhood for abnormali-</div><div class="t m0 x12 h8 y4f ff1 fs5 fc0 sc0 ls0 ws0">ties in the network activities. We develop a cross-layer design</div><div class="t m0 x12 h8 y50 ff1 fs5 fc0 sc0 ls0 ws0">framework that will exchange the detection information across</div><div class="t m0 x12 h8 y51 ff1 fs5 fc0 sc0 ls0 ws0">the layers and trigger multiple levels of detection. This enables</div><div class="t m0 x12 h8 y52 ff1 fs5 fc0 sc0 ls0 ws0">the IDS to make a more informed decision about the intrusion</div><div class="t m0 x12 h8 y53 ff1 fs5 fc0 sc0 ls0 ws0">in the network. We simulate our approach using GloMoSim</div><div class="t m0 x12 h8 y54 ff1 fs5 fc0 sc0 ls0 ws0">for proof of concept. Results indicate that attacks are detected</div><div class="t m0 x12 h8 y55 ff1 fs5 fc0 sc0 ls0 ws0">at a higher percentage with considerable reduction in false</div><div class="t m0 x12 h8 y56 ff1 fs5 fc0 sc0 ls0 ws0">positives.</div><div class="t m0 x14 h9 y57 ff1 fs2 fc0 sc0 ls0 ws0">TABLE I</div><div class="t m0 x15 h9 y58 ff1 fs2 fc0 sc0 ls0 ws0">DENIAL OF SERVICE ATTACKS</div><div class="t m0 x16 h9 y59 ff1 fs2 fc0 sc0 ls0 ws0">Protocol layer DoS Attacks</div><div class="t m0 x17 h9 y5a ff1 fs2 fc0 sc0 ls0 ws0">Link Layer Collision</div><div class="t m0 x15 h9 y5b ff1 fs2 fc0 sc0 ls0 ws0">Network Layer Packet Drop</div><div class="t m0 x18 h9 y5c ff1 fs2 fc0 sc0 ls0 ws0">Misdirection</div><div class="t m0 x13 h8 y5d ff1 fs5 fc0 sc0 ls0 ws0">The remainder of the paper is organized as follows. Section</div><div class="t m0 x12 h8 y5e ff1 fs5 fc0 sc0 ls0 ws0">II discusses the related work. Section III gives the threat</div><div class="t m0 x12 h8 y5f ff1 fs5 fc0 sc0 ls0 ws0">model and the assumptions used in this work. Section IV</div><div class="t m0 x12 h8 y60 ff1 fs5 fc0 sc0 ls0 ws0">describes the proposed cross-layer design approach. Section</div><div class="t m0 x12 h8 y61 ff1 fs5 fc0 sc0 ls0 ws0">V presents a detailed analysis of the collision detection algo-</div><div class="t m0 x12 h8 y62 ff1 fs5 fc0 sc0 ls0 ws0">rithm implemented. Section VI and VII details the detection</div><div class="c x19 y63 w2 ha"><div class="t m1 x0 hb y64 ff6 fs7 fc0 sc0 ls0 ws0">0-7803-9466-6/05/$20.00 ©2005 IEEE MASS 2005 Workshop - WSNS05</div></div></div><div class="pi" data-data='{"ctm":[1.611639,0.000000,0.000000,1.611639,0.000000,0.000000]}'></div></div> </body> </html>

<div id="pf2" class="pf w0 h0" data-page-no="2"><div class="pc pc2 w0 h0"><img class="bi x0 y0 w1 h1" alt="" src="https://static.pudn.com/prod/directory_preview_static/625f96ae8cbeb85d5766461a/bg2.jpg"><div class="t m0 x10 h8 y65 ff1 fs5 fc0 sc0 ls0 ws0">procedure for packet drop and the misdirection attack. Section</div><div class="t m0 x10 h8 y66 ff1 fs5 fc0 sc0 ls0 ws0">VIII elaborates the working of the intrusion detection module.</div><div class="t m0 x10 h8 y67 ff1 fs5 fc0 sc0 ls0 ws0">Section IX illustrates the simulation results and analysis.</div><div class="t m0 x10 h8 y68 ff1 fs5 fc0 sc0 ls0 ws0">Section X concludes the paper.