A model of data forwarding in MANETs for lightweight detection of malicious packet dropping

TL;DR: This work introduces a model of data forwarding in MANETs which is used for recognizing malicious packet dropping behaviors and proposes an anomaly-based IDS system based on an enhanced windowing method to carry out the collection and analysis of selected cross-layer features.

Abstract: This work introduces a model of data forwarding in MANETs which is used for recognizing malicious packet dropping behaviors. First, different legitimate packet discard situations are modeled, such as those generated by collisions, channel errors or mobility related droppings. Second, we propose an anomaly-based IDS system based on an enhanced windowing method to carry out the collection and analysis of selected cross-layer features. Third, a real deployment of the IDS is also considered by suggesting a methodology for the collection of the selected features in a distributed manner. We evaluate our proposal in a simulation framework and the experimental results show a considerable enhancement in detection results when compared with other approaches in the literature. For instance, our scheme shows a 22% improvement in terms of true positives rate and a remarkable 83% improvement in terms of false positives rate when compared to previous well-known statistical solutions. Finally, it is notable the simplicity and lightweightness of the proposal.

Summary

1. Introduction

• Wireless networks have considerably evolved in the last years, leading to the appearance of different related technologies, architectures and applications [1].
• One of the architectures that have attracted much attention, especially by the research community, are the so called Mobile Ad hoc NETworks .
• Malicious nodes drop received data or control messages instead of relaying them, thus affecting the traffic in the network [5].
• There are different types of dropping attacks, depending on the particular strategy adopted by the attacker [6].
• The analytical model of the forwarding process which is used as the basis for their detection proposal is presented in Section 3.

2. Related Work

• A wide variety of solutions that handle packet dropping attacks in MANETS can be found in recent research [7, 8].
• Below, the authors discuss and classify them in three categories according to their basic operation, ACK-, reputation- and detection-based schemes.
• The authors have deliberately omitted some other solutions, such as credit-based schemes, as they consider them as prevention mechanisms.

2.1. ACK-based Schemes

• Here, nodes in the network communicate with their neighbors to explicitly request acknowledgments and confirm the reception of sent packets.
• These two schemes fail when any two-hop neighbors do not cooperate.
• Besides, to reduce the routing overhead, authors present in [12] an improvement of their scheme called 2ACK, where only a portion of the packets are acknowledged.
• Nodes use 3hop ACK packets to acknowledge TC messages, while HELLO rep packets advertise two-hop neighbors to a requesting MultiPoint Relay (MPR) node.
• The collected information is afterwards used as the basis for an accusation-based collaborative mechanism for node isolation.

2.2. Reputation-based Schemes

• The basic idea behind these techniques is that each node first generates an opinion with respect to others.
• A trust manager sends and receives alarm messages, informing about detected adversaries.
• Finally, a path manager is responsible for launching an appropriate response.
• The authors in [17] propose Friends and Foes, a scheme to punish selfish nodes.
• The concept of inner-circle consistence was adopted in [18] to identify forged route replies and prevent packet dropping attacks.

2.3. Detection-based Schemes

• Marti et al. [19] proposed a system called Watchdog, where a monitor node compares the packets that it sends with the overheard packets forwarded by the next hop.
• Classifiers like Naı̈ve-Bayes, RIPPER or C4.5 are then used for the detection.
• They perform the intrusion detection in application, routing and MAC layers.
• Other authors also propose dynamic adaptations in their works, like those in [24, 25].
• The authors in [28] incorporate a Bayesian filter into the standard watchdog implementation in order to reduce the number of false positives.

2.4. Discussion of Related Work

• Many of the aforementioned works are focused on the detection of dropping events in the network, identifying them as malicious or abnormal behaviors.
• They do not fully consider that the detection of packet droppings can be fooled by the existence of other causes, like the mobility of the nodes, which can make the RTS/CTS mechanism to fail when a node moves out of the communication range, thus leading to packet drops.
• For this reason, in their previous work [30] the authors proposed a heuristic to complete the model in [29], in order to properly deal with scenarios with mobility.
• Here, some features from MAC and routing layers were considered.
• As a result of such multi-layer approach, the authors obtained much better detection efficiency than that obtained in [29].

3. Model for the Forwarding Process in MANETs

• The model considers different legitimate circumstances in communications (collisions, channel errors or mobility) as well as malicious behaviors, and allows inferring how they all may affect the performance of the overall retransmission procedure.
• If all of the previous events occur, the node tries to forward the packet.
• To do this, two subsequent actions are taken.
• Let us term this event as RTS event, and its associated probability PRTS .
• All these circumstances cause messages to be lost and CTS packets not to be received, thus leading to an RTS retransmission.

