Anda di halaman 1dari 6

44

International Journal of Research and Reviews in Computer Science (IJRRCS) Vol. 1, No. 3, September 2010

Secured Packet Transmission by implementing


Enhanced IDS in MANET
1
S..Vardhaganapathy, 2 A.M.Natarajan
1
Department of Information Technology Kongu Engineering College Perundurai
svg@kongu.ac.in
2
Department of Electronics and Communication Engineering, Bannari Amman Institute of
Technology, Sathyamangalam

defense, separating nodes into trusted and non-trusted. Such


Abstract: MANET is a self-configuring network of mobile routers a distinction would have been based on a security policy, the
connected by wireless links. Routers are free to move randomly and possession of the necessary credentials and the ability for
organize themselves arbitrarily. Topology change occurs rapidly nodes to validate them. In the MANET context, there may be
and unpredictably in the MANET due to mobility of nodes and due
to ad hoc criteria. MANET needs no infrastructure for
no ground for an apriori classification, since all nodes are
intercommunication. In ad hoc networks, misuse detection relies on required to cooperate in supporting the network operation,
the use of unauthorized known patterns. The most concern while no prior security association can be assumed for all the
requirement is to detect intrusion when the transmitted traffic network nodes.
contains abnormal packets based on signatures of attacks. For The presence of even a small number of adversarial nodes
deploying misuse detection, nodes should execute the sniffing and could result in repeatedly compromised routes, and, as a
analyze software modules. Mobility is often a problem for
providing security services in ad hoc networks. Numerous protocols
result, the network nodes would have to rely on cycles of
exist for forming ad hoc networks among cooperative mobile, time-out and new route discoveries to communicate. This
radio-equipped nodes. There are more possibilities of attacks by would incur arbitrary delays before the establishment of a
multiple mobile intruders. Providing higher security for the mobile non-corrupted path, while successive broadcasts of route
users is partially possible by different algorithms like distributed requests would impose excessive transmission overhead. In
polynomial and complexity selection algorithms. The existing particular, intentionally falsified routing messages would
solution uses an algorithm GODOM (GeOmetric DOMinated set) to
find out more number of active nodes. However geometric domains
result in a denial-of-service (DoS) experienced by the end
with even spaces were carried out for the resultant intrusion nodes. The proposed scheme combats such types of
detection. The proposed work aims to provide an enhanced version misbehavior and safeguards the acquisition of topological
of GODOM algorithm in the uneven geometric subspaces. The information.
status IDS will checkout every packet using some threshold values
and if the packet transmission crosses the threshold values then that 1.1. Secured Packet Transmission
packet is marked as an abnormal packet. The proposed system has
many advantages such as finding more number of active nodes,
improved status based IDS which detects more number of DSR To secure the data transmission phase, Secure Message
attacks with higher efficiency and lower cost of execution. Transmission (SMT) provides an end-to-end secure data
forwarding protocol tailored to the MANET communication
1. Introduction requirements. The secure message transmission protocol
safeguards pair-wise communication across an unknown
The emergence of the Mobile Ad Hoc Networking frequently changing network, possibly in the presence of
(MANET) technology advocates self-organized wireless adversaries that may exhibit arbitrary behavior. It combines
interconnection of communication devices that would either four elements, end-to-end secure and robust feedback
extend or operate in concert with the wired networking mechanism, dispersion of the transmitted data, simultaneous
infrastructure or, possibly, evolve to autonomous networks. usage of multiple paths, and adaptation to the network
In either case, the proliferation of MANET-based changing conditions. SMT detects and tolerates
applications depends on a multitude of factors, with compromised transmissions, while adapting its operation to
trustworthiness being one of the primary challenges to be provide secure data forwarding with low delays. The goal is
met. Despite the existence of well-known security to ensure secure routing over available routes, despite of the
mechanisms, additional vulnerabilities and features pertinent presence of adversaries.
to this new networking paradigm might render such
traditional solutions inapplicable. The provision of security 1.2. Security Requirements in MANET
services in the MANET context faces a set of challenges
specific to this new technology. The insecurity of the One way to counter security attacks would be to
wireless links, energy constraints, relatively poor physical cryptographically protect and authenticate all control and
protection of nodes in a hostile environment, and the data traffic. But to accomplish this, nodes would have to
vulnerability of statically configured security schemes have have the means to establish the necessary trust relationships
been identified as such challenges. The absence of with each and every peer they are transiently associated with,
infrastructure and the consequent absence of authorization including nodes that just forward their data. Even if this were
facilities impede the usual practice of establishing a line of feasible, such cryptographic protection cannot be effective
45
International Journal of Research and Reviews in Computer Science (IJRRCS) Vol. 1, No. 3, September 2010

