Reputation-based cross-layer intrusion detection system for wormhole attacks in wireless mesh networks


ABSTRACT

Wireless mesh networks provide long-distance wireless network connectivity over heterogeneous devices for greater scalability and availability. However, protecting legitimate long-distance wireless links from wormhole attacks is an important yet challenging security issue in wireless mesh networks. In this paper, we propose a reputation-based cross-layer intrusion detection system to effectively detect various wormhole attacks. The proposed system analyses the behaviours of the routing paths in wireless mesh networks to correctly isolate the malicious wormhole paths from legitimate long-distance wireless links. It uses reputation and cross-layer parameters for comprehensive ability to isolate the wormhole attacks in routing paths. This isolation ensures full utilisation of legitimate long-distance wireless links in wireless mesh networks, which is not possible with the existing wormhole attack detection approaches. Experimental results show that the proposed system increases the detection rate, decreases the false alarm rate, and secures legitimate long-distance wireless links in wireless mesh networks. Copyright © 2014 John Wiley & Sons, Ltd.
Keywords:
  • long-distance communications;
  • reputation;
  • intrusion detection;
  • goodput;
  • packet collisions

Comments

Post a Comment

Popular posts from this blog

NS2 Code for Blackhole Attack (multiple blackholes) in AODV Protocol

Image
Workshop on Cyber Security and Forensics (16th to 20th August 2016) http://svecw.edu.in/docs/CSEFDPCS.pdf   Workshop on Big Data Analytics (2nd to 6th August 2016) http://svecw.edu.in/docs/CSEFDPBigDataAnalytics2016.pdf The following scenario consists of 25 nodes, in which 1,7 and 13 nodes are blackholenodes and other nodes are non-malicious.           To create multiple blackhole   attackers in AODV protocol     i)              In aodv.h the following blue colour lines needs to be added to define balckhole attackers      /*        * History management        */      double                PerHopTime(aodv_rt_entry *rt); nsaddr_t malicious1; nsaddr_t malicious2; nsaddr_t malicious3;     ii)             In   aodv.cc the following blue colour lines needs to be added to initialize the attackers   int AODV::command(intargc, const char*const* argv) { if(argc == 2) { Tcl&tcl = Tcl::instance(); if(strncasecmp(argv[1]
Read more

NS2 code for Rushing attacks (Jellyfish and Byzantine attacks)

Image
Workshop on Cyber Security and Forensics (16th to 20th August 2016) http://svecw.edu.in/docs/CSEFDPCS.pdf    Workshop on Big Data Analytics (2nd to 6th August 2016) http://svecw.edu.in/docs/CSEFDPBigDataAnalytics2016.pdf Rushing attack   Rushing attack is a zero delay attack andmore effective when the attacker nearby source or destination node.On-demand routing protocols like AODV and DSR are more vulnerable to this attack, because whenever source nodefloods the route request packet in the network, an adversary nodereceives the route request packet and sends without any hop_count update and delay intothe network. Whenever the legitimate nodes receive the originalsource request packets, they are dropped because legitimate nodes,would have already received packet from the attacker and treat the currently received packets asduplicate packets. Thus, adversary is included in active routeand disturbs the data forwarding phase. Rushing attack can be takenplace at source side o
Read more

Intrusion Detection Technique for Wormhole and Following Jellyfish and Byzantine Attacks in Wireless Mesh Network

Abstract Wireless Mesh Networks (WMNs) have emerging application because of its ad-hoc features, high internet bandwidth capability, and interoperable with various networks. However, all features of WMNs vulnerable due to their inadequate security services, and most of the existing techniques protect WMNs from single adversary node, but failed to protect colluding attacks. We proposed new Intrusion Detection (ID) technique, to protect the WMNs from wormhole attack (colluding attack) and following jellyfish and byzantine attacks. The proposed ID technique works based on different delays such as initial end-to-end packet delay, average end-to-end packet delay, and worst case end-to-end packet delay because wormhole attackers attract the network nodes by sending lower latency. Eventually, simulation results show that, our ID technique improves throughput of the network, when source and destination nodes detect and isolate (select new path which does not contain adversaries) the adver
Read more