</div><div class="t m0 x1a h8 y69 ff1 fs5 fc0 sc0 ls0 ws0">II. RELATED WORK</div><div class="t m0 xf h8 y6a ff1 fs5 fc0 sc0 ls0 ws0">Intrusion detection systems in both wired and wireless</div><div class="t m0 x10 h8 y6b ff1 fs5 fc0 sc0 ls0 ws0">networks commonly adopt an anomaly or misuse based de-</div><div class="t m0 x10 h8 y6c ff1 fs5 fc0 sc0 ls0 ws0">tection. Misuse detection systems are accurate in identifying</div><div class="t m0 x10 h8 y6d ff1 fs5 fc0 sc0 ls0 ws0">the known attacks and has low false positives but cannot detect</div><div class="t m0 x10 h8 y6e ff1 fs5 fc0 sc0 ls0 ws0">newly invented attacks. Anomaly based detection schemes are</div><div class="t m0 x10 h8 y6f ff1 fs5 fc0 sc0 ls0 ws0">more effective in detecting unknown attacks however they</div><div class="t m0 x10 h8 y70 ff1 fs5 fc0 sc0 ls0 ws0">often result in high false positives. In recent years, several</div><div class="t m0 x10 h8 y71 ff1 fs5 fc0 sc0 ls0 ws0">approaches such as reputation based schemes and watchdog</div><div class="t m0 x10 h8 y72 ff1 fs5 fc0 sc0 ls0 ws0">mechanisms have been proposed in the literature to aid the</div><div class="t m0 x10 h8 y73 ff1 fs5 fc0 sc0 ls0 ws0">detection process in IDS systems [3], [4].</div><div class="t m0 xf h8 y74 ff1 fs5 fc0 sc0 ls0 ws0">Michiardi and Molva [3] use passive eavesdropping to</div><div class="t m0 x10 h8 y75 ff1 fs5 fc0 sc0 ls0 ws0">isolate the misbehaving nodes and assign reputation to the</div><div class="t m0 x10 h8 y76 ff1 fs5 fc0 sc0 ls0 ws0">nodes such that only good nodes in the network are trusted.</div><div class="t m0 x10 h8 y77 ff1 fs5 fc0 sc0 ls0 ws0">Marti et al [4] proposed the popular watchdog mechanism to</div><div class="t m0 x10 h8 y78 ff1 fs5 fc0 sc0 ls0 ws0">monitor the neighbor nodes and detect misbehavior in order to</div><div class="t m0 x10 h8 y79 ff1 fs5 fc0 sc0 ls0 ws0">reliably route packets around the good nodes in the network.</div><div class="t m0 x10 h8 y7a ff1 fs5 fc0 sc0 ls0 ws0">This work however fails to differentiate the misbehaviors</div><div class="t m0 x10 h8 y7b ff1 fs5 fc0 sc0 ls0 ws0">caused in nodes due to collisions, collusions and other reasons.</div><div class="t m0 x10 h8 y7c ff1 fs5 fc0 sc0 ls0 ws0">Kachirski and Guha [5], propose the idea of a distributed IDS</div><div class="t m0 x10 h8 y7d ff1 fs5 fc0 sc0 ls0 ws0">where cluster heads are elected and the IDS functionality is</div><div class="t m0 x10 h8 y7e ff1 fs5 fc0 sc0 ls0 ws0">distributed among them. This approach minimizes the total</div><div class="t m0 x10 h8 y7f ff1 fs5 fc0 sc0 ls0 ws0">processing time spent by each node. However, it may not be a</div><div class="t m0 x10 h8 y80 ff1 fs5 fc0 sc0 ls0 ws0">suitable approach in an ad hoc network scenario, where care</div><div class="t m0 x10 h8 y81 ff1 fs5 fc0 sc0 ls0 ws0">should be taken to avoid malicious cluster heads or prevent</div><div class="t m0 x10 h8 y82 ff1 fs5 fc0 sc0 ls0 ws0">cluster heads from being compromised.