DETECTING BLACK HOLE ATTACK IN MOBILE AD HOC NETWORK

advertisement
SYNCRONUS AD-HOC NETWORK DISTANCE VECTOR FOR MANET
Jyoti , Nitasha soni
Lingaya university, India
jyotidixit.25@gmail.com , Soni_nitasha@yahoo.co.in
Abstract
Mobile
Ad-Hoc
Networks
are
autonomous and decentralized wireless
systems. MANETs consist of mobile
nodes that are free in moving in and out
in the network. Due to security
vulnerabilities of the routing protocols,
however, wireless ad hoc networks may
be unprotected against attacks by the
malicious nodes. Black hole attack is an
important problem that could happen
easily in ad hoc networks especially in
popular on demand protocols Like the
Ad hoc On-demand Distance Vector
Routing (AODV). Prior research in ad
hoc networking has generally looked
into the routing problem in a non
adversarial network setting, assuming a
reasonably trusted environment .This
paper
proposes
a
collaborative
architecture to detect and exclude
malicious nodes that act in groups or
alone. This paper describes an extension
to the watchdog method to incorporate a
collaborative architecture to tackle
collusion amongst nodes. The security
issue
of
MANETs
in
group
communications
is
even
more
challenging because of the involvement
of multiple senders and multiple
receivers.
Keywords: Ad hoc networks, Routing
protocols, AODV, Black hole.
1. INTRODUCTION
Security is an essential requirement in
mobile ad hoc networks (MANETs).
Compared to wired networks, MANETs
are more vulnerable to security attacks
due to the lack of a trusted centralized
authority, easy eavesdropping, Mobile
Ad Hoc networks are infrastructure-less
networks where nodes collaborate to
forward packets for each other to
communicate beyond the direct wireless
transmission range. Since each node is
free to move around, there is ample
scope for the network topology to
change continuously.
The Black hole attack is an important
problem that can occur in Ad Hoc
Networks especially in popular on
demand protocols like AODV. The
original AODV protocol had envisaged
that any intermediate node in an ad hoc
network could respond to a route request
packet if it has a fresh enough route to
the destination. The idea behind this
being that it would decrease the routing
delay in the network. The original
protocol however assumed that all the
nodes in a given ad hoc network are
trusted nodes, this not being the case, it
is easy for any malicious node to crash
the network in part or whole by replying
to the route request. On receipt of the
reply from the malicious node the node
that started the route discovery would
conclude that the route discovery
process is complete and would start
sending data. As a result all the routes
through the malicious node are lost.
The concept of a watchdog that detects
malicious nodes and the concept of a
path router that helps the routing
protocols circumvent these paths are
introduced. The approach adopted
however fails to detect collusion among
nodes, receiver collision etc.
2. Classification of Attacks
The attacks can be categorized on the
basis of the source of the attacks i.e.
Internal or External, and on the behavior
of the attack i.e. Passive or Active attack.
This classification is important because
the attacker can exploit the network
either as internal, external or/ as well as
active or passive attack against the
network.
External and Internal Attack
External attackers are mainly outside the
networks who want to get access to the
network and once they get access to the
network they start sending bogus
packets, denial of service in order to
disrupt the performance of the whole
network. While in internal attack the
attacker wants to have normal access to
the network as well as participate in the
normal activities of the network.
malicious behavior. Internal attack is
more severe attacks then external attacks
Active and Passive Attack
In active attack the attacker disrupts the
performance of the network, steal
important information and try to destroy
the data during the exchange in the
network. In Passive attack, the attacker
listen to network in order to get
information, what is going on in the
network.
Resource Consumption Attack
In this attack, a malicious node
deliberately tries to consume the
resources (e.g. battery power, bandwidth)
of other nodes in the network.
Rushing Attack
On demand routing protocols that use
route discovery process are vulnerable to
this type of attack. An attacker node
which receives a “route request” packet
from the source node floods the packet
quickly through out the network before
other nodes which also receive the same
“route request” packet can reach. Nodes
that receive the legitimate “route
request” packet assume those packets to
be the duplicates of the packet already
received through the attacker node and
hence discard those packets.
Gray Hole Attack
We now describe the gray hole attack on
MANETS. The gray hole attack has two
phases. In the first phase, a malicious
node exploits the AODV protocol to
advertise itself as having a valid route to
a destination node, with the intention of
intercepting packets, even though the
route is spurious. In the second phase,
the node drops the intercepted packets
with a certain probability. This attack is
more difficult to detect than the black
hole attack where the malicious node
drops the received data packets with
certainly. A gray hole may exhibit its
malicious behavior in different ways. It
may drop packets coming from (or
destined to) certain specific node(s) in
the network while forwarding all the
packets for other nodes. Another type of
gray hole node may behave maliciously
for some time duration by dropping
packets but may switch to normal
behavior later.
Wormhole attack
Here attacker receives packets at one
point in the network, “tunnels” them to
another point in the network, and then
replays them into the network from that
point. For tunneled distances longer than
the normal wireless transmission range
of a single hop, it is simple for the
attacker to make the tunneled packet
arrive with better metric than a normal
multihop route.
Black Hole Attack
Black hole attack is that kind of attack
which occurs in Mobile Ad-Hoc
networks (MANET).