4. Malicious Packet Dropping Detection

• A new detection methodology for packet dropping in MANETs is explained.
• First, the authors describe the attack model and the underlying scenario.
• Second, the authors detail the proposed detection approach.
• Next, the authors provide details about parameters estimation and suggest a windowing methodology.

4.1. Attack Model and Scenario Description

• The authors also 1Although there are other reasons to consider a link as broken, like node failures, congestion or others, in this work, for simplicity, they will use indistinctly the terms mobility or broken link to encompass all these situations.
• Of course, this aspect does not affect to the fundamentals of their proposal.
• The authors additionally consider the existence of M malicious nodes, with the same behavior as the legitimate ones, except that they will also drop received packets instead of forwarding them.
• A further extension of their work would imply the combination and evaluation of their technique with others which specifically deal with collusion attacks.
• Their scheme might be complemented by performing some end-to-end checking, like the one proposed in [31].

4.2. Overview of the Detection Approach

• This way, a set of network related features is first obtained for each node in a given temporal window of analysis.
• From these features, the probability values given in Section 3 are afterwards estimated.
• If PDROP is greater than this threshold and according to an anomaly-based approach, the authors conclude that the analyzed node is malicious, and legitimate otherwise: node = { malicious, if PDROP ≥ θ legitimate, otherwise (5) Obviously, the operating point of the detector depends on the value used for the detection threshold.
• If θ is set to a low value, more malicious nodes in the network will be detected, but also more legitimate nodes will be misclassified as malicious (i.e., false positive rate increases).
• On the contrary, the use of high values for θ will result in fewer malicious nodes being detected, but it will also produce low false positives.

4.3. Parameters Estimation

• Here the authors discuss how to calculate the probabilities involved in their analytical model taking into account different features obtained from the network.
• P̂MOB is set to 1 when the number of RTS retransmissions exceeds the SRL limit in a measuring window, since here the node considers that it does not have a connection with the next hop.
• AODV (Ad hoc On-demand Distance Vector) routing protocol [35] is considered as a case study in this work.
• In the case that the broken link is closer to the source node than to the destination one, the intermediate node throws the route away and sends back a Route ERRor message (RERR) to alert its precursors about the link fail.
• For that, it sends a RREQ message in a similar way that the source node would do.

4.4. Enhanced Windowing for Collecting Features

• This methodology presents two main drawbacks: i. The first one is related to situations where the temporal window ends just after the transmission of an RTS packet.
• That is, the features are obtained for non-overlapping windows of P received data packets for each node in the network.
• Fig. 3 evidences that, by employing the event-based windowing, the authors ensure that mobility situations can be fully collected.
• Besides the solution of these reported problems, an additional significant advantage should be mentioned for the proposed event-based windowing scheme.

4.5. Complexity

• Here the authors briefly discuss the complexity of the proposed scheme, taking into consideration both storage and computational requirements for each IDS instance.
• Regarding memory needs, each IDS procedure running in a given node just requires to handle 5 features (4 of them integers and 1 boolean) for each node monitored.
• In terms of computational overhead, for each node to be monitored their scheme executes a maximum of 13 basic operations (arithmetic, comparisons and assignments) per analysis window.
• Expressed in Big O notation, the complexity of the proposed detector is O(1) per analysis window and monitored node, which is lower than that of most data mining techniques, usually of order O(n), O(n2), or even greater.
• The detection performed by the SVM classifier used in [27] requires between 2,700 and 9,000 computations per analysis window and monitored node.

4.6. Summary of the Detection Approach

• It must be noted that the detection proposal is based on an analytical model which employs simple features to carry out the detection process.
• The use of this methodology incurs lower computational overhead in comparison with more sophisticated techniques based on data mining or machine learning algorithms, which require higher AC CE PT ED M AN US CR IP T computational complexity.
• The operating point of their system must still be empirically obtained for specific scenarios or network conditions.

5. Implementing the Packet Dropping Detection Scheme

• Beyond the theoretical development of their cross-layer malicious packet dropping detection method, in the following the authors discuss how to deploy their proposal.
• The IDS has access not only to the statistics of sent packets by a given node, but also to those corresponding to the received packets.
• The features for estimating the potential malicious behavior of a given node are indirectly collected by other nodes, which cooperate in order to provide a collaborative data collection process.
• In the experimentation presented in Section 6 the authors show the effect of this estimation and demonstrate that it does not degrade significantly the performance of the detection system.
• This way, the set of trustworthy monitor nodes can be substituted by the own neighbor nodes of a given one in the network.