</div><div class="t m0 xf h8 y83 ff1 fs5 fc0 sc0 ls0 ws0">The necessity of accurately identifying the cause of misbe-</div><div class="t m0 x10 h8 y84 ff1 fs5 fc0 sc0 ls0 ws0">havior has recently gained some attention [2], [6]. Rao and</div><div class="t m0 x10 h8 y85 ff1 fs5 fc0 sc0 ls0 ws0">Kesidis [6], differentiate intruder behavior in the network that</div><div class="t m0 x10 h8 y86 ff1 fs5 fc0 sc0 ls0 ws0">cause DoS attacks from the congestion behavior of the nodes</div><div class="t m0 x10 h8 y87 ff1 fs5 fc0 sc0 ls0 ws0">by selecting trafﬁc transmission patterns and by performing</div><div class="t m0 x10 h8 y88 ff1 fs5 fc0 sc0 ls0 ws0">veriﬁcation at the receiver. However, this approach may not</div><div class="t m0 x10 h8 y89 ff1 fs5 fc0 sc0 ls0 ws0">be suitable for bandwidth limited ad hoc networks.</div><div class="t m0 xf h8 y8a ff1 fs5 fc0 sc0 ls0 ws0">Most of the existing intrusion detection techniques focus</div><div class="t m0 x10 h8 y8b ff1 fs5 fc0 sc0 ls0 ws0">on identifying the abnormalities in the network by placing</div><div class="t m0 x10 h8 y8c ff1 fs5 fc0 sc0 ls0 ws0">the detection module at a particular layer of the protocol</div><div class="t m0 x10 h8 y8d ff1 fs5 fc0 sc0 ls0 ws0">stack, mostly the network layer. The vulnerabilities of multiple</div><div class="t m0 x10 h8 y8e ff1 fs5 fc0 sc0 ls0 ws0">layers in the wireless ad hoc network (as shown in Table I)</div><div class="t m0 x10 h8 y8f ff1 fs5 fc0 sc0 ls0 ws0">has necessitated the need for an integrated intrusion detection</div><div class="t m0 x10 h8 y90 ff1 fs5 fc0 sc0 ls0 ws0">module that runs across the different layers of the protocol</div><div class="t m0 x10 h8 y91 ff1 fs5 fc0 sc0 ls0 ws0">stack. Zhang and Lee [2], develop a cross-layer based IDS</div><div class="t m0 x10 h8 y92 ff1 fs5 fc0 sc0 ls0 ws0">architecture to study the abnormalities in the network using</div><div class="t m0 x10 h8 y93 ff1 fs5 fc0 sc0 ls0 ws0">anomaly detection. They introduce the concept of integrating</div><div class="t m0 x10 h8 y94 ff1 fs5 fc0 sc0 ls0 ws0">multiple layers of the protocol stack for efﬁcient intrusion</div><div class="t m0 x10 h8 y95 ff1 fs5 fc0 sc0 ls0 ws0">detection.</div><div class="t m0 xf h8 y96 ff1 fs5 fc0 sc0 ls0 ws0">Liu et al [7] recently proposed a cross-layer based anomaly</div><div class="t m0 x10 h8 y97 ff1 fs5 fc0 sc0 ls0 ws0">detection by adapting a rule based data mining technique. In</div><div class="t m0 x10 h8 y98 ff1 fs5 fc0 sc0 ls0 ws0">this work, a speciﬁc feature set is deﬁned to proﬁle normal</div><div class="t m0 x10 h8 y99 ff1 fs5 fc0 sc0 ls0 ws0">user behavior by correlating information obtained from the</div><div class="t m0 x10 h8 y9a ff1 fs5 fc0 sc0 ls0 ws0">MAC and the network layers. The IDS system developed is</div><div class="t m0 x10 h8 y9b ff1 fs5 fc0 sc0 ls0 ws0">effective in localizing the attacks within one hope perimeter.