INVESTIGATING DDOS ATTACKS ON MANETS

INVESTIGATING DDOS ATTACKS ON MANETS

ABSTRACT

Wireless networks are proven to be more acceptable by users compared with wired networks for many reasons, namely the ease of setup, reduction in running cost, and ease of use in different situations such as disasters recovery. A Mobile ad-hoc network (MANET) is as an example of wireless networks. MANET consists of a group of hosts called nodes which can communicate freely via wireless links. MANET is a dynamic topology, self-configured, non-fixed infrastructure, and does not have any central administration that controls all nodes among the network.  Every device, used in day-today living, is assumed to be a network device, and it is managed using Internet Protocols (IP). Information on every electronic device is collected using infrared sensors, voice or video sensors, Radio-Frequency Identification (RFID), etc.  The new wireless networks and communications paradigm known as Internet of Things (IoT) is introduced which refers to the range of multiple interconnected devices which communicate and exchange data between one another.

MANET becomes prone to many attacks mainly due to its specifications and challenges such as limited bandwidth, nodes mobility and limited energy. This research study focuses specifically on detecting Denial of Service attack (DoS) in MANET. The main purpose of DoS attack is to deprive legitimate users from using their authenticated services such as network resources. Thus, the network performance would degrade and exhaust the network resources such as computing power and bandwidth considerably which lead the network to be deteriorated.

Therefore, this research aims to detect DoS attacks in both Single MANET (SM) and Multi MANETs (MM). A novel Monitoring, Detection, and Rehabilitation (MrDR) method is proposed in order to detect DoS attack in MANET. The proposed method is incorporating trust concept between nodes. Trust value is calculated in each node to decide whether the node is trusted or not. To address the problem when two or more MANETs merge to become one big MANET, the novel technique of  Merging Using MrDR (MUMrDR) is also applied to detect DoS attack.  As the mobility of nodes in MANET, the chance of MANETs merge or partition occurs.  Both centralised and decentralised trust concepts are used to deal with IP address conflict and the merging process is completed by applying the MUMrDR method to detect DoS attacks in MM. The simulation results validate the effectiveness in the proposed method to detect different DoS attacks in both SM and MM.

CHAPTER ONE

INRODUCTION

1.0 Background of The Study

The current wireless network technology revolution has occurred due to the implementation and availability of many wireless devices in different sectors, such as in the military arena, at conferences and in cafes. A wireless network enables two or more computers to connect with each other without using cables. There are many types and modes of wireless network communication, each of which has a different architecture. Available architectures include ad-hoc, peer-to-peer, infrastructure, WiFi, and WiMAX.

A wireless ad-hoc network involves a set of mobile devices, or hosts that can connect to each other wirelessly with no requirement for access, or centralised points. This network type can be employed as long as the devices are both within a specified range. The devices can connect and share data via radio waves. A Mobile Ad-hoc Network (MANET) is one type of ad-hoc network and it is the focus of this research. Due to the nature of MANETs, they are prone to many attacks, such as Denial of Service (DoS) attacks.

This chapter outlines the problem addressed by this research, the aims and objectives of this research, and thesis novel contributions.

1.1          Problem definition 

MANET is a temporary, self-configuring, wireless network that consists of nodes, which can communicate with each other without any fixed infrastructure. MANET has a dynamic topology, meaning nodes can move in and out of the network frequently without any previous announcement. As such, nodes can move independently in any direction. Nodes can refer to smart phones, tablets, MP3 players, iPads, personal computers, or even laptops. In addition, nodes in MANET do not have a central administration point (Jain and Buksh, 2014).

Instead, each node in MANET behaves as a router and a host by sending and receiving packets. As such, each node can communicate separately with each other node and may provide services to, or act as a client, with other network entities. MANET has received much interest as it is easy to use and setting-up the network architecture is not complex. For example, it can be used in emergency relief situations, such as search, disasters, and rescue, military services, such as use in transport and by soldiers, civilian usage, such as at airports, conferences, cafes, lectures and planes, and personal usage, such as personal laptops, wrist watches, and smart phones (Agrawal and Chauhan, 2013). This type of network is increasingly important with society’s move towards Internet of Things (IoT) computing. Detailed of IoT paradigm will be presented in Chapter 3.

Due to the nature of MANET, many security concerns and challenges have been raised. MANET contains a number of flaws that make it an easy target for attackers. First, as each node can communicate with each other node separately, there is no central computer capable of monitoring the entire network and ensuring correct behaviours by participants. Second, nodes can move arbitrarily. As such, the topology changes unpredictably and frequently. Third, each node needs energy to communicate with another node. This means that power constrains are a significant concern in MANET. Scalability is another concern in MANET as each node can access the network and also leave dependently. As such, the number of nodes within the network often changes and is unpredictable and particularly the case as MANETs merge. The fifth issue is that the bandwidth in MANET is constrained compared to other wireless networks, and the links between variables have a low capacity.

Wireless networks are vulnerable to many problems, such as interference, external noise, and signal effects. All of these factors mean that MANET is vulnerable to numerous internal and external attacks. For example, eavesdropping, fabrication, and DoS attacks can occur in MANET due to these vulnerabilities. The aim of these attacks differs and requires different responses from the security services to ensure the maintenance of Confidentiality, Integrity, and Availability  (CIA) (Conti and Giordano, 2014).  More details about CIA are provided in Chapter 2.

There are many security services that are required from MANET and any other network. Confidentiality, integrity, availability, non-repudiation, authorisation and authentication are the main security services that are required for a communications system to be considered safe. Confidentiality ensures that the transmitted data is only read at the intended destination, thus protecting transmitted data from eavesdropping. Integrity protects the transmitted message from modification by adversaries, meaning that only the intended recipients can edit the data. Availability ensures that the data is available whenever the legitimate users need to access it. In addition, it ensures that data can be transmitted from the source to the target destination promptly (Berman and Mukherjee, 2004).

The most critical and crucial type of attack in modern society is known as a DoS (Malhotra et al., 2013).  In this research, the focus is specifically on this type of attack. DoS attacks paralyse, deprive and disrupt the availability of the network, thereby preventing legitimate users from accessing the services. Also, this kind of attack reduces the performance of the network and can cause harm in many ways, both financially and in terms of resources (Patel and Sharma, 2013). For example, if the MANET connects to the Internet (connected MANET) and one of the most popular sites, such as Amazon or eBay, is subject to a DoS attack, even for a short time, the financial losses would be huge (Lotfy and Azer, 2013). Moreover, DoS attacks are a severe problem because many users may not realise that they are under attack, instead thinking that the delay is merely the result of network congestion (Ponsam and Srinivasan, 2014).

Distributed DoS (DDoS) attacks utilise many devices such as botnets or zombies as well as multiple Internet connections to launch an attack, whereas DoS attacks are launched by employing a single device and a single Internet connection (Sharma et al., 2013a).  In this thesis, DoS and DDoS are used interchangeably.

It will be demonstrated later on in this thesis that, traditional approaches to mitigate DoS attacks in fixed-wire networks cannot be applied to MANET due to certain characteristics it presents.  There are many methods that can be used to detect a DoS attack in MANET, such as distributed firewalls, filtering, IDS (Intrusion Detection System) and so on. The majority of existing methods used to detect DoS attacks have advantages and disadvantages. For example, there are some limitations in the use of distributed firewalls because of the vulnerabilities of host networks. Essentially, if users do not keep systems up to date, some complex systems can succeed in launching an attack that firewalls are unable to distinguish from normal traffic (Alicherry et al., 2005). These existing methods with their advantages and disadvantages are illustrated in detail in Chapter 4.

The use of ‘trust concepts’ to detect DoS attacks in MANET are studied in this research. The proposed method is called MrDR (Monitoring, Detection, and Rehabilitation) and it is used in this research to detect DoS attacks in both Single

MANET (SM) and Multiple MANET (MM) systems. MM systems refer to those with two merged MANETs as well as those with more than two MANETs.  This method relies on the use of the trust concept between nodes in order to detect DoS attacks in the early stages. Monitoring the network ensures that any irregular activity is detected as early as possible. Detection identifies misbehaving nodes and determines whether they are malicious or selfish. Rehabilitation refers to the return of the network to a secure state. In order to achieve this system’s goals, this approach recognises the issues discussed above, and uses a trust-based approach to mitigate DoS attacks in MANETs.

The Merging Using MrDR (MUMrDR) method will be used to detect DoS attacks when merging multiple MANETs. Two situations will be discussed in this thesis: merging two MANETs; and merging four MANETs. The reason why these numbers are selected is due to the fact that two which are related to any standard networks and four MANETs reflects the situation when there are more than two networks while this number can be increased by five, six, or more networks. According to the trust concept, MUMrDR would detect DoS attacks when merging MANETs. Another issue that must be considered is whether the IP addresses in the network are unique after merging. Centralised and decentralised trust concepts are used to help MM to merge in this study.

1.2          Research aims and objectives

The aim of this research project is to investigate and recommend a novel method for the identification of DoS, specifically in MANET. The two types of MANET discussed above, SM and MM will be considered in this research. This method will implement the trust concept in an effort to encourage cooperation between nodes to detect, respond, and rehabilitate the network following an attack. Furthermore, this method rehabilitates misbehaving nodes in an attempt to reuse them, which could drastically increase the performance of the network.

In order to achieve the above aim, the following project objectives are identified:

• To study and understand the nature of MANET and its security challenges and vulnerabilities. The research will focus on DoS attacks in particular in order to determine how they occur, the various types, and the threat they pose to MANET architecture, resources, and users.
• To critically evaluate existing countermeasures used to identify DoS attacks on MANET and identify their advantages and disadvantages. This will highlight any flaws in the existing detection methods.
• To design and implement a novel method for the early identification of DoS attacks in both SM and MM, acknowledging the disadvantages of existing methods.
• To evaluate the proposed novel method in an effort to establish its strengths and weaknesses, particularly with respect to SM, under various types of DoS attack.
• To compare the performance of the proposed method with existing methods using the trust concept to detect DoS attacks on SM.
• To use the trust concept to assign IP addresses on MM.
• To test the proposed method in MM where two MANETs merge, and in MM where more than two MANETs merge. This is the first attempt to use the trust concept to detect DoS attacks during the merger of MM.

INVESTIGATING DDOS ATTACKS ON MANETS