Modified DSR protocol for detection and removal of selective black hole attack in MANET

A black hole attack in ad hoc network refers to an attack by malicious nodes, which forcibly acquires the route from a source to destination by falsely advertising shortest hop count to reach the destination node. In this paper, we present a Modified Dynamic Source Routing Protocol (MDSR) to detect and prevent selective black hole attack. Selective black hole attack is a special kind of black hole attack where malicious nodes drop the data packets selectively. We proposed an Intrusion Detection System (IDS) where the IDS nodes are set in promiscuous mode only when required, to detect the abnormal difference in the number of data packets being forwarded by a node. When any anomaly is detected, the nearby IDS node broadcast the block message, informing all nodes on the network to cooperatively isolate the malicious node from the network. The proposed technique employs Glomosim to validate the effectiveness of proposed intrusion detection system.     

Black Hole Attack Detection and Performance Improvement in Mobile Ad-Hoc Network

ABSTRACT

Security is an essential service for mobile network communications. Routing plays an important role in the security of mobile ad-hoc networks (MANETs). A wide variety of attacks targets the weakness of MANETs. By attacking the routing protocols, attackers can absorb network traffic, injecting themselves into the path between the source and destination. The black hole attack is one of the routing attacks where a malicious node advertise itself as having the shortest path to all nodes in the network by sending fake route reply. In this paper, a defense scheme for detecting black hole node is proposed. The detection is based on the timing information and destination sequence numbers maintained in the Neighborhood Route Monitoring Table. The table maintains the record of time of Reply. A black hole node will send a route reply message without checking the routing table as the legitimate node normally does. This reduced reply time is used to detect the black hole node. To improve the security further, the destination sequence number is checked with the threshold value, which is dynamically updated. The simulation results demonstrate that the protocol not only detects black hole attack but also improves the overall performance.     

基于蚁群算法的无线传感器网络节点可信安全路由

针对无线传感器网络内部恶意节点可能产生的攻击,提出一种基于蚁群算法的节点可信安全路由协议,将节点信任评估模型引入到蚁群路由算法中,提高无线传感器网络的节点可信度,以节点可信度为依据隔离恶意节点,增强网络安全性。仿真结果显示,算法在网络丢包率、端到端时延、吞吐量和全网能耗等评价指标上都得到了显著的改善,对黑洞攻击具有较好的抵抗性能。     

基于SVM的VANET黑洞攻击检测方法

车载自组网（ VANET）在遭受黑洞攻击时会丢失数据分组,影响网络正常通信。提出了针对黑洞攻击的特征向量选择方法,建立了正常情况和黑洞攻击情况下的车队仿真模型,并采用支持向量机（ SVM）的方法对VANET进行黑洞入侵检测。仿真结果表明：对于非源、目的节点以及攻击节点,采用该检测方法时都能够保持较高的检测率和较低的误检率,达到了基于单个节点通信数据判断当前 VANET是否遭受黑洞攻击的较好效果。     

车联网环境下基于重复博弈的恶意车辆节点检测机制

针对车联网内部存在的虚假信息攻击,以及节点动态变化快及密集程度不同造成的恶意车辆节点检测机制效率低下,提出了一种基于重复博弈的恶意车辆节点检测机制。首先,根据车辆在信息交互中的行为建立重复博弈模型,并利用生成的节点收益计算出信任值与动态阈值,经二者比较,筛选出可疑的恶意车辆节点;其次,通过权值投票算法从可疑的恶意车辆节点中判定出恶意车辆节点;最后,从邻居列表中选取信任值最高的下一跳车辆节点进行合作。仿真和分析表明,与现有的相关机制相比,该机制提高了对虚假信息攻击的检测率,降低了误检率。     

