MANET入侵检测技术的研究

移动自组网(MANET)是由移动节点自组织形成的无线网络,由于其动态拓扑的特点,容易遭受各种安全威胁,而入侵检测技术能有效地保障移动自组网的安全.对已有的分级入侵检测技术进行分析,提出一种基于区域分级的入侵检测系统(IDS),避免了对节点的重复监控及尺寸小的簇的形成,减少了节点的运算负荷与通信负荷,提高了簇头的稳定性,避免簇头频繁选举带来更多的资源消耗.     

Intrusion Detection Techniques for Mobile Wireless Networks

The rapid proliferation of wireless networks and mobile computing applications has changed the landscape of network security. The traditional way of protecting networks with firewalls and encryption software is no longer sufficient and effective. We need to search for new architecture and mechanisms to protect the wireless networks and mobile computing application. In this paper, we examine the vulnerabilities of wireless networks and argue that we must include intrusion detection in the security architecture for mobile computing environment. We have developed such an architecture and evaluated a key mechanism in this architecture, anomaly detection for mobile ad-hoc network, through simulation experiments.     

无线传感器网络入侵检测系统

无线传感器网络与传统网络存在较大差异,传统入侵检测技术不能有效地应用于无线传感器网络。文中分析了无线传感器网络面临的安全威胁;总结了现有的无线传感器网络入侵检测方案;在综合现有无线传感器网络入侵检测方法的基础上,提出了一种分等级的入侵检测系统,该入侵检测体系结构通过减少错报能检测到大多数的安全威胁。     

移动自组织网络中的入侵检测技术

文章介绍了入侵检测技术及其分类,指出了入侵检测技术在移动自组织网络中面临的挑战,提出了一种基于域的移动自组织(Ad Hoc)网络入侵检测系统,并给出了其网络分层结构和代理概念模型.     

基于移动代理WSN分布入侵检测研究

针对聚类无线传感器网络安全的问题,将移动代理技术与分布式入侵检测技术相结合,提出了一种基于移动代理的无线传感器网络分布式入侵检测方案,采用了多个代理模块进行分布式协作,运用一种基于聚类的分布式入侵检测算法,从节点上收集和处理数据,减少网络负载、促进效率平衡,能够满足WSNs的要求和限制。从而达到提高无线传感器网络的安全性、可靠性,降低入侵检测能量消耗的目的。     

Intrusion Detection in Homogeneous and Heterogeneous Wireless Sensor Networks

Intrusion detection in Wireless Sensor Network (WSN) is of practical interest in many applications such as detecting an intruder in a battlefield. The intrusion detection is defined as a mechanism for a WSN to detect the existence of inappropriate, incorrect, or anomalous moving attackers. For this purpose, it is a fundamental issue to characterize the WSN parameters such as node density and sensing range in terms of a desirable detection probability. In this paper, we consider this issue according to two WSN models: homogeneous and heterogeneous WSN. Furthermore, we derive the detection probability by considering two sensing models: single-sensing detection and multiple-sensing detection. In addition, we discuss the network connectivity and broadcast reachability, which are necessary conditions to ensure the corresponding detection probability in a WSN. Our simulation results validate the analytical values for both homogeneous and heterogeneous WSNs.     

An Evolutionary-Based Approach for Low-Complexity Intrusion Detection in Wireless Sensor Networks

Wireless Personal Communications - As security threats are increasingly diversified, a critical problem in Wireless Sensor Network environments (WSNs) is detecting anomalies. WSNs are affected by...     

基于信誉度的移动自组网入侵检测分簇算法

针对已有基于路由的分簇算法,不适用于移动自组网入侵检测的特性要求,文中提出了一种基于信誉度的入侵检测分簇算法(CIDS).该算法从簇结构安全、稳定的角度出发,采用信誉度的概念对网络节点属性进行数学抽象,定义了节点信誉度的数学表达式,选择综合信誉度高的节点收集网络教据、检测网络行为.为移动自组网入侵检测系统提供了稳定、安全的支持.     