against denial of service attacks, with adversaries simply network. For these reasons, the IDS of MANET should have
discarding data packets. The security requirements in ad hoc characteristics that follow these natures, distributed and
networks are similar to those in other networks. The goal is collaborative. Advantage using distributed architecture is the
to protect information transmitted and resources in the security accident can be detected earlier. However, this
network from malicious activities (Deng et al, 2002). These architecture needs huge resources, which is difficult to be
requirements include availability of network services, implemented in small wireless devices such as PDA.
authentication of the users in order to ensure that a malicious The existing MANET IDSs have various methods to detect
user cannot masquerade as a trusted user, confidentiality of and to respond regarding these attacks. The proposed IDSs
the information transmitted in the network, integrity of the are designed for detecting the intrusion activities in the
information in order to ensure that the information is not routing protocol of MANET. The proposed one extends the
modified by an unauthorized entity and non-repudiation in GODOM algorithm on MANET to detect misbehavior nodes
order to ensure that a node cannot refuse the sending of a and reacted if they originated from outside community’s
message that it originated (Subhadrabandhu et al., 2004). network or inside (both the cases). The proposed IDS in DSR
has the following advantages compared to existing GODOM
1.3 Intrusion Detection System a. Effective coverage of given network terrain to detect
attacks, (Uncovered subspaces)
An Intrusion Detection System (IDS) is software and/or b. Detect more number of DSR attacks, and
hardware designed to detect unwanted attempts (Alia c. Higher efficiency and lower cost of execution
Fourati, Khaldoun Al Agha, 2007) at accessing, There are three main types of systems in which IDS can be
manipulating, and/or disabling computer systems, mainly used. They are network, applications and hosts. In a network-
through a network, such as the Internet. These attempts may based intrusion-detection system (NIDS), the sensors are
take the form of attacks, as examples, by crackers, malware located at choke points in network to be monitored, often in
and/or disgruntled employees. An IDS cannot directly detect the demilitarized zone (DMZ) or at network borders. The
attacks within properly encrypted traffic. An intrusion sensor captures all network traffic and analyzes the content
detection system is used to detect several types of malicious of individual packets for malicious traffic. In systems, PIDS
behaviors that can compromise the security and trust of a and APIDS[2] are used to monitor the transport and
computer system. This includes network attacks against protocols for illegal or inappropriate traffic or constructs of a
vulnerable services, data driven attacks on applications, host language. For example, forged SQL queries attempt to delete
based attacks such as privilege escalation, unauthorized database records, virus in emails.
logins and access to sensitive files, and malware (viruses, In a host-based system, the sensor usually consists of a
trojan horses, and worms). software agent, which monitors all activity of the host on
An IDS can be composed of several components: Sensors which it is installed. For example, attempt to modify the
which generate security events, a console to monitor events master boot record, key logger, file access. Depending on the
and alerts and control the sensors, and a central engine that detection techniques used, IDS can be classified into three
records events logged by the sensors in a database and use a main categories (A. Hijazi and N. Nasser 2005) signature or
system of rules to generate alerts from security events misuse based IDS, anomaly based IDS, and specification
received. There are several ways to categorize IDS based IDS, which is a hybrid both of the signature and the
depending on the type and location of the sensors and the anomaly based IDS.
methodology used by the engine to generate alerts. In many The signature-based IDS uses pre-known attack scenarios (or
simple IDS implementations all three components are signatures) and compare them with incoming packets traffic.
combined in a single device or appliance. There are several approaches in the signature detection,
which they differ in representation and matching algorithm
2. Related Work employed to detect the intrusion patterns. The detection
approaches, such as expert system (T. F. Lunt, R.
The classification among the proposed IDS of Jagannathan – 1998) , pattern recognition (M. Esposito, C.
MANET can be composed using the parameters discussed in Mazzariello, 2005), colored Petri nets (S. Kumar and E.
the previous sections, i.e.: architecture, attacks, and IDS Spafford, 1994), and state transition analysis (P.A. Porras
detection techniques [2]. Most of the MANET IDSs tend to and R. Kemmerer, 1992) are grouped on the misuse.
have the distributed architectures and their variants. The IDS Meanwhile, the anomaly-based IDS attempts (Bo Sun
architecture may depend on the network infrastructure. But And Lawrence Osborne, Yang Xiao, Sghaier Guizani, 2007)
the most important thing is the reasons the architecture to be to detect activities that differ from the normal expected
configured in distributed manner. system behavior. This detection has several techniques, i.e.:
As the nature of MANET is so open, attacks can be statistics (P. Porras and A. Valdes, 1998), neural networks
generated from any node within the MANET itself or nodes (H. Debar, M. Becker and D. Siboni 1992), and other
of neighboring networks. Unfortunately, this network lacks techniques such as Chi-square test utilization (N. Ye, X. Li,
in central administration. It is difficult for implementing 2001).The specification-based IDS monitors current behavior
firewall or the IDS on the strategic points. Moreover, each of systems according to specifications that describe desired
node can work as client, server or router. Delivery packets functionality for security-critical entities (C. Ko, J. Rowe, P.
need collaboration work among the nodes participating in the
46
International Journal of Research and Reviews in Computer Science (IJRRCS) Vol. 1, No. 3, September 2010