基于启发式Q学习的FANET可信路由算法

无人机自组织网络（FANET）是实现无人机自主集群的关键技术,其通过各无人机节点来完成协同通信。但节点的高机动性、网络结构的开放性造成FANET拓扑变化频繁,容易遭受恶意攻击。为此,提出一种基于启发式Q学习的可信路由算法HQTR。将FANET中的路由选择问题映射为有限马尔科夫决策过程,针对路由层面的黑洞攻击与泛洪攻击,引入数据包转发率与路由请求发送速率,通过模糊推理计算节点的信任值,同时考虑节点的邻居关系,提出一种模糊动态信任奖励机制。结合单跳链路状况设计启发式函数,采用改进的ε-贪婪策略来平衡利用-探索过程,引导当前节点选择最优可信下一跳节点。仿真结果表明,相对AOMDV、TEAOMDV与ESRQ算法,HQTR算法能够有效应对黑洞攻击与RREQ泛洪攻击,降低节点高速运动与网络规模变化所造成的影响,提高数据包投递率与吞吐量,减少路由开销与平均端到端时延。     

移动自组织网络中内部丢包的检测模型

无线移动自组织网络中数据的传输是基于中间节点的合作转发的,但由于内部自私节点为了节省带宽和电量或者网络受到恶意节点的攻击,导致丢包行为发生,网络性能严重降低。基于无线自组织网络常用的路由协议AODV,提出了一种新的针对内部丢包攻击的检测模型。该检测模型引入旁信道概念,旁信道节点和看门狗共同检测并记录节点转发报文行为,采用邻居信息表存放检测结果,当相应节点的记录值达到一定下限时就被隔离出网络。由于旁信道可以发送警报报文,该模型能够同时检测到自私节点或合作攻击节点引起的内部丢包攻击。     

DSR协议下3种攻击的影响比较与仿真研究

针对移动Ad Hoc网络的动态拓扑容易遭受各种网络攻击的特点,研究和比较现有的多种攻击模型,在动态源路由(DSR)协议下提出将黑洞节点按主动攻击和被动攻击进行分类的方法。在NS2网络仿真平台上实现包括RREQ洪泛攻击、被动型黑洞攻击和主动型黑洞攻击在内的3种攻击模式。通过仿真实验评估和比较这3种攻击对网络性能的影响,得出结论,就破坏性而言,RREQ洪泛攻击强于黑洞攻击,而主动型黑洞攻击强于被动型黑洞攻击。     

MANET环境中抵御“黑洞”攻击的路由算法

介绍了adhoc网络环境中的“黑洞”攻击，并根据“黑洞”的特点提出了一种基于mobile agent的路由算法。利用mobile agent和各节点进行数据交换，得到节点连接关系的矩阵表，当数据报文需要传送时，根据矩阵表可以迅速得到最佳路径，之后通过对邻居节点数据包转发的监视，抵御“黑洞”的攻击。     

无线传感器网络选择性传递攻击的检测和防御机制

针对无线传感器网络的选择性转发攻击,以提高恶意节点检测率和系统防御性为目标,提出了一种基于最优转发策略的随机路由算法和可信邻居节点监听的检测和防御方法。该方法通过引入距离、信任度等参数构建转发路径,同时,在路由发现和选择过程中,采用节点监听机制对恶意节点进行检测和防御处理。在Matlab环境下对该机制进行了仿真实验,并与其他方法进行了性能对比分析。实验结果表明：该方法能够在消耗相对较少能量情形下有效检测出选择性传递攻击,保持较高事件报文成功率,并且对恶意节点能做到有效的防御和处理。     

Defending against Wormhole Attack in MANET Using an Artificial Immune System

MANETs are mobile networks that are spontaneously deployed over a geographically limited area without requiring any pre-existing infrastructure. Typically, nodes are both autonomous and self-organized without requiring a central administration or a fixed network infrastructure. Due to their distributed nature, MANET is vulnerable to a specific routing misbehavior, called wormhole attack. In a wormhole attack, one malicious node tunnels packets from its location to the other malicious node. Such wormhole attacks result in a false route with fewer hop count. If the source node follows this fake route, malicious nodes have the option of delivering the packets or dropping them. This article aims at removing these attacks. For this purpose, it investigates the use of an Artificial Immune System (AIS) to defend against wormhole attack. The proposed approach learns rapidly how to detect and bypass the wormhole nodes without affecting the overall performance of the network. The proposed approach is evaluated in comparison with other existing solutions in terms of dropped packet count, packet loss ratio, throughput, packet delivery ratio, and end-to-end delay. A simulation result shows that the proposed approach offers better performance than other schemes defending against the wormhole attack.     