</div><div class="t m0 x10 h8 y9c ff1 fs5 fc0 sc0 ls0 ws0">Inter layer interactions can be exploited in numerous ways for</div><div class="t m0 x12 h8 y9d ff1 fs5 fc0 sc0 ls0 ws0">detecting intrusions in the wireless ad hoc networks. To the</div><div class="t m0 x12 h8 y9e ff1 fs5 fc0 sc0 ls0 ws0">best of our knowledge a multi-layer detection module has not</div><div class="t m0 x12 h8 y9f ff1 fs5 fc0 sc0 ls0 ws0">been utilized to detect DoS attacks in ad hoc networks. In</div><div class="t m0 x12 h8 ya0 ff1 fs5 fc0 sc0 ls0 ws0">our work, we provide a novel cross-layer detection model to</div><div class="t m0 x12 h8 ya1 ff1 fs5 fc0 sc0 ls0 ws0">detect malicious behavior of nodes using information from one</div><div class="t m0 x12 h8 ya2 ff1 fs5 fc0 sc0 ls0 ws0">layer in another layer. We also distinguish between the normal</div><div class="t m0 x12 h8 ya3 ff1 fs5 fc0 sc0 ls0 ws0">and malicious behavior of nodes thus enhancing the detection</div><div class="t m0 x12 h8 ya4 ff1 fs5 fc0 sc0 ls0 ws0">accuracy. In this paper, we speciﬁcally target the detection of</div><div class="t m0 x12 h8 ya5 ff1 fs5 fc0 sc0 ls0 ws0">DoS attacks in the link and the network layers.</div><div class="t m0 x1b h8 ya6 ff1 fs5 fc0 sc0 ls0 ws0">III. THREAT MODEL AND ASSUMPTIONS</div><div class="t m0 x13 h8 ya7 ff1 fs5 fc0 sc0 ls0 ws0">In this section, we discuss the nature of the adversary model</div><div class="t m0 x12 h8 ya8 ff1 fs5 fc0 sc0 ls0 ws0">considered in our work. Some basic assumptions are:</div><div class="t m0 x13 h8 ya9 ff1 fs5 fc0 sc0 ls0 ws0">1) The adversary node attacks the infrastructure by denying</div><div class="t m0 x1c h8 yaa ff1 fs5 fc0 sc0 ls0 ws0">service availability to the nodes in the network.</div><div class="t m0 x13 h8 yab ff1 fs5 fc0 sc0 ls0 ws0">2) The adversary node is limited in terms of its energy</div><div class="t m0 x1c h8 yac ff1 fs5 fc0 sc0 ls0 ws0">resources just as any other node in the network.</div><div class="t m0 x13 h8 yad ff1 fs5 fc0 sc0 ls0 ws0">3) Number of adversary nodes do not outnumber the good</div><div class="t m0 x1c h8 yae ff1 fs5 fc0 sc0 ls0 ws0">nodes in the wireless network.</div><div class="t m0 x13 h8 yaf ff1 fs5 fc0 sc0 ls0 ws0">4) The adversary node may or may not be an authenticated</div><div class="t m0 x1c h8 yb0 ff1 fs5 fc0 sc0 ls0 ws0">member of the network.</div><div class="t m0 x13 h8 yb1 ff1 fs5 fc0 sc0 ls0 ws0">We brieﬂy describe each of the DoS attacks in consideration.</div><div class="t m0 x13 h8 yb2 ff7 fs5 fc0 sc0 ls0 ws0">Collision: In wireless networks, the channel is reserved for</div><div class="t m0 x12 h8 yb3 ff1 fs5 fc0 sc0 ls0 ws0">transmission through RTS/CTS packets. In spite of the channel</div><div class="t m0 x12 h8 yb4 ff1 fs5 fc0 sc0 ls0 ws0">reservation, an adversary node can induce a collision in the</div><div class="t m0 x12 h8 yb5 ff1 fs5 fc0 sc0 ls0 ws0">wireless channel by transmitting when another node in its</div><div class="t m0 x12 h8 yb6 ff1 fs5 fc0 sc0 ls0 ws0">range is already in transmission. The purpose of this attack</div><div class="t m0 x12 h8 yb7 ff1 fs5 fc0 sc0 ls0 ws0">is to either prevent access to a certain node or to exhaust the</div><div class="t m0 x12 h8 yb8 ff1 fs5 fc0 sc0 ls0 ws0">transmitting node’s resources by continuous retransmissions.