In black hole attack, a malicious node
uses its routing protocol in order to
advertise itself for having the shortest
path to the destination node or to the
packet it wants to intercept.
This hostile node advertises its
availability of fresh routes irrespective
of checking its routing table. In this way
attacker node will always have the
availability in replying to the route
request and thus intercept the data packet
and retain it. When this route is establish,
now it’s up to the node whether to drop
all the packets or forward it to the
unknown address.
The method how malicious node fits in
the data routes varies. Fig. shows how
black hole problem arises, here node
“A” want to send data packets to node
“D” and initiate the route discovery
process. So if node “C” is a malicious
node then it will claim that it has active
route to the specified destination as soon
as it receives RREQ packets. It will then
send the response to node “A” before
any other node. In this way node “A”
will think that this is the active route and
thus active route discovery is complete.
Node “A” will ignore all other replies
and will start seeding data packets to
node “C”. In this way all the data packet
will be lost consumed or lost.
Fig. Black Hole Problem
Black hole attack in AODV
Two types of black hole attack can be
described in AODV in order to
distinguish the kind of black hole attack.
Internal Black hole attack
This type of black hole attack has an
internal malicious node which fits in
between the routes of given source and
destination. As soon as it gets the chance
this malicious node make itself an active
data route element. At this stage it is
now capable of conducting attack with
the start of data transmission. This is an
internal attack because node itself
belongs to the data route. Internal attack
is more vulnerable to defend against
because of difficulty in detecting the
internal misbehaving node.
External Black hole attack
External attacks physically stay outside
of the network and deny access to
network traffic or creating congestion in
network or by disrupting the entire
network. External attack can become a
kind of internal attack when it take
control of internal malicious node and
control it to attack other nodes in
MANET.
Solution for black hole attack :
We propose a solution that is an
enhancement of the basic AODV routing
protocol, which will be able to avoid
black holes. To reduce the probability it
is proposed to wait and check the replies
from all the neighboring nodes to find a
safe route. According to this proposed
solution the requesting node without
sending the DATA packets to the reply
node at onceand check its key which is
assign by source node, it has to wait till
other replies with next hop details from
the other neighboring nodes and key
details by destination node. If any
repeated next hop node is present in the
reply paths it assumes the paths are
correct or the chance of malicious paths
is limited.if two nodes gives key details
and both have different details. Then we
can say that there is a blackhole in the
network and we can use the method by
which we can find out where the black
hole is present. Now question is how we
can resolve it? To find out this we can
use watchdog metod by adding alarm to
every nodes.
no intention to transmit the DATA
packets to the destination node D
but it wants to intercept/collect the
DATA from the source node S. So it
immediately replies to the request as (M
– 4). Instead of transmitting the DATA
packets immediately through M, S has to
wait for the reply from the other nodes.
After some time it will receive the reply
from node 1 as (1 – 3), and node 2 as (2
– 3).
5. CONCLUSION
The security of the ad hoc network
routing protocols is still an open problem
and deserves more research work. With
the wide spread usage of the internet as a
shopping place, and the fast spread of
wireless mobile units in the battle field
and search and rescue missions.
Therefore, there is strong need, now
more than ever, for secure applications
in the wireless world. In this paper the
routing security from black hole in
MANETs are discussed on one type of
attack.
REFERENCES :
Figure : Solution to Black hole
1
[1] S. Marti, T.J. Giuli, K. Lai, M.
Baker, “Mitigating routing misbehavior
in mobile ad hoc networks,” 6th
MobiCom,
Boston,
Massachusetts,
August 2000
3
S
2
D
M
In the above figure, S wants to transmit
to D. So it first transmits the route
request to all the neighboring nodes.
Here node 1, node M and node 2 receive
this request. The malicious node M has
[2] B. Dahill, B. Levine, E. Royer, and
C. Shields, “A secure routing protocol
for
ad
hoc
networks,”
IEEE
NetworkMagazine, vol. 13, no.6,
NovIDec 1999.
[3] J. Kong, P. Zerfos, H. Luo, S. Lu and
L. Zhang. “Providing robust and
ubiquitous security support for mobile
ad-hoc
networks”,
International
Conference
onNetwork
(ICNP),pp. 251-260,2001,
Protocols
[4] P. Papadimitratos, and Z. Hass,
“Secure routing for mobile ad hoc
networks,” IEEE Network Magazine,
vol. 13, no.6, NovIDec 1999.
[5] Hongmei Deng, Wei Li, and Dharma
P. Agrawal, Routing security in ad hoc
wireless
networks,
IEEE
Communications Magazine, October
2002 Vol 40 pages 70-75
[6] C. Perkins and E. Royer, “Ad-hoc
ondemand distance vector routing,” inb
Proceedings of the IEEE Wrkshop on
Mobile Computing Systems and
Applications, 1999.
[7] Y. Zhang and W. Lee, ”Intrusion
detection in wireless ad-hoc networks,”
in Proceedings of ACM MobiCom,
2000.
[8] Z. Zhou and Z. Haas, “Secure ad hoc
networks,” IEEENetworks, vol. 13, no.
6, pp. 24-30, 1999.
Download