EAACK – A Secure Intrusion Detection System for MANETs
1. Abstract:
The migration to wireless network from wired network has been a global trend in the past
few decades. The mobility and scalability brought by wireless network made it possible
in many applications. Among all the contemporary wireless networks, Mobile Ad hoc
NETwork (MANET) is one of the most important and unique applications. On the
contrary to traditional network architecture, MANET does not require a fixed network
infrastructure; every single node works as both a transmitter and a receiver. Nodes
communicate directly with each other when they are both within the same
communication range. Otherwise, they rely on their neighbors to relay messages. The
self-configuring ability of nodes in MANET made it popular among critical mission
applications like military use or emergency recovery. However, the open medium and
wide distribution of nodes make MANET vulnerable to malicious attackers. In this case,
it is crucial to develop efficient intrusion-detection mechanisms to protect MANET from
attacks. With the improvements of the technology and cut in hardware costs, we are
witnessing a current trend of expanding MANETs into industrial applications. To adjust
to such trend, we strongly believe that it is vital to address its potential security issues. In
this paper, we propose and implement a new intrusion-detection system named Enhanced
Adaptive ACKnowledgment (EAACK) specially designed for MANETs. Compared to
contemporary approaches, EAACK demonstrates higher malicious-behavior-detection
rates in certain circumstances while does not greatly affect the network performances.
2. Aim:
In this paper a new Intrusion-Detection system technique is used to prevent a malicious
node in the MANETS, the malicious attacker used the wide distribution and open
medium features of the MANETS to establish the vulnerabilities in the network.
3. Problem Statement:
To implement a secured new Intrusion-Detection system technique to prevent a malicious
node in the MANETS.
4. Existing System:
By definition, Mobile Ad hoc NETwork (MANET) is a collection of mobile nodes
equipped with both a wireless transmitter and a receiver that communicate with each
other via bidirectional wireless links either directly or indirectly. Unfortunately, the open
medium and remote distribution of MANET make it vulnerable to various types of
attacks. For example, due to the nodes’ lack of physical protection, malicious attackers
can easily capture and compromise nodes to achieve attacks. In particular, considering
the fact that most routing protocols in MANETs assume that every node in the network
behaves cooperatively with other nodes and presumably not malicious, attackers can
easily compromise MANETs by inserting malicious or no cooperative nodes into the
network. Furthermore, because of MANET’s distributed architecture and changing
topology, a traditional centralized monitoring technique is no longer feasible in
MANETs. In such case, it is crucial to develop an intrusion-detection system (IDS)
specially designed for MANETs.
Disadvantages of Existing System:
Watchdog scheme fails to detect malicious misbehaviors with the presence of the
following:
1) Ambiguous collisions;
2) Receiver collisions;
3) limited transmission power;
4) False misbehavior report;
5) Collusion; and
6) Partial dropping.
The TWOACK scheme successfully solves the receiver collision and limited
transmission power problems posed by Watchdog. However, the acknowledgment
process required in every packet transmission process added a significant amount of
unwanted network overhead. Due to the limited battery power nature of MANETs, such
redundant transmission process can easily degrade the life span of the entire network. The
concept of adopting a hybrid scheme in AACK greatly reduces the network overhead, but
both TWOACK and AACK still suffer from the problem that they fail to detect malicious
nodes with the presence of false misbehavior report and forged acknowledgment packets.
5. Proposed System:
In fact, many of the existing IDSs in MANETs adopt an acknowledgment-based scheme,
including TWOACK and AACK. The functions of such detection schemes all largely
depend on the acknowledgment packets. Hence, it is crucial to guarantee that the
acknowledgment packets are valid and authentic. To address this concern, we adopt a
digital signature in our proposed scheme named Enhanced AACK (EAACK).
Advantages of Proposed System:
Our proposed approach EAACK is designed to tackle three of the six weaknesses of
Watchdog scheme, namely, false misbehavior, limited transmission power, and receiver
collision.
6. Project Description:
MANET is a self-configuring infrastructure network of mobile devices connected by
wireless network it equipped with both a wireless transmitter and a receiver that
communicate each other bidirectional wireless either directly or indirectly. One of the
major advantages of wireless networks is its ability to allow data communication between
different parties and still maintain their mobility. This means that two nodes cannot
communicate with each other when the distance between the two nodes is beyond the
communication range of their own. MANET solves this problem by allowing
intermediate parties to relay data transmissions. This is achieved by dividing MANET
into two types of networks, namely, single-hop and multihop. Unfortunately, the open
medium and remote distribution of MANET make it vulnerable to various types of
attacks. Due to the nodes lack of physical protection, malicious attackers can easily
capture and compromise nodes to achieve attacks. In particular, considering the fact that
most routing protocols in MANETs assume that every node in the network behaves
cooperatively with other nodes and presumably not malicious. If MANET can detect the
attackers as soon as they enter the network, we will be able to completely eliminate the
potential damages caused by compromised nodes at the first time. IDSs usually act as the
second layer in MANETs, and they are a great complement to existing proactive
approaches.