Brutch, K. Levitt 2001). A mismatch between current 4. Geometric Dominated Set Algorithm
behavior and the specifications will be reported as an attack.
In misuse detection (Signature detection) each instance in a The GODOM algorithm uses a special technique to find the
data set is labeled as “normal” or “intrusive” and a learning active insider nodes called dominated set, meaning that
algorithm is trained over the labeled data. These techniques giving supremacy to the particular nodes in which they help
are able to automatically retrain intrusion detection models to monitor the network threats. In control flow graphs, a
on different input data that include new types of attacks; as node 'd' dominates a node 'n' if every path from the start node
long as they have been labeled appropriately. Unlike to 'n' must go through 'd’. Every node dominates itself. The
signature-based IDS [9], models of misuse are created dominators of a node 'n' are given by the maximal solution to
automatically and can be more sophisticated and precise than the following data-flow equations: Where, 'n_0' is the start
manually created signatures. (Subhadrabandhu, D., S. Sarkar node, the dominator of the start node is the start node itself.
and F. Anjum, 2004) The signature IDS [9] has high degree The set of dominators for any other node 'n' is the
of accuracy in detecting known attacks and their variants. Its intersection of the set of dominators for all predecessors 'p of
disadvantage is that it cannot detect unknown intrusions and n'.
they rely on signatures extracted by human experts. This Dominated set pseudocode algorithm solution:
method uses specifically known patterns of unauthorized // Dominator of the start node is the start itself
behavior to predict and detect subsequent similar attempts. Dom (n_0) = {n_0}
These specific patterns are called signatures. // for all other nodes, set all nodes as the dominators
For host based intrusion detection [10], one example of a for each n in N - {n_0}
signature is "three failed logins". For network intrusion Dom (n) =N;
detection, a signature can be as simple as a specific pattern // iteratively eliminate nodes that are not dominators
that matches a portion of a network packet. The occurrence While changes in any Dom (n)
of a signature might not signify an actual attempted for each n in N - {n_0} :
unauthorized access. Depending on the robustness and Dom (n) = {n} union with intersection over all p in
seriousness of a signature that is triggered, some alarm, predom (n) of Dom (p)
response, or notification should be sent to the proper Direct solution is quadratic in the number of nodes, or O
authorities (n2).
This algorithm, which is almost linear, but its
3. Proposed System implementation tends to be not much more complex and time
consuming for a graph of several 100 nodes or less. The
The proposed work presents an enhanced GODOM proposed algorithm uses geometric information to select the
algorithm for secured packet transmission in DSR protocol. IDS active insiders. This heuristic can be used in topologies
It improves the effective detection coverage in the given where all insiders have equal transmission ranges denoted as
ad hoc network scenario. It also improvises the GODOM 'r'. Thus, 2 insiders are neighbors if and only if the distance
algorithm to handle intrusion attacks even in undefined between them is less than or equal to 'r'. The network is
geometric subspaces. covered by the minimum possible number of circles each
Every communicative node is able to reach the active packet with ranges 'r'. Each IDS capable insider knows or computes
monitoring nodes. The proposed enhanced GODOM the coordinates of the centers of the circles. Each insider
evaluates the pre-specified number of hops the protocol knows its coordinates (e.g., by using Global Positioning
should adapt. It also identifies active nodes even in the System (GPS) or other existing techniques). An insider
subspaces where its geometry is undefined. The status IDS
will checkout every packet using threshold values generated
in due course of secured transmission with enhanced
GODOM. Packet’s abnormality is marked when its
transmission value crosses the specified threshold values.
The scalability of the intrusion attacks in larger networks is
handled efficiently by its effective active node proposition
across the network terrain even in uneven subspaces.
The proposed solution uses the existing GODOM
(GeOmetric DOMinated set) algorithm to find out more
number of active nodes in a MANET. GODOM algorithm
helps a node to find out number of neighboring nodes present
over it and if it has more number of neighbor nodes then it is
selected as an active node. This algorithm will be installed
with DSR protocol algorithm. If the DSR protocol starts
execution then the GODOM algorithm will also execute
along with it. The proposed solution uses STAT (State
Transition Analysis Technique) based IDS designed for
detecting attacks against the DSR routing protocol. Figure 1. Finding Active Nodes using GODOM Algorithm
47
International Journal of Research and Reviews in Computer Science (IJRRCS) Vol. 1, No. 3, September 2010