一种解决GEAR路由空洞问题的新方案

无线传感器网络中的GEAR路由协议在解决路由空洞问题时,会出现短暂路由环现象,使分组转发跳数增大,浪费更多的网络能量.基于反馈避免的思想提出一种改进的GEAR路由算法,当转发节点发现自身为空洞节点时,便向其邻节点广播hole信息,在分组转发时,邻节点将该节点标记为空洞节点,转发节点修改自身的综合代价,从而绕开该空洞节点...     

域间路径的一种安全宣告和撤销方法

目前得到广泛认可的域间路由安全机制(例如S-BGP)不能鉴别某条路由通告是正常的域间路径宣告,还是对于已撤销路径的恶意重放.这种情况会严重威胁域间路由安全.分析这种安全漏洞并提出相应的弥补方法.该方法为路由通告加上序列号,融合了带有消息恢复功能的自证明签名方案,能够在不增加计算量的情况下防止序列号被篡改.在发言人路由器接收验证路由通告以及撤销消息时,该方法通过这些序列号的缓存和对比判断机制,防范前面所述的重放攻击,为域间路径的安全宣告和撤销提供保障,同时在不需要密钥托管的情况下消除了繁重的证书存储和管理任务.     

An Improved Multi-Objective Particle Swarm Optimization Routing on MANET

A Mobile Ad hoc Network (MANET) is a group of low-power consumption of wireless mobile nodes that configure a wireless network without the assistance of any existing infrastructure/centralized organization. The primary aim of MANETs is to extend flexibility into the self-directed, mobile, and wireless domain, in which a cluster of autonomous nodes forms a MANET routing system. An Intrusion Detection System (IDS) is a tool that examines a network for malicious behavior/policy violations. A network monitoring system is often used to report/gather any suspicious attacks/violations. An IDS is a software program or hardware system that monitors network/security traffic for malicious attacks, sending out alerts whenever it detects malicious nodes. The impact of Dynamic Source Routing (DSR) in MANETs challenging blackhole attack is investigated in this research article. The Cluster Trust Adaptive Acknowledgement (CTAA) method is used to identify unauthorised and malfunctioning nodes in a MANET environment. MANET system is active and provides successful delivery of a data packet, which implements Kalman Filters (KF) to anticipate node trustworthiness. Furthermore, KF is used to eliminate synchronisation errors that arise during the sending and receiving data. In order to provide an energy-efficient solution and to minimize network traffic, route optimization in MANET by using Multi-Objective Particle Swarm Optimization (MOPSO) technique to determine the optimal number of clustered MANET along with energy dissipation in nodes. According to the research findings, the proposed CTAA-MPSO achieves a Packet Delivery Ratio (PDR) of 3.3%. In MANET, the PDR of CTAA-MPSO improves CTAA-PSO by 3.5% at 30% malware.     

抵御欺骗攻击的DV-hop安全定位算法

针对无线传感器网络中距离无关的定位技术,提出了DV-Hop定位中普通节点被俘获的欺骗攻击模型,分析了这种欺骗攻击模型对DV-Hop定位过程的影响,进而提出了一种抵御欺骗攻击的DV-Hop安全定位算法.首先,在普通节点端提出了基于发送-转发信息一致性的检测机制来检测恶意节点;其次,在汇聚节点端提出了基于消息转发链举证的检测机制来确定恶意节点;最后,当汇聚节点检测出存在恶意节点进行篡改攻击后,汇聚节点通报全网弃用恶意节点转发的数据分组并重启定位.仿真结果表明,本文提出的安全定位算法可以有效滤除恶意节点,且安全定位算法的定位性能与无攻击下的DV-Hop定位性能基本相当,可以有效解决欺骗攻击对DV-Hop定位过程造成的影响.     

