Covering attack detection, malware response, algorithm and mechanism design, privacy, and risk management, this comprehensive work applies unique quantitative models derived from decision, control, and game theories to understanding diverse network security problems It provides the reader with a system-level theoretical understanding of network security, and is essential reading for researchers interested in a quantitative approach to key incentive and resource allocation issues in the field It also provides practitioners with an analytical foundation that is useful for formalising decision-making processes in network security

Network Security: A Decision and Game-Theoretic Approach

Node misbehavior due to selfish or malicious reasons or faulty nodes can significantly degrade the performance of mobile ad hoc networks. To cope with misbehavior in such self-organized networks, nodes need to be able to automatically adapt their strategy to changing levels of cooperation. Existing approaches such as economic incentives or secure routing by cryptography alleviate some of the problems, but not all. We describe the use of a self-policing mechanism based on reputation to enable mobile ad hoc networks to keep functioning despite the presence of misbehaving nodes. The reputation system in all nodes makes them detect misbehavior locally by observation and use of second-hand information. Once a misbehaving node is detected it is automatically isolated from the network. We classify the features of such reputation systems and describe possible implementations of each of them. We explain in particular how it is possible to use second-hand information while mitigating contamination by spurious ratings.

/pdf/self-policing-mobile-ad-hoc-networks-by-reputation-systems-233pebwemz.pdf

Self-policing mobile ad hoc networks by reputation systems

Wireless Sensor Networks (WSNs) have critical applications in diverse domains like environmental monitoring and military operations where accurate location of sensors is vital. One common method of location discovery uses a set of specialty nodes known as beacon nodes (BNs) that assist other sensor nodes (SNs) to determine their location. This paper proposes a novel reputationbased scheme called Distributed Reputation-based Beacon Trust System (DRBTS) for excluding malicious BNs that provide false location information. To the best of our knowledge, DRBTS is the first model to use the concept of reputation for excluding BNs. In DRBTS, every BN monitors its 1-hop neighborhood for misbehaving BNs and accordingly updates the reputation of the corresponding BN in the Neighbor-Reputation-Table (NRT). The BNs then publish their NRT in their 1-hop neighborhood. BNs use this second-hand information published in NRT for updating the reputation of their neighbors after it qualifies a deviation test. On the other hand, the SNs use the NRT information to determine whether or not to use a given beacon?s location information, based on a simple majority voting scheme.

/pdf/drbts-distributed-reputation-based-beacon-trust-system-2kyqobqkda.pdf

DRBTS: Distributed Reputation-based Beacon Trust System

A mobile ad hoc network (MANET) is an autonomous network that consists of mobile nodes that communicate with each other over wireless links. In the absence of a fixed infrastructure, nodes have to cooperate in order to provide the necessary network functionality. One of the principal routing protocols used in Ad hoc networks is AODV (Ad hoc On demand Distance Vector) protocol. The security of the AODV protocol is compromised by a particular type of attack called ‘Black Hole’ attack In this attack a malicious node advertises itself as having the shortest path to the node whose packets it wants to intercept. To reduce the probability it is proposed to wait and check the replies from all the neighboring nodes to find a safe route. Our approach to combat the Black hole attack is to make use of a ‘Fidelity Table’ wherein every participating node will be assigned a fidelity level that acts as a measure of reliability of that node. In case the level of any node drops to 0, it is considered to be a malicious node, termed as a ‘Black hole’ and is eliminated. Computer simulation using GLOMOSIM shows that our protocol provides better security and also better performance in terms of packet delivery than the conventional AODV in the presence of Black holes with minimal additional delay and Overhead.

Prevention of Co-operative Black Hole Attack in MANET

Fully self-organized mobile ad hoc networks (MANETs) represent complex distributed systems that may also be part of a huge complex system, such as a complex system-of-systems used for crisis management operations. Due to the complex nature of MANETs and its resource constraint nodes, there has always been a need to develop lightweight security solutions. Since MANETs require a unique, distinct, and persistent identity per node in order for their security protocols to be viable, Sybil attacks pose a serious threat to such networks. A Sybil attacker can either create more than one identity on a single physical device in order to launch a coordinated attack on the network or can switch identities in order to weaken the detection process, thereby promoting lack of accountability in the network. In this research, we propose a lightweight scheme to detect the new identities of Sybil attackers without using centralized trusted third party or any extra hardware, such as directional antennae or a geographical positioning system. Through the help of extensive simulations and real-world testbed experiments, we are able to demonstrate that our proposed scheme detects Sybil identities with good accuracy even in the presence of mobility.

Lightweight Sybil Attack Detection in MANETs

Several misbehavior detection and reputation systems have been proposed for mobile ad-hoc networks, relying on direct network observation mechanisms, so-called watchdogs. While these approaches have so far only been evaluated in simulations and restricted to selfish packet dropping, we are interested in the capabilities of a watchdog detection component in a real network. In this paper, we present our test-bed implementation of misbehavior detection. Following an evaluation of both the feasibility and detectability of attacks on routing and forwarding in the dynamic source routing (DSR) protocol, we present the design of our test-bed. In order to add detection capabilities, we extend the concept of passive acknowledgment by mechanisms for partial dropping, packet modification, and fabrication detection. We combine DSR with Netfilter and APE to enable detection. We implement both attackers and detection and show their feasibility and limitations.

/pdf/a-test-bed-for-misbehavior-detection-in-mobile-ad-hoc-4hgcosgvxl.pdf

C. Tissieres

Papers

A test-bed for misbehavior detection in mobile ad-hoc networks - how much can watchdogs really do?