6. Performance Evaluation

• This section describes the experimental framework used to validate the packet dropping IDS approach proposed here, and the results obtained from that evaluation.
• The authors have carried out extensive experiments to verify the proper performance of their proposal.

6.1. Experimental Environment

• Network Simulator 2 (NS-2) [38] has been adopted as evaluation platform [39] to simulate several deployments for a MANET environment.
• Other parameters chosen for simulation are those shown in Table 1 and Table 2.
• The pause time is 15 s, that is, after reaching the desired destination the node waits for 15 s before choosing a new random destination and repeating the procedure.
• Malicious nodes in the environment are configured to drop 20% of the data packets received to be forwarded towards a final destination.

6.2. Detection Results

• The detection performance of the introduced IDS is evaluated by means of two well known parameters, namely the True Positives Rate (TPR), or detection accuracy/rate, and the False Positives Rate (FPR).
• Repeating 75 times (with different seed values) each of the simulations2.
• As expected, the results obtained for the distributed-collection IDS approach are a little bit worse than the ones got in the stand-alone case.
• On the contrary, lower detection thresholds result in better TPR values, but in increasing FPR figures.

6.2.1. Influence of Window Size

• The size of the selected event-based window for collecting the features has also been chosen through experimental results.
• Operating Point for Different Window Sizes, also known as Table 3.
• As expected, the bigger the window the better detection capabilities in terms of FPR, although the size of the window cannot grow indefinitely, since this fact leads to increasing delays in the detection process.

6.2.2. Influence of Mobility

• The authors now study the detection efficiency for different mobility conditions.
• Six scenarios are thus simulated, with speed values from 5 m/s to 30 m/s to consider a wide range of possibilities.
• Fig. 6 shows graphically both TPR and FPR for such different scenarios.
• As shown, both the stand-alone and the distributed implementations achieve excellent results regarding the two metrics considered.
• AC CE PT ED M AN US CR IP T meanwhile FPR always remains below 4%.

6.2.3. Influence of Channel Error Probability

• The detection efficiency under different channel error probabilities has also been studied.
• The authors have also considered higher error probabilities to test the performance of their scheme when different channel characteristics, like shadowing or multipath fading, cause large packet losses.
• Fig. 7 depicts graphically both TPR and FPR in these situations.
• As shown, TPR degrades for the stand-alone implementation as channel error probability increases.
• This is mainly due to the fact that, for every received packet, it is more likely that the node has to retransmit it several times.

6.2.4. Influence of Number of Malicious Nodes

• Another set of experiments are aimed at analyzing the performance of both detection approaches for an increasing number of malicious nodes.
• The results obtained are presented in Fig. 8.
• That is, the proposal provides again very good detection results.

6.2.5. Discussion and Comparison of Detection Results

• From the above figures, it is clear that their IDS related proposal can efficiently detect the malicious nodes in the environment with an overall accuracy upper to 93%.
• The authors have also carried out a more realistic comparison among their results and those exhibited by other similar schemes and comparable scenarios) in [22, 23, 27].
• In order to show the suitability of this comparison among detection results, Table 4 presents for each scheme some parameters defining the scenarios considered.
• This scheme integrates three different subsystems (a Bayes-based classifier, Markov chains and an association rule algorithm), which results in a more complex approach.

Figures

Figure 3: Discontinuities caused by the time-based windowing.

Figure 4: Biased information due to the time-based windowing.

Frequently asked questions

Q1. What have the authors contributed in "A model of data forwarding in manets for lightweight detection of malicious packet dropping" ?

This work introduces a model of data forwarding in MANETs which is used for recognizing malicious packet dropping behaviors. Second, the authors propose an anomaly-based IDS system based on an enhanced windowing method to carry out the collection and analysis of selected crosslayer features. The authors evaluate their proposal in a simulation framework and the experimental results show a considerable enhancement in detection results when compared with other approaches in the literature. Third, a real deployment of the IDS is also considered by suggesting a methodology for the collection of the selected features in a distributed manner. 

Q2. What future works have the authors mentioned in the paper "A model of data forwarding in manets for lightweight detection of malicious packet dropping" ?

Different schemes can be analyzed for that, e. g., obtaining an average of previous AC CE PT ED M AN US CR IP T threshold values, computing the threshold as a function of the mobility speed, etc. • Finally, the authors are planning to extend their approach to include an attack model where several nodes work in collusion to evade the detection process.