Collaborative Anomaly-based Intrusion Detection in Mobile Ad Hoc Networks

Abstract

An intrusion detection mechanism that uses collaborative e orts of the nodes in a neighbourhood to detect aberrant behaviour in a mobile ad hoc network. A node showing this kind of behaviour is termed as a malicious node. The technique is de- signed for detection of malicious nodes in a neighbourhood in which each pair of nodes are within radio range of each other. Such a neighbourhood of nodes is known as a clique. This technique uses message passing between the nodes.The procedure for monitor node election is invoked and is aimed to reduce the computation and com- munication costs. The monitor node, operating in dual power mode, connects the clusters which help in routing messages from a node to any other node. The monitor node initiates the detection process. The monitor node sends data packets to two other nodes, called target nodes, through the node which has to be tested for mali- cious behaviour. The monitor node then requests each of these two nodes to return back the data packets that have been sent to them by the node under consideration. The monitor node compares this data with the one it had sent out. Based on this, the monitor determines which of the nodes are secure and which of them are suspicious. Finally, the monitor node, with the help of secure nodes, separates malicious nodes from the suspicious nodes. This technique is aimed to reduce the computation and communication costs to se- lect a monitor node and reduces the message passing between the nodes to detect a malicious node from the cluster hence there very less traffic and less chances of a collision.