A HIERARCHICAL COOPERATIVE INTRUSION DETECTION METHOD IN AD-HOC WIRELESS NETWORKS

ABSTRACT

In recent years, ad-hoc wireless networks have experienced an increase in popularity and usage due to their flexibility and the ability to provide connectivity from anywhere, at any time. Ad-hoc wireless network provides mobile communications to nodes in situations where the participating nodes are not in need of existing network infrastructure. The detection of malicious nodes is hard to achieve due to its dynamic nature of nodes mobility, lack of infrastructure and the nature of the wireless channel. Most traditional Intrusion Detection Systems (IDS) are designed to operate in a centralized manner, and do not operate properly in MANET as data in mobile ad-hoc networks are distributed in different network devices.

Hierarchical Cooperative Intrusion Detection Method (HCIDM) is a distributed intrusion detection mechanism that uses collaboration between nodes to detect active attacks against the routing table of a mobile ad-hoc wireless network. HCIDM operation reduces the effectiveness of the attack by informing other nodes about the existence of the malicious nodes, its operating mode and keeps the performance of the network within an acceptable level. The novelty of the mechanism lies in the way the responsibility to protect the network is distributed among nodes, the trust level is computed and the information about the presence of a malicious activity is communicated to potential victims, that is, nodes within the radio range of the attacker. HCIDM operates as a middle box between the network traffic and the routing protocol. HCIDM is tested using the Network Simulator (NS-2) in an AODV-enabled mobile ad hoc wireless network. The accuracy and the efficiency of HCIDM are tested during a black hole attack in a network with mobile nodes, starting with a small network topology and increasing the number of nodes to test its performance in a large network. The throughput, delay and packet loss are used as metrics for evaluating the performance of HCIDM.