7. Process Summary:
The project implementation starts with the creation of topology and then a routing
protocol is used (AODV or DSR) according to the requirements. Then, among the nodes
in the topology any of the two nodes are selected as the source and destination pairs. The
source and destination nodes then exchange the simple Digital Signature according to the
DSA and RSA algorithms. The signatures are then used to implement the three stages of
EAACK mechanism.
8. Algorithms:
a. DSA Algorithm: To generate and exchange digital signatures between source and
destination. In this algorithm, the original message is required for the verification of
the signature.
b. RSA Algorithm: To generate the digital signatures for the nodes. This algorithm
does not require any other information besides the signature itself in the verification
process.
c. EAACK Algorithm: The algorithm for EAACK protocol to implement the stages
within EAACK intrusion detection system.
9. Operating Environment:
HARDWARE CONFIGURATION:a. Processor – Pentium –IV Speed – 1.1 GHz
b. RAM – 256 MB(min)
c. Hard Disk – 20 GB
d. Key Board – Standard Windows Keyboard
e. Mouse – Two or Three Button Mouse
f. Monitor – SVGA
SOFTWARE CONFIGURATION:-
a.
Operating System: Windows XP onwards.
b. Coding Language: JAVA
c. Database : MySQL
10. Design and Implementation Constraints:
The implementation of topology’s nature has to be dynamic.
11. Assumptions and Dependencies:
Initially the project can be tested on two workstations. However, the further increment in
number of workstations is doubtful.
12. Modules Information:
a. ACK Implementation:
ACK is basically an end – to – end acknowledgment scheme .It is a part of EAACK
scheme aiming to reduce the network overhead when no network misbehavior is
detected. The basic flow is if Node A sends an packet p1 to destination Node D, if all
the intermediate node are cooperative and successfully receives the request in the
Node D. It will send an ACK to the source (Node A) , if ACK from the destination
get delayed then it S-ACK process will be initialized.
b. Secure ACKnowledgement:
In the S-ACK principle is to let every three consecutive nodes work in a group to
detect misbehaving nodes. For every three consecutive nodes in the route, the third
node is required to send an S-ACK acknowledgment packet to the first node. The
intention of introducing S-ACK mode is to detect misbehaving nodes in the presence
of receiver collision or limited transmission power.
c. Misbehavior Report Authentication:
The MRA scheme is designed to resolve the weakness of watchdog with respect to
the false misbehavior report. In this source node checks the alternate route to reach
destination. Using the generated path if the packet reaches the destination then it is
concluded as the false report.
d. Digital Signature Validation:
In all the three parts of EAACK, namely, ACK, S-ACK, and MRA, are
acknowledgment-based detection schemes. They all rely on acknowledgment packets
to detect misbehaviors in the network. Thus, it is extremely important to ensure that
all acknowledgment packets in EAACK are authentic and untainted. Otherwise, if the
attackers are smart enough to forge acknowledgment packets, all of the three schemes
will be vulnerable.
Proposed Work: The proposed work for the base paper is the detection and removal
of black hole attack. For this, an algorithm is proposed where a modification to
AODV protocol is performed with respect to the EAACK requirement. The algorithm
can be defined in two phases as follows:-
a. Route Discovery Phase: - In this phase, the sender first requests the certificate
from the cluster head of the cluster it belongs to of the intended destination node.
The cluster head first verifies the node and then replies with the certificate of the
intended node to the requesting node. Then, the sender node initiates the AODV
protocol and broadcasts RREQ packets to all its neighbors. The neighbors will
broadcast this RREQ packet to their own neighbors and this continues until, the
RREQ packet is reached to the destination. In this process, each node appends its
own address to the packet datagram so that if, a node receives a packet with the
datagram that contains the appended address as the same node which the received
the packet, the node drops the packet as the packet might posses the undesired
looping address and repetition of the redundant address. Once, the destination
node receives the RREQ packet it sends RREP packet to its intermediate hop
towards the packet source. The RREP packet is forwarded the same way RREQ
packet was along the path but in reverse order of that of the RREQ packet. After
the source receives the RREP packet, it extracts the traversed path information
from the packet datagram. This route is the discovered route for the source,
destination pair.
b.
DATA packet sending phase: - In this phase, a data packet is sent through
every route discovered between a particular source and destination pair. An ACK
threshold RTT is defined which is used as the measure to determine whether a
route contains a malicious node. If the source node receives an ACK packet
within time more than that of the threshold then it initiates a node verification
process to determine the malicious node in the route. Then after the detection of
the malicious node the source node broadcasts the node removal from the network
to all the nodes which are present in all the routes from that source node to
selected destination node. In this way, the malicious node(black hole) is
determined and is removed from the network.
13. Project Plan:
Modules
Code Delivery Date
Code
Percentage
Module 1
25%
Module 2
50%
Module 3
75%
Module 4
100%
delivered
in