{"title":"A cooperative intrusion detection system for ad hoc networks","authors":"Yi-an Huang, Wenke Lee","doi":"10.1145/986858.986877","DOIUrl":"https://doi.org/10.1145/986858.986877","url":null,"abstract":"Mobile ad hoc networking (MANET) has become an exciting and important technology in recent years because of the rapid proliferation of wireless devices. MANETs are highly vulnerable to attacks due to the open medium, dynamically changing network topology, cooperative algorithms, lack of centralized monitoring and management point, and lack of a clear line of defense. In this paper, we report our progress in developing intrusion detection (ID) capabilities for MANET. Building on our prior work on anomaly detection, we investigate how to improve the anomaly detection approach to provide more details on attack types and sources. For several well-known attacks, we can apply a simple rule to identify the attack type when an anomaly is reported. In some cases, these rules can also help identify the attackers. We address the run-time resource constraint problem using a cluster-based detection scheme where periodically a node is elected as the ID agent for a cluster. Compared with the scheme where each node is its own ID agent, this scheme is much more efficient while maintaining the same level of effectiveness. We have conducted extensive experiments using the ns-2 and MobiEmu environments to validate our research.","PeriodicalId":380051,"journal":{"name":"ACM Workshop on Security of ad hoc and Sensor Networks","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114231237","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Chin-Yang Tseng, P. Balasubramanyam, C. Ko, Rattapon Limprasittiporn, J. Rowe, K. Levitt
{"title":"A specification-based intrusion detection system for AODV","authors":"Chin-Yang Tseng, P. Balasubramanyam, C. Ko, Rattapon Limprasittiporn, J. Rowe, K. Levitt","doi":"10.1145/986858.986876","DOIUrl":"https://doi.org/10.1145/986858.986876","url":null,"abstract":"The Ad hoc On-Demand Distance Vector (AODV) routing protocol, designed for mobile ad hoc networks, offers quick adaptation to dynamic link conditions, low processing and memory overhead, and low network utilization. However, without keeping in mind the security issues in the protocol design, AODV is vulnerable to various kinds of attacks. This paper analyzes some of the vulnerabilities, specifically discussing attacks against AODV that manipulate the routing messages. We propose a solution based on specification-based intrusion detection to detect attacks on AODV. Briefly, our approach involves the use of finite state machines for specifying correct AODV routing behavior and distributed network monitors for detecting run-time violation of the specifications. In addition, one additional field in the protocol message is proposed to enable the monitoring. We illustrate that our algorithm, which employs a tree data structure, can effectively detect most of the serious attacks in real time and with minimum overhead.","PeriodicalId":380051,"journal":{"name":"ACM Workshop on Security of ad hoc and Sensor Networks","volume":"257 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115632207","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Random key-assignment for secure Wireless Sensor Networks","authors":"R. D. Pietro, L. Mancini, A. Mei","doi":"10.1145/986858.986868","DOIUrl":"https://doi.org/10.1145/986858.986868","url":null,"abstract":"A distributed Wireless Sensor Network (WSN) is a collection of n sensors with limited hardware resources. Sensors can exchange messages via Radio Frequency (RF), whose range usually covers only a limited number of other sensors. An interesting problem is how to implement secure pair-wise communications among any pair of sensors in a WSN. A WSN requires completely distributed solutions which are particularly challenging due to the limited resources and the size of the network. Moreover, WSNs can be subject to several security threats, including the physical compromising of a sensor. Hence, any solution for secure pairwise communications should tolerate the collusion of a set of corrupted sensors. This paper describes a probabilistic model and two protocols to establish a secure pair-wise communication channel between any pair of sensors in the WSN, by assigning a small set of random keys to each sensor. We build, based on the first Direct Protocol, a second Co-operative Protocol. The Co-operative Protocol is adaptive: its security properties can be dynamically changed during the life-time of the WSN. Both protocols also guarantee implicit and probabilistic mutual authentication without any additional overhead and without the presence of a base station. The performance of the Direct Protocol is analytically characterized while, for the Co-operative Protocol, we provide both analytical evaluations and extensive simulations. For example, the results show that, assuming each sensor stores 120 keys, in a WSN composed of 1024 sensors with 32 corrupted sensors the probability of a channel corruption is negligible in the case of the Co-operative Protocol.","PeriodicalId":380051,"journal":{"name":"ACM Workshop on Security of ad hoc and Sensor Networks","volume":"242 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115785872","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Identity certified authentication for ad-hoc networks","authors":"A. Weimerskirch, D. Westhoff","doi":"10.1145/986858.986864","DOIUrl":"https://doi.org/10.1145/986858.986864","url":null,"abstract":"Ad-hoc networks face huge security lacks. In the most general case entities need to build up a well-defined security association without any pre-established secret or common security infrastructure. In previous work we presented a protocol which provides a weak form of authentication that we call zero common-knowledge (ZCK) authentication. The protocol is extremely efficient and only requires symmetric primitives but does not provide identification. In this