A Game Theory Based Multi Layered Intrusion Detection Framework for Wireless Sensor Networks

Most of the existing intrusion detection frameworks proposed for wireless sensor networks (WSNs) are computation and energy intensive, which adversely affect the overall lifetime of the WSNs. In addition, some of these frameworks generate a significant volume of IDS traffic, which can cause congestion in bandwidth constrained WSNs. In this paper, we aim to address these issues by proposing a game theory based multi layered intrusion detection framework for WSNs. The proposed framework uses a combination of specification rules and a lightweight neural network based anomaly detection module to identify the malicious sensor nodes. Additionally, the framework models the interaction between the IDS and the sensor node being monitored as a two player non-cooperative Bayesian game. This allows the IDS to adopt probabilistic monitoring strategies based on the Bayesian Nash Equilibrium of the game and thereby, reduce the volume of IDS traffic introduced into the sensor network. The framework also proposes two different reputation update and expulsion mechanisms to enforce cooperation and discourage malicious behavior among monitoring nodes. These mechanisms are based on two different methodologies namely, Shapley Value and Vickery–Clark–Grooves (VCG) mechanism. The complexity analysis of the proposed reputation update and expulsion mechanisms have been carried out and are shown to be linear in terms of the input sizes of the mechanisms. Simulation results show that the proposed framework achieves higher accuracy and detection rate across wide range of attacks, while at the same time minimizes the overall energy consumption and volume of IDS traffic in the WSN.     

入侵检测技术在移动Ad Hoc网络中的应用

文章介绍了入侵检测技术及其分类,指出了在移动AdHoc(自组织)网络中应用入侵检测系统(IDS)所面临的挑战,提出了一种基于域的多层移动AdHoc网络入侵检测系统,并阐述了它的网络结构和工作原理。     

A Case for Hybrid Sensor Networks

In this paper, we investigate the use of limited infrastructure, in the form of wires, for improving the energy efficiency of a wireless sensor network. We call such a sensor network—a wireless sensor network with a limited infrastructural support—a hybrid sensor network. The wires act as short cuts to bring down the average hop count of the network, resulting in a reduced energy dissipation per node. Our results indicate that adding a few wires to a wireless sensor network can not only reduce the average energy expenditure per sensor node, but also the non-uniformity in the energy expenditure across the sensor nodes.      

Intrusion Detection System for Wireless Sensor Networks Using Danger Theory Immune-Inspired Techniques

An IDS framework inspired in the Human Immune System to be applied in the wireless sensor network context is proposed. It uses an improved decentralized and customized version of the Dendritic Cell Algorithm, which allows nodes to monitor their neighborhood and collaborate to identify an intruder. The work was implemented and tested both in simulation and in real sensor platform scenarios, comparing them to each other and was also compared to a Negative Selection Theory implementation in order to demonstrate its efficiency in detecting a denial-of-sleep attack and in energy consumption. Results demonstrated the success of the proposal.     

Mobile Malicious Node Detection Using Mobile Agent in Cluster-Based Wireless Sensor Networks

Many application domains require that sensor node to be deployed in harsh or hostile environments, such as active volcano area tracking endangered species, etc. making these nodes more prone to failures. The most challenging problem is monitoring the illegal movement within the sensor networks. Attacker prefers mobile malicious node because by making the diversity of path intruder maximize his impact. The emerging technology of sensor network expected Intrusion detection technique for a dynamic environment. In this paper, a defective mechanism based on three-step negotiation is performed for identifying the mobile malicious node using the mobile agent. In many approaches, the multi-mobile agents are used to collect the data from all the sensor nodes after verification. But it is inefficient to verify all the sensor nodes (SNs) in the network, because of mobility, energy consumption, and high delay. In the proposed system this can be solved by grouping sensor nodes into clusters and a single mobile agent performs verification only with all the cluster heads instead of verifying all the SNs. The simulation result shows the proposed system shows a better result than the existing system.