一种新的无线传感网络干扰攻击检测技术

为了解决现有干扰攻击检测技术存在数据包丢失、高开销和网络吞吐量的问题,提出了一种基于群集和时间戳的无线传感器网络干扰攻击检测技术。该技术基于聚类算法对传感器节点进行分组,利用时间戳识别恶意节点,通过判断签名是否匹配来检测干扰。如果任何节点被识别为恶意节点,就安排新群集绕过堵塞的区域,通过备用路由来继续通信。实验表明与现有技术相比,基于时间戳的干扰检测技术在数据包传输率（packet delivery ratio,PDR）、网络吞吐量、能量消耗和路由开销方面均优于现有方法性能。     

移动Ad Hoc网中一种路由DoS攻击的分布式防御机制

在移动AdHoc网中,路由安全值得关注。恶意路由泛洪攻击会造成对正常节点的DoS攻击以及对网络资源的消耗。路由请求泛洪攻击是一类易于发起的典型泛洪攻击,但由于恶意节点除了进行路由发现的次数比其他节点频繁以外,其他操作与正常节点没有大的差别,所以这种攻击很难被检测出来。提出了一种分布式的过滤机制来减轻网络性能的下降,防御这一类的DoS攻击。本方案对于已有的路由结构和功能只需要做较小的修改,且不需要额外的网络带宽。     

一种直接评价节点诚信度的分布式信任机制

基于信誉的信任机制能够有效解决P2P网络中病毒泛滥和欺诈行为等问题.现有信任机制大多采用单个信誉值描述节点的诚信度,不能防止恶意节点用诚信买行为掩盖恶意卖行为;而且从信誉值上无法区分初始节点和恶意节点.提出一种新的分布式信任机制,基于交易历史,通过迭代求解,为每个节点计算全局买信誉值和卖信誉值,根据信誉值便能判断节点的善恶.仿真实验对比和性能分析表明,与EigenTrust算法相比,该算法能够迅速降低恶意节点的全局信誉值,抑制合谋攻击,降低恶意交易概率.     

Detection of wormhole attacks in multi-path routed wireless ad hoc networks: A statistical analysis approach

Various routing attacks for single-path routing have been identified for wireless ad hoc networks and the corresponding counter measures have been proposed in the literature. However, the effects of routing attacks on multi-path routing have not been addressed. In this paper, the performance of multi-path routing under wormhole attack is studied in detail. The results show that multi-path routing is vulnerable to wormhole attacks. A simple scheme based on statistical analysis of multi-path (called SAM) is proposed to detect such attacks and to identify malicious nodes. Comparing to the previous approaches (for example, using packet leash), no special requirements (such as time synchronization or GPS) are needed in the proposed scheme. Simulation results demonstrate that SAM successfully detects wormhole attacks and locates the malicious nodes in networks with different topologies and with different node transmission range. Moreover, SAM may act as a module in local detection agents in an intrusion detection system (IDS) for wireless ad hoc networks.     

模拟复杂网络下子网络节点抗攻击设计

针对复杂网络节点受攻击而出现的安全性问题,提出在模拟复杂网络基础上结合Feistel算法的子网络节点抵抗攻击方法;该方法通过子网络节点定位参数集,建立恶意节点位置模型,并确定定位真实精度;而后利用Feistel算法对节点密文进行加密处理,进而使加密信息恢复成明文信息,完成模拟复杂网络下子网络节点的抗攻击方法改进;结果证明,该方法不仅能够准确地对恶意节点进行定位,而且增强了节点抗攻击性能,提升了网络安全性。