work we extend this approach in such a way that our new protocol provides identification at the cost of external infrastructure and moderate computing power. Our new protocol can be used to authenticate messages, e.g., to exchange keys for the earlier ZCK authentication protocol. Compared to public-key schemes, our approach is still very efficient.","PeriodicalId":380051,"journal":{"name":"ACM Workshop on Security of ad hoc and Sensor Networks","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123784416","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Modeling vulnerabilities of ad hoc routing protocols","authors":"Shahan Yang, J. Baras","doi":"10.1145/986858.986861","DOIUrl":"https://doi.org/10.1145/986858.986861","url":null,"abstract":"The purpose of this work is to automate the analysis of ad hoc routing protocols in the presence of attackers. To this end, a formal model fo protocol behavior is developed in which time is modeled by a set of constraints on the time of occurrence of events, enabling the representation of partially ordered timed events and asynchronous communication. Data variables are represented symbolically, capturing a range of distinct executions in each expression. Given a formal description of Ad Hoc On Demand Distance Vector Routing Algorithm (AODV) and a desired safety property (route stability), an analysis by a naive semi-decision procedure discovers an instance of an attack that leads to a violation of the property.","PeriodicalId":380051,"journal":{"name":"ACM Workshop on Security of ad hoc and Sensor Networks","volume":"70 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123825315","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Secure multicast groups on ad hoc networks","authors":"T. Kaya, G. Lin, G. Noubir, Atilay Yilmaz","doi":"10.1145/986858.986872","DOIUrl":"https://doi.org/10.1145/986858.986872","url":null,"abstract":"In this paper we address the problem of secure multicast of data streams over a multihop wireless ad hoc network. We propose a dynamic multicast group management protocol that aims at solving problems that are specific to ad hoc networks such as mobility, unreliable links, and cost of multihop communication. The main idea is to have group members actively participate to the security of the multicast group, therefore reducing the communication and computation load on the source. Since the group security is distributed among the group members, we propose a service right certificate, to verify that a node is authorized to join the group, and also a corresponding revocation mechanism. We simulated our protocol within the ns-2 environment under various mobility, group size, and group dynamic scenarios. Our simulation results indicate that the communication cost and join delay of the protocol scale well when the group dynamic and nodes mobility increase. We have implemented the basic protocol in our ad hoc network testbed. We also proposed an extension to the basic secure multicast tree using multi-link capability combined with a k-out-of-N coding approach.","PeriodicalId":380051,"journal":{"name":"ACM Workshop on Security of ad hoc and Sensor Networks","volume":"52 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121315423","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"SECTOR: secure tracking of node encounters in multi-hop wireless networks","authors":"Srdjan Capkun, L. Buttyán, J. Hubaux","doi":"10.1145/986858.986862","DOIUrl":"https://doi.org/10.1145/986858.986862","url":null,"abstract":"In this paper we present SECTOR, a set of mechanisms for the secure verification of the time of encounters between nodes in multi-hop wireless networks. This information can be used notably to prevent wormhole attacks (without requiring any clock synchronization), to secure routing protocols based on last encounters (with only loose clock synchronization), and to control the topology of the network. SECTOR is based primarily on distance-bounding techniques, on one-way hash chains and on Merkle hash trees. We analyze the communication, computation and storage complexity of the proposed mechanisms and we show that, due to their efficiency and simplicity, they are compliant with the limited resources of most mobile devices.","PeriodicalId":380051,"journal":{"name":"ACM Workshop on Security of ad hoc and Sensor Networks","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132180258","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"An approach to certificate path discovery in mobile Ad Hoc networks","authors":"He Huang, S. F. Wu","doi":"10.1145/986858.986865","DOIUrl":"https://doi.org/10.1145/986858.986865","url":null,"abstract":"Public key certificates prove validity and authenticity of their ownership and possibly other properties. Certificate path discovery is the critical process for public key verification in hierarchical public key infrastructure (PKI) diagrams. This process is conventionally done in centralized public key management system such as central CA or directory. However, in an infrastructure-less environment, such as a mobile ad hoc network, no such central service is present due to network dynamics. That brings the challenges for public key verification. Some researchers have been exploring public key management in ad hoc networks, but none of their studies are based on the hierarchical public key trust model. In this paper, we present a scheme to represent each CA certificate with a coded certificate path label and design an algorithm to speed up the process of certificate path discovery without the presence of central PKI service. Furthermore, we propose an on-demand protocol to collect the certificates in networks on the fly. In the final we present the performance evaluation for the implementation of our proposed ideas in ns-2.","PeriodicalId":380051,"journal":{"name":"ACM Workshop on Security of ad hoc and Sensor Networks","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121691310","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}