Misbehaving activity detection using RSS with MAC
Saravavan T, Lalith kumar B,Santhosh Kumar A.
Department of Information Technology, Jeppiaar Engineering College, Chennai, India
ABSTRACT In Distributed networks are vulnerable to spoofing attacks, which allows for
many other forms of attacks on the networks. Although the identity of a node can be
verified through cryptographic authentication, authentication is not always possible because
it requires key management and additional infrastructural overhead. In this paper we
propose a method for both detecting spoofing attacks, as well as locating the positions of
adversaries performing the attacks. We first propose an attack detector for network
spoofing that utilizes MAC (Media access Control) and RSS (Received Signal strength)
analysis. Next, we describe how we integrated our attack detector into a real-time indoor
localization system, which is also capable of localizing the positions of the attackers. We
then show that the positions of the attackers can be localized using either area-based or
point-based localization algorithms with the same relative errors as in the normal case. Our
results show that it is possible to detect network spoofing with both a high detection rate
and a low false positive rate,
KEYWORDS:MAC,RSS,spoofing.
approaches . DOS(denial of service) can take
1.INTRODUCTION:
place by using the IP spoofing method which
Multivariate correlation analysis is a method
used for detecting the IP spoofing by Triangle
Area
Based
principle
for
protecting
the
legitimate user. It briefly uses the concept of
multithreading for providing services to the
clients. Correlation is a statistical principle used
for Portfolio management in order to prevent the
unauthorized user from accessing the network
service
Cloud service providers offer users
efficient and scalable data storage services with a
much lower marginal cost than traditional
disrupts the normal flow of the network. Several
measures are used to prevent IP spoofing, one of
the most important concept used in this project is
RSS with MAC. MAC address is typically used
as a unique identifier for all the nodes on the
network. The objective of our project Anomaly
detection system based on entropy and entropy
rate to detect DDoS attack in Grid environment.
We use normalized entropy which calculates the
over all probability distribution in the captured
flow in our algorithm to get more accurate
3.PROPOSED SYSTEM:
result. The aim of attack detection and recovery
is to detect DDoS attack before it affects the end
user .Intrusion detection systems are widely
used for DDoS detection. An Intrusion detection
system (IDS) is software and/or hardware which
will monitor the network or a computer system
for suspicious activity and alerts the system
manager or network administrator. We can
classify
the
IDS
based
the
target
of
implementation as host based and network
based. The technique adopted by IDS for
intrusion detection classifies IDS in to two types
we proposed a method for detecting
spoofing attacks as well as localizing the
adversaries in network and sensor networks. In
contrast
to
authentication
traditional
methods,
identity-oriented
our
RSS
based
approach does not add additional overhead to
the network devices and sensor nodes. We
formulated the spoofing detection problem as a
classical statistical significance testing problem.
We then utilized the MAC(Media access Control)
and RSS(Received Signal strength) cluster
analysis to derive the test statistic. Further, we
signature based and anomaly based.
have built a real-time localization system and
2.RELATED WORK:
integrated our spoofing detector into the
Many system and techniques are used to
system to locate the positions of the attackers
and as a result to eliminate the adversaries from
find the Misbehaving activity and detect it.
the network.
Vern Paxon developed a system called "Bro" a
system for finding a network attacker in real
time. It is a independent system that highlights
4.SYSTEM MODEL:
real time, hign speed monitoring.
D.E.Denning proposed a system "An Intrusion
Detection Model" used for detecting break-ins
penetrations and the computer stealing is
described.
G.Thatte,U.Mitra
In this module, Multipath routing is considered
an effective mechanism for fault and intrusion
tolerance to improve data delivery in WSNs. The
basic idea is that the probability of atleast one
path reaching the sink node or base station
a
increases as we have more paths doing data
Anamoly
delivery. we have to create the user interface for
detection in Agregate traffic" used a probability
establishing the connection between the sender
distribution statistics for identifying the events
and the receiver. Here the user has to prepare the
during the overload of IP addess.
data that has to send to the particular destination.
system"Parametric
developed
Methods
for
For every transaction, user interface is the main
.
part for establishing connection between the
sender and the receiver
In a system, every processor has been provided a
unique MAC address that cannot be duplicated.
we have found that the distance between the
centroids in signal space is a good test statistic
for effective attack detection.All the Client nodes
always login with our Specific IP and MAC
address attackers can't easily forge their MAC
address
so
they
can
avoid
IP
spoofing
attacks.Due to the open-nature of the wireless
medium, it is easy for adversaries to monitor
communications to find the layer-2 Media
5 SYSTEM TESTING AND
IMPLEMENTATION
5.1 INTRODUCTION
Access Control (MAC) addresses of the other
entities. Recall that the MAC address is typically
Software testing is a critical element of
software quality assurance and represents the
used as a unique identifier for all the nodes 2 on
ultimate review of specification, design and coding.
the network. The Module Architecture
given
In fact, testing is the one step in the software
define several steps involved in the
engineering process that could be viewed as
below
detection process.This module continuously
destructive rather than constructive.
monitoring the all request from the Client.
