A Bio-Inspired Trust Framework in Wireless Ad Hoc Networks

Cyber attacks are amongst the most serious threats facing people and organizations. In the face of the increasing complexity and effectiveness of these attacks, creative approaches to defense are required. Groups of insects survive due to their use of collaborative approaches with the unique ability to detect anomalies using primarily local data and very limited computational resources (i.e., limited brain power). These attributes are even more crucial for wireless ad hoc networks where the number of nodes and connections between those nodes are ephemeral. We propose a trust framework inspired by the detection mechanisms exhibited by bee swarms in which a wireless node can only observe and leverage the actions of their neighbors rather than the global knowledge of the network to make decisions. This leveraging of local knowledge is an important aspect of trust in wireless networks in which global state information is difficult to encapsulate. We also utilize models from binary voting to present a mathematical model for our bee-inspired trust framework in wireless ad hoc networks. 1. Intrusion Detection, Neighboring Nodes, and Trust Cyber threats present some of the most pervasive challenges in today’s security landscape. Reports from the Governmental Accountability Office (GAO) showed that federal government agencies reported 35277 cyber security incidents in 2017 and 31107 incidents in 2018 [1, 2]. According to the Identity Theft Resource Center, there were 1473 reported data breaches exposing over 164.68 million sensitive records in 2019 [3]. In the face of these stark statistics, it is clear that there is a need for more effective defensive tools. One of the most commonly utilized defensive tools is the intrusion detection system (IDS) [4]. As the name implies, the purpose of these systems is to detect intrusions by identifying anomalous behavior within individual hosts or in a network. Broadly, there are two categories of IDSs, network-based and host-based. A network-based IDS uses network behavior such as traffic volume or diversity to detect abnormal network behavior. A host-based IDS uses local events like unusual program execution or log-in attempts to trigger an alert regarding a potential attack. These techniques have been successful in monitoring single machines and single networks. Unfortunately, the nature of cyber attacks is evolving and require more sophisticated defenses to detect them. Highly distributed attacks like distributed denial of service (DDoS) attacks can be used to camouflage virus and malware installation for nefarious purposes [5]. In order to counter these threats, cyber defenses have leveraged the idea of information sharing between hosts and networks in order to create collaborative systems capable of rapid detection and response to sophisticated cyber threats [5, 6]. These types of systems are called collaborative intrusion detection systems (CIDS). While CIDS and collaboration are good approaches to improving cyber defense, they raise several issues. The first is a question of network structure and how nodes should share information amongst themselves. There are three approaches to CIDSs, centralized, hierarchical, and