Performance Metrics: Four metrics were taken into


selects an IDS capable neighbor, which is the nearest to the consideration: Selecting active nodes, Packet delivery ratio,
center of a circle it currently resides in to execute the IDS (an Malicious packet detection, packet send.
insider may select itself as well since by definition it is its
own neighbor). For this, each IDS capable insider broadcasts 5.2 Simulation Results
its distance from the center of each circle it resides in to its
neighbors. It sends this broadcast packet when it joins the 5.2.1 Scenario for selecting active nodes: The simulation
system and thereafter, each time it moves. GODOM detects result gives number of active nodes from 20,40,60,80 nodes.
many IDS active insiders so as to cover the entire network. Each simulation result was compared.
Now GODOM is generalized so as to select fewer IDS active
insiders at the expense of obtaining lower detection rates. 5.2.2 Scenario for sending Malicious Packet: The simulation
Now, each insider selected by GODOM decides whether to result under attacker node sends malicious packets. The
execute the IDS with a probability which can be selected so active nodes are simulated to checkout every packet and drop
as to regulate the resource consumed and detection rate. This if it has a signature of attack.
version is referred as Generalized Geometric Dominating set
Algorithm (GGODOM). The disadvantage of these schemes 5.2.3 Packet sent by AODV and DSR in Dynamic nodes:
is that they consume significant energy and computational Packet sent was same with slight variations in both the
resource due to involvement of every node in the detection protocols in dynamic nodes. Increasing the number of nodes
scheme which is not efficient especially when the threat level by keeping all scenarios constant leads to some increase in
is too high. packets sending at the stage of hundred nodes by the
proposed algorithm. (Fig. 2).

5. Results and Discussion

GODOM-STATIDS using DSR is simulated using ns-2 to Packets Sent


validate its efficiency and ability under volatile MANET’s
9000
environment. Active Nodes, Packet Sent, Malicious Packet
8000
detection, Packet Delivery ratio were used as metrics to
Number of Packets

7000
compare the performance of GODOM-STAIDS using DSR 6000
5000 AODV
and using AODV. Simulation results are shown below. 4000 DSR
The Simulated parameters are 3000
• Selecting active nodes 2000
1000
• No. of Packets sent 0
• Malicious packets detected
25