A strategy for software testing integrates
When the request is coming, it identifies
software test case design methods into a well-
the IP address with MAC address
and
stored in cache and starts counting the
request from the same IP address and also
planned series of steps that result in the
successful construction of software. Testing is
the set of activities that can be planned in
advance and conducted systematically. The
maintains the timer. More than 20
underlying motivation of program testing is to
requests within one second from same IP
affirm software quality with methods that can
address are considered as DDOS attack.
economically and effectively apply to both
Then the IP address is blocked for certain
strategic to both large and small-scale systems.
time periods (e.g. 5 minutes).
5.2.
STRATEGIC
SOFTWARE TESTING
APPROACH
TO
The software engineering process can be
viewed as a spiral. Initially system engineering
defines the role of software and leads to software
requirement analysis where the information
domain,
functions,
behavior,
performance,
constraints and validation criteria for software
are established. Moving inward along the spiral,
we come to design and finally to coding. To
develop computer software we spiral in along
streamlines that decrease the level of abstraction
on each turn.
A strategy for software testing may also
be viewed in the context of the spiral. Unit
testing begins at the vertex of the spiral and
concentrates on each unit of the software as
implemented in source code. Testing progress by
moving outward along the spiral to integration
testing, where the focus is on the design and the
construction of the software architecture. Talking
another turn on outward on the spiral we
encounter validation testing where requirements
established as part of software requirements
6.CONCLUSION AND FUTURE WORK:
This paper has presented the detection
process using the RSS and MAC address. The
former system is inadequate for IP-spoofing so
we are implementing the MAC which can't be
spoofing. The RSS will help to authenticate in
eliminating the hacker from the network by
using the weight of the signal. By implementing
this system the legitimate user will not be
affected. The Multivariate Correlation Analysis
uses Triangle-Area Based method. The system is
verified using KDD cup99 process
analysis are validated against the software that
has been constructed. Finally we arrive at system
The future work can be done on the DOS
testing, where the software and other system
detection system and make the network safer
elements are tested as a whole.
from the unauthorized user
.
5.3 Bar chart:
7.REFERENCES:
[1] V. Paxson, “Bro: A System for Detecting
Network Intruders in Real-Time,” Computer
Networks, vol. 31, pp. 2435-2463, 1999.
[2] P. Garca-Teodoro, J. Daz-Verdejo, G. Maci-
Detection,” IEEE Trans. Systems, Man, and
Fernndez, and E. Vzquez, “Anomaly-Based
Cybernetics Part B, vol. 38, no. 2, pp. 577-583,
Network
Apr. 2008.
Systems
Intrusion
and
Detection:
Challenges,”
Techniques,
Computers
and
[8] C. Yu, H. Kai, and K. Wei-Shinn,
Security, vol. 28, pp. 18-28, 2009.
“Collaborative Detection of DDoS Attacks over
[3] D.E. Denning, “An Intrusion-Detection
Multiple Network Domains,” IEEE Trans.
Model,” IEEE Trans. Software Eng., vol. TSE-
Parallel and Distributed Systems, vol. 18, no. 12,
13, no. 2, pp. 222-232, Feb. 1987. [4] K. Lee, J.
pp. 1649-1662, Dec. 2007.
Kim, K.H. Kwon, Y. Han, and S. Kim, “DDoS
[9] G. Thatte, U. Mitra, and J. Heidemann,
Attack
“Parametric Methods for Anomaly Detection in
Detection
Method
Using
Cluster
Analysis,” Expert Systems with Applications,
Aggregate
vol. 34, no. 3, pp. 1659-1665, 2008.
Networking, vol. 19, no. 2, pp. 512-525, Apr.
[5] A. Tajbakhsh, M. Rahmati, and A. Mirzaei,
2011.
“Intrusion Detection Using Fuzzy Association
[10] S.T. Sarasamma, Q.A. Zhu, and J. Huff,
Rules,” Applied Soft Computing, vol. 9, no. 2,
“Hierarchical Kohonenen Net for Anomaly
pp. 462-469, 2009.
Detection in Network Security,” IEEE Trans.
[6] J. Yu, H. Lee, M.-S. Kim, and D. Park,
Systems,
“Traffic Flooding Attack Detection with SNMP
Cybernetics, vol. 35, no. 2, pp. 302-312, Apr.
MIB Using SVM,” Computer Comm., vol. 31,
2005.
no. 17, pp. 4212-4219, 2008.
[7] W. Hu, W. Hu, and S. Maybank, “AdaBoostBased
Algorithm
for
Network
Intrusion
Traffic,”
Man,
and
IEEE/ACM
Cybernetics,
Trans.
Part
B: