In the last decade, mobile ad hoc networks (MANETs) have emerged as a major next generation wireless networking technology. However, MANETs are vulnerable to various attacks at all layers, including in particular the network layer, because the design of most MANET routing protocols assumes that there is no malicious intruder node in the network. In this paper, we present a survey of the main types of attack at the network layer, and we then review intrusion detection and protection mechanisms that have been proposed in the literature. We classify these mechanisms as either point detection algorithms that deal with a single type of attack, or as intrusion detection systems (IDSs) that can deal with a range of attacks. A comparison of the proposed protection mechanisms is also included in this paper. Finally, we identify areas where further research could focus.

A Survey of MANET Intrusion Detection & Prevention Approaches for Network Layer Attacks

Fuelled to bring the Internet of Things concept to real life, the Internet Engineering Task Force is working on 6LoWPAN, in which the standard allows a vast number of smart objects to be deployed in local wireless sensor networks (WSNs) using the huge address space of IPv6 for data and information harvesting through the Internet. From the security point of view, 6LoWPAN/WSN will be open to security threats from the local network itself and the Internet. Cryptography techniques applied as the front line of defence or deterrent can easily be broken because of the weak secure nature of LoWPAN devices and the wireless environment. Compromised nodes could lead to insider attacks without being detected by any cryptography checking. An intrusion detection system (IDS) is, primarily needed as a second line of defence to monitor the network operations and raise an alarm in case of any anomaly. This paper analyses potential security threats in 6LoWPAN and reviews the current countermeasures, in particular, the IDS-based solutions for countering insider/internal threats. Additionally, it discovers three novel QoS-related security threats, namely rank attack, local repair attack, and resource depleting attack, which are more seriously affecting the routing protocol for low-power and lossy network, the routing protocol used to establish 6LoWPAN network topology. A new two-layer IDS concept is introduced as a countermeasure method for securing the routing protocol for low-power and lossy network-built network topology from the internal QoS attacks. Potential research works are also presented to provide baseline reference to researchers in this field. Copyright © 2012 John Wiley & Sons, Ltd.

6LoWPAN: a study on QoS security threats and countermeasures using intrusion detection system approach

Security attacks typically result from unintended behaviors or invalid inputs. Security testing is labor intensive because a real-world program usually has too many invalid inputs. It is highly desirable to automate or partially automate security-testing process. This paper presents an approach to automated generation of security tests by using formal threat models represented as Predicate/Transition nets. It generates all attack paths, i.e., security tests, from a threat model and converts them into executable test code according to the given Model-Implementation Mapping (MIM) specification. We have applied this approach to two real-world systems, Magento (a web-based shopping system being used by many online stores) and FileZilla Server (a popular FTP server implementation in C++). Threat models are built systematically by examining all potential STRIDE (spoofing identity, tampering with data, repudiation, information disclosure, denial of service, and elevation of privilege) threats to system functions. The security tests generated from these models have found multiple security risks in each system. The test code for most of the security tests can be generated and executed automatically. To further evaluate the vulnerability detection capability of the testing approach, the security tests have been applied to a number of security mutants where vulnerabilities are injected deliberately. The mutants are created according to the common vulnerabilities in C++ and web applications. Our experiments show that the security tests have killed the majority of the mutants.

Automated Security Test Generation with Formal Threat Models

We present a model-based approach to testing access control requirements. By using combinatorial testing, we first automatically generate test cases from and without access control policies-i.e., the model- and assess the effectiveness of the test suites by means of mutation testing. We also compare them to purely random tests. For some of the investigated strategies, non-random tests kill considerably more mutants than the same number of random tests. Since we rely on policies only, no information on the application is required at this stage. As a consequence, our methodology applies to arbitrary implementations of the policy decision points.

/pdf/model-based-tests-for-access-control-policies-2p4llqag2o.pdf

Model-Based Tests for Access Control Policies

In recent years, Mobile Ad hoc NETworks MANETs have generated great interest among researchers in the development of theoretical and practical concepts, and their implementation under several computing environments. However, MANETs are highly susceptible to various security attacks due to their inherent characteristics. In order to provide adequate security against multi-level attacks, the researchers are of the opinion that detection-based schemes should be incorporated in addition to traditionally used prevention techniques because prevention-based techniques cannot prevent the attacks from compromised internal nodes. Intrusion detection system is an effective defense mechanism that detects and prevents the security attacks at various levels. This paper tries to provide a structured and comprehensive survey of most prominent intrusion detection techniques of recent past and present for MANETs in accordance with technology layout and detection algorithms. These detection techniques are broadly classified into nine categories based on their primary detection engine/s. Further, an attempt has been made to compare different intrusion detection techniques with their operational strengths and limitations. Finally, the paper concludes with a number of future research directions in the design and implementation of intrusion detection systems for MANETs. Copyright © 2016 John Wiley & Sons, Ltd.

https://onlinelibrary.wiley.com/doi/pdf/10.1002/sec.1484

Intrusion detection in mobile ad hoc networks: techniques, systems, and future challenges

Mobile ad hoc networks offer very interesting perspectives in wireless communications due to their easy deployment and their growing performances. However, due to their inherent characteristics of open medium, very dynamic topology, lack of infrastructure and lack of centralized management authority, MANET present serious vulnerabilities to security attacks. In this paper, we propose an intrusion detection scheme based on extended finite state machines (EFSM). We provide a formal specification of the correct behavior of the routing protocol and by the means of a backward checking algorithm, detect run-time violations of the implementation. We choose the standard proactive routing protocol OLSR as a case study and show that our approach allows to detect several kinds of attacks as well as conformance anomalies.

/pdf/an-efsm-based-intrusion-detection-system-for-ad-hoc-networks-4dhxc2sljf.pdf

An EFSM-based intrusion detection system for ad hoc networks

Nowadays, security policies are the key point of every modern infrastructure. The specification and the testing of such policies are the fundamental steps in the development of a secure system since any error in a set of rules is likely to harm the global security. To address both challenges, we propose a framework to specify security policies and test their implementation on a system. Our framework makes it possible to generate in an automatic manner, test sequences, in order to validate the conformance of a security policy. system behavior is specified using a formal description technique based on extended finite state machine (EFSM) [12]. The integration of security rules within the system specification is performed by specific algorithms. Then, the automatic tests generation is performed using a dedicated tool, called SIRIUS, developed in our laboratory. Finally, we briefly present a weblog system as a case study to demonstrate the reliability of our framework.

/pdf/a-formal-approach-for-testing-security-rules-yy64k6eou0.pdf

A formal approach for testing security rules

All existing routing protocols of Mobile Ad Hoc networks (MANET) assume that IP addresses of hosts are already configured before they join the network. In traditional schemes, this task is delegated to the dynamic host configuration protocol (DHCP [R. Droms, Dynamic host configuration protocol, RFC 2131, March 1997]), which allots an IP address to each requesting node. However, this process can not be applied in the context of MANET because of the lack of infrastructure and the great mobility that characterize them. A manual management of the addresses can be considered as long as the number of nodes remains reasonable. On the other hand, it is not possible any more since the network reaches a certain size. Some works proposed solutions to allow an automatic configuration of the nodes, i.e. without human intervention. Unfortunately these processes, often inspired of the traditional wired networks, are not always well adapted to MANET and appear relatively greedy concerning for example the delay, the address space or the bandwidth. Moreover, they apply only to ideal networks in which all nodes can trust each other. In this manner, they do absolutely not consider the security aspects and are thus not adapted to a real use in potentially hostile environment. In this paper, we propose a node auto-configuration scheme which uses the buddy system technique to allocate the addresses, as well as an algorithm allowing to authenticate the participants inside the network.

Secure hosts auto-configuration in mobile ad hoc networks

All existing routing protocols of Mobile Ad Hoc networksassume that IP addresses of hosts are already configuredbefore they join the network. Some papers proposed solutionsto allow an automatic configuration of nodes, i.e. withouthuman intervention. Unfortunately these processes, ofteninspired of the traditional wired networks, are not alwayswell adapted to the MANET model and appear relativelyresources greedy. Moreover, they apply only to idealnetworks in which all nodes can trust each other. In thismanner, they do absolutely not consider the security aspectsand are thus not adapted to a real use. In this paper, we proposea node auto-configuration algorithm which uses theBuddy systems technique to allocate the addresses, as wellas a scheme allowing to authenticate the participants insidethe network.

Secure Hosts Autoconfiguration in Mobile Ad Hoc Networks

All existing routing protocols of mobile ad hoc networks assume that IP addresses of hosts are already configured before they join the network. Some papers proposed solutions to allow an automatic configuration of nodes, i.e. without human intervention. Unfortunately these processes, often inspired of the traditional wired networks, are not always well adapted to the MANET model and appear relatively resources greedy. Moreover, they apply only to ideal networks in which all nodes can trust each other. In this manner, they do absolutely not consider the security aspects and are thus not adapted to a real use. We propose a node autoconfiguration algorithm which uses the Buddy systems technique to allocate the addresses, as well as a scheme allowing to authenticate the participants inside the network.

Jean-Marie Orset

Papers

An EFSM-based intrusion detection system for ad hoc networks

A formal approach for testing security rules

Secure hosts auto-configuration in mobile ad hoc networks

Secure Hosts Autoconfiguration in Mobile Ad Hoc Networks

Secure hosts auto-configuration in mobile ad hoc networks