50

75

100
• Packet Delivery Ratio without malicious packets Number of nodes

Simulation Environment: In the Simulation study, first 25 Figure 2: GODOM: Nodes vs packet sent
nodes were considered. Then two protocols were considered
by executing each. The TCL file executed first to know how 5.2.4. Malicious packet detection by DSR (static vs dynamic
many nodes were selected as active nodes from respective nodes): The DSR protocol detects more number of malicious
nodes and at the end of NAM (Network Animator) files is packets in static nodes and also the detection ratio shows
opened to view the network movements eventually. The sequential increment when number of nodes has been
nodes were increased up to 100 and performance was increased but in the case of dynamic nodes, it shows only
calculated using ‘C’ file. The ‘Trace.c’file is used to extract random detection increment ratios. The Fig. 3 gives the
the trace file in which the Packet send, Active nodes, malicious packet detection ratios.
malicious packet detection, Packet Delivery Ratio. The
nodes were divided into Static (without mobility) and 5.2.5 Malicious packet detection by AODV (static vs dynamic
Dynamic (with mobility) in which their performance were nodes): The AODV protocol detects more number of
calculated using respective algorithms. malicious packets in static nodes and also the detection ratio
shows sequential increment when number of nodes has been
5.1 Scenario Metrics increased but dynamic nodes show only random detection
increment ratios. The Fig. 4 gives the malicious packet
Scenario metrics define the environment in which the ad hoc detection ratios
network functions. These metrics do not contribute to the
performance evaluation of the network, but it is critical to 5.2.6 Malicious packet detection by AODV and DSR in
consider these metrics to ensure comparable results for use in Dynamic nodes: The DSR Protocol detects more number of
any performance evaluation/comparison. malicious packets than AODV in dynamic nodes. When the
number of nodes is increased, the detection rate is also
increased in the proposed algorithm and protocol but in
48
International Journal of Research and Reviews in Computer Science (IJRRCS) Vol. 1, No. 3, September 2010

existing system when number of nodes is increased, the Selecting Active Nodes
detection rate shows slight increment. The Fig. 5 gives the 70
malicious packet detection ratios

Number of Active nodes


60

Malicious Packets Detected 50


40 AODV
800 30 DSR
700 20
Number of Packets

600 10
500 0
DSR-D

25

50

75

100
400
DSR-S
300 No. of Nodes
200
100
0
Figure 6: DSR vs AODV: Nodes vs Selecting active nodes.
25

50

75

100
Number of nodes
5.2.8 Packet delivery ratio by AODV and DSR in Dynamic
Fig 3: DSR: Nodes vs malicious packet detected-s vs D nodes: The delivery ratio of DSR and AODV protocol in
dynamic nodes shows that DSR protocol shows better
performance than AODV. The Fig. 7 gives delivery ratio
Malicious Packets Detected
comparisons.
700
600 5.2.9 Packet delivery ratio by DSR (static vs Dynamic
Number of Packets

500 nodes): The delivery ratio of DSR protocol in static and


400 AODV-D dynamic nodes shows only slight variations. The Fig. 8 gives
300 AODV-S delivery ratio comparisons.
200
Delivery Ratio
100
0
120
25

50

75

100

Number of nodes 100


80
AO DV
Figure 4: AODV:Nodes vs malicious packet detected-s vs D 60
DSR
40
20
Malicious Packets Detected 0
25

50

75

100

800
700 Nu mb e r o f no d e s
Number of Packets

600
500
AODV
400
300
DSR Figure 7: DSR vs AODV: Nodes vs delivery ratio-D
200
100
0 Packet Delivery Ratio
25

50

75

100

No. of Nodes 100


98
Packets Delivered

Fig 5: AODV Vs DSR : Malicious packet detected -D 96


94 DSR-D
92 DSR-S
5.2.7 Selecting active nodes by DSR and AODV in GODOM:
90
The DSR protocol detects more number of active nodes in 88
GODOM than compared to that of AODV protocol and the 86
25

50

75

100

proposed system’s selection ratio shows sequential increment


when number of nodes has been increased compared to the Number of nodes
existing system. The Fig. 6 gives the active node selection
comparison ratios. Figure 8: DSR: Nodes vs delivery ratios-S vs D
49
International Journal of Research and Reviews in Computer Science (IJRRCS) Vol. 1, No. 3, September 2010

6. Conclusion 6. Subhadrabandhu, D., S. Sarkar and F. Anjum, “a. A


framework for misuse detection in adhoc networks part I.
The proposed work enhances the GODOM algorithm and IEEE J. S selected Areas on Communications “(Special
deploys it in DSR protocol along with the security measures. Issues on Security in Wireless Adhoc Networks), 24 (2):
In the systemic model, every communicative node is able to 274-289. DOI: 10.1109/JSAC. 2005.861387. INSPEC:
reach the active packet monitoring nodes. The improved 8765864. 2006
security algorithm evaluates the pre-specified number of
hops the protocol should adapt. The STAT-IDS checks out 7. Subhadrabandhu, D., S. Sarkar and F. Anjum, ” A
every packet using threshold values. Packet’s abnormality is framework for misuse detection in adhoc networks part II.
marked when its transmission value crosses the specified IEEE J. Selected Areas on Communications “ (Special issues
threshold values. Scalability of the intrusion attacks in larger on security in wireless adhoc networks), 24 (2): 290-304.
networks are handled. In terms of efficiency, the proposed DOI: 10.1109/JSAC. 2005.861388. INSPEC: 8765865. 2006
model shows an improvement of 13% to 16% compared to
that of the existing GODOM algorithm. The enhanced 8. Subhadrabandhu, D., S. Sarkar and F. Anjum, “ Efficacy
GODOM security algorithm helps a node to find out number of misuse detection in adhoc networks “ In: Proceedings of
of neighbor nodes to select a safety active node with a raise IEEE SECON, 4-7: 97-107. DOI: 10. 1109 /SAHCN. 2004.
of 8% higher probability. 1381907.INSPEC: 8371304. ISBN: 0-7803-8796-1. 2004
The proposed solution uses STAT based IDS designed for
detecting attacks against the DSR routing protocol. The 9. Fereshteh Amini, M.,Moazzam khan, N.,Jelena Misic, K.,
active nodes are capable of executing the STAT-IDS and “Signature Based Intrusion Detection in Wireless Sensor
detecting 10% more of DSR attacks. The proposed work Networks ” In :Proc. of the 4th IEEE Workshop on Wireless
further analyzed and presented security scheme for more Sensor Networks,pp:80-86. 2008
number of intruders participate in the network and
collaborate it by attack packets. It is done by improving the 10. David Wagner.J.,Paloo Soto. D, “Mimicy attacks on Host
performance of the GODOM algorithm and intrusion Based Intrusion Detection System “ In Proceedings of the 9th
detection systems to prevent against Sybil attack and DoS ACM Conference on Computer and Communications
attacks. Security.pp:45-51.2005

11. Alia Fourati, Khaldoun Al Agha, “An IDS First Line of


References Defense for Ad Hoc Networks”, Proceedings of the WCNC
2007, pg. No.2621-2626.
1. Belding-Royer, E.M. and C.E. Perkins, “ Transmission
range effects on aodv multicast communication” 12. Bo Sun And Lawrence Osborne, Yang Xiao, Sghaier
Guizani, “intrusion detection techniques in mobile ad hoc
ACMTKluwer MONET, 7(6): 455-470.http: //alpha.ece.
and wireless sensor networks”, IEEE Wireless Communi-
ucsb.edu/~eroyer/txt/monet.ps. DOI: 10. 1023/A:
cations, October 2007.
1020708701096. 2002

2. Denning, D., “An intrusion detection model ” IEEE Trans.


Soft. Eng., IEEE Press Piscataway, NJ, USA, 13(2): 222-
223. DOI: 10.1109/TSE.1987.232894. 1987

3. Deng, H.D.P. Agrawal and W.L. Routing,” Security in


wireless adhoc networks “ IEEE Commun. Mag., 40(10): 70-
75. DOI: 10.1109/MCOM.2002. 1039859. INSPEC:
7422917. 2002

4. Perkins, CE. and E.M. Royer, “ AODV: Adhoc on-


demand distance vector routing “ In: Proc. of the 2nd IEEE
Workshop on Mobile Computing Systems and Applications,
pp:90-100. 2002 http://www. cs. cmu. Edu /People/bumba
/filing_cabinet/./papers/perkins-aodv. ps.gz.

5. Rao, R. and G. Kesidis, “Detecting of malicious packet


dropping using statistically regular traffic pattern in multihop
wireless networks that are not bandwidth limited” In: Proc.
IEEE GLOBECOM, 5: 2957-2961. ISBN: 0-7803-7974-8.
DOI: 10.1109/ GLOCOM.2003.1258776. INSPEC:
8330047. 2002

Anda mungkin juga menyukai