A Survey on Intrusion Detection in MANET

1
A Survey on Intrusion Detection in MANET

• Zi Bin, Cheah
• cheah_at_ntnu.no/zibin2k2_at_yahoo.com
• Student Presentation
• Specialization Course in TTM2
• Autumn 2007

2
MANET

• Mobile Ad Hoc Networks
• a self-configuring network of mobile nodes.
• each wireless node can function as a sender, a
  receiver or a router.
• multi-hop communications.
• no centralised infrastructure.(no base stations,
  access points)?
• dynamic topology.
• every node in the network is (assumed)trusted.
• open medium.

3
IDS in MANET

• IDS is implemented in nodes such as switches,
  routers or gateways in wired environment.

4
IDS in MANET

• Nodes may be partitioned into clusters with one
  clusterheard for each cluster.
• infrastructure in MANET is either flat or
  multilayered.
• clusterhead for inter-cluster communications.

5
IDS Architecture in MANET

• Stand-alone IDS
• no data exchanged, decision based on information
  collection on own node.
• Distributed and Cooperative IDS
• every node participates in intrusion detectin and
  response by having an IDS agent running.
• Hierachical IDS
• Suitable for multilayered network. Clusterheads
  in cluster act as chokepoint such as routers in
  wired networks
• Mobile Agent for IDS
• mobile agents are codes that can traverse the
  network. Each agent is assigned to perform
  specific task.

6
Node Cooperations

• Each node must rely on other nodes for
  cooperations in routing and forwarding packets
• Nodes can choose to forward a received packets or
  dropped them.

7
Example Node Cooperations

• Watchdog
• when A forwards the packets to B, A also keeps a
  copy of the packet in its buffer. then, it
  promiscuously listens to the transmission o B to
  make sure that B forwards to C.
• If a failure threshold id achieved, we know that
  a node is misbehaving and reports the results to
  source node.
• Pathrater
• performs the path metric.
• selfish nodes problem has to be solved by not
  involving them in the route and not helping them
  forward packet

8
Distributed IDS using Multiple Sensor

• Monitoring Agent
• host based monitor agent hosting system-level
  sensors and user-activity sensor runs on every
  node.
• certain nodes monitoring on packet-level.
• Action Agent
• housed on every node to take action against host
  based alerts.
• Decision Agent
• check network-wide anomilies

9
References

• Article Reference
• A survery on Intrusion Detection in Mobile Ad Hoc
  Networks
• Diagram Reference
• http//www.projetoderedes.com.br/artigos/imagens/I
  mage82.gif