     

移动无线传感器网络节点的定位

文中在MCB（Monte—Carlo Localization Boxed）定位算法的基础上提出了一种新的移动无线传感器网络（Mobile Wireless Sensor Networks）节点的定位算法——权重MCB算法。MCB算法在定位过程中,在采样和滤波阶段用到了一阶锚节点和二阶锚节点的位置信息,而没有应用到邻居节点的位置信息。权重MCB在定位过程中不仅用到了一阶锚节点和二阶锚节点的位置信息,还应用到了一阶邻居节点的采样集合里的采样点（即一阶邻居节点的估计位置）,从而改进了定位精度。对比MCB算法,权重MCB算法对定位精度的改进为13％～18％。     

Ad Hoc网络的入侵检测技术研究

Ad Hoc网络是一种没有固定基础设施、网络拓扑不断变化的新型网络,固有的脆弱性使它容易受到攻击,给Ad Hoc的入侵检测带来更多挑战.文中介绍了入侵检测技术及其分类,并根据Ad Hoc网络自身的特性,总结了已有的适于Ad Hoc网络的新型的入侵检测技术及其特性.最后,提出一种基于簇的分布式入侵检测技术,对其关键技术和工作机制进行分析和阐述.     

基于聚类的Adhoc网络入侵检测研究

由于Adhoc网络的独特网络特性,其安全性特别脆弱。在分析了Adhoc网络安全性的基础上,提出了一种聚类算法和人工免疫系统相结合来进行入侵检测的方法。该算法是一种无监督异常检测算法,它具有可扩展性、对输入数据集的顺序不敏感等特性,有处理不同类型数据和噪声数据的能力。实验表明,该算法可以改进Adhoc网络入侵检测的检测率和误检率。     

基于局部联系的无线传感网络异常入侵检测

提出一种局部联系对比搜索算法.通过把节点刷新定位过程,与其相邻的小范围分布网络的均值特征节点做比较,利用局部无线网络节点最优信息,检测异常入侵节点信息,避免了传统集中式方法对全部节点搜索的耗时.实验证明,这种局部联系对比定位算法能够有效利用网络信息,对异常节点实现准确入侵检测,缩短了检测时间.     

A Smart Approach for Intrusion Detection and Prevention System in Mobile Ad Hoc Networks Against Security Attacks

Design of intrusion detection and prevention scheme for improving MANET security, with considered energy efficiency, detection rate, delay, and false positive rate are major research issues. Most of the existing solutions have suffered to obtain accurate detection rate in minimal time execution and energy consumption. In this work we proposed a Smart approach for intrusion detection and prevention system (SA-IDPS) to mitigate attacks in MANET by machine learning methods. Initially, mobile users are registered in Trusted Authority using One Way Hash Chain Function. Each mobile user submits their following information to verify authentication: finger vein biometric, user id, and latitude and longitude. Intrusion detection is executed using four entities: Packet Analyzer, Preprocessing Unit, Feature Extraction Unit and Classification Unit. In packet analyzer, we verify whether any attack pattern is found or not. It is implemented using Type 2 Fuzzy Controller which considers information from packet header. In preprocessing unit, logarithmic normalization and encoding schemes are considered, which is time series and suitable for any application. In feature extraction unit, Mutual Information is used where we extracts optimum set of features for packets classification. In classification unit, Bootstrapped Optimistic Algorithm for Tree Construction with Artificial Neural Network is used for packets classification, which classifies packets five classes: DoS, Probe, U2R, R2L, and Anomaly, and then Association Rule Tree are used to classify whether the attack is Frequent or Rare. In this case, historical table is used for packets classification. Finally, experiments are conducted and tested for evaluating the performance of proposed SA-IDPS scheme in terms of Detection Rate (%), False Positive Rate (%), Detection Delay (s), and Energy Consumption (J).