</div><div class="t m0 x13 h8 yb9 ff7 fs5 fc0 sc0 ls0 ws0">Packet drop: The adversary node can randomly drop either</div><div class="t m0 x12 h8 yba ff1 fs5 fc0 sc0 ls0 ws0">the control or data packets at the network layer. This results</div><div class="t m0 x12 h8 ybb ff1 fs5 fc0 sc0 ls0 ws0">in denying service to the destination node, hence affecting the</div><div class="t m0 x12 h8 ybc ff1 fs5 fc0 sc0 ls0 ws0">availability of the node.</div><div class="t m0 x13 h8 ybd ff7 fs5 fc0 sc0 ls0 ws0">Misdirection: Misdirection attack occurs when the adversary</div><div class="t m0 x12 h8 ybe ff1 fs5 fc0 sc0 ls0 ws0">node forwards the data packet to the wrong destination node.</div><div class="t m0 x12 h8 ybf ff1 fs5 fc0 sc0 ls0 ws0">In another kind of misdirection attack, the adversary node can</div><div class="t m0 x12 h8 yc0 ff1 fs5 fc0 sc0 ls0 ws0">deny the availability of an existing route to the destination by</div><div class="t m0 x12 h8 yc1 ff1 fs5 fc0 sc0 ls0 ws0">sending false Route Error (RERR) messages thus preventing</div><div class="t m0 x12 h8 yc2 ff1 fs5 fc0 sc0 ls0 ws0">service to the destination in the absence of alternate routes.</div><div class="t m0 x13 h8 yc3 ff1 fs5 fc0 sc0 ls0 ws0">In our adversary model, (speciﬁc to the DoS attacks in Table</div><div class="t m0 x12 h8 yc4 ff1 fs5 fc0 sc0 ls0 ws0">I) we assume that the adversary can launch any and all of</div><div class="t m0 x12 h8 yc5 ff1 fs5 fc0 sc0 ls0 ws0">the attacks discussed above. However, because the collision</div><div class="t m0 x12 h8 yc6 ff1 fs5 fc0 sc0 ls0 ws0">attack involves the adversary node expending a large amount</div><div class="t m0 x12 h8 yc7 ff1 fs5 fc0 sc0 ls0 ws0">of energy of its own, it is assumed that the number of times</div><div class="t m0 x12 h8 yc8 ff1 fs5 fc0 sc0 ls0 ws0">the adversary repeats the collision attack is less. Other Denial</div><div class="t m0 x12 h8 yc9 ff1 fs5 fc0 sc0 ls0 ws0">of Service attacks such as packet drop and misdirection are</div><div class="t m0 x12 h8 yca ff1 fs5 fc0 sc0 ls0 ws0">assumed to occur more frequently in the network.</div><div class="t m0 x1d h8 ycb ff1 fs5 fc0 sc0 ls0 ws0">IV. CROSS-LAYER BASED INTRUSION DETECTION (CIDS)</div><div class="t m0 x13 h8 ycc ff1 fs5 fc0 sc0 ls0 ws0">In this work, we propose a novel cross-layer based intrusion</div><div class="t m0 x12 h8 ycd ff1 fs5 fc0 sc0 ls0 ws0">detection system (CIDS) that exploits information across the</div><div class="t m0 x12 h8 yce ff1 fs5 fc0 sc0 ls0 ws0">layers to effectively identify an intrusion. Multiple levels of</div><div class="t m0 x12 h8 ycf ff1 fs5 fc0 sc0 ls0 ws0">detection is performed across different layers of the protocol</div><div class="t m0 x12 h8 yd0 ff1 fs5 fc0 sc0 ls0 ws0">stack before conﬁrming the malicious behavior of the nodes,</div><div class="t m0 x12 h8 yd1 ff1 fs5 fc0 sc0 ls0 ws0">thus reducing false positives. Also, the approach leads to an</div><div class="t m0 x12 h8 yd2 ff1 fs5 fc0 sc0 ls0 ws0">increase in the number of nodes detected correctly, hence</div><div class="t m0 x12 h8 y62 ff1 fs5 fc0 sc0 ls0 ws0">increasing the true positives in the network.</div></div><div class="pi" data-data='{"ctm":[1.611639,0.000000,0.000000,1.611639,0.000000,0.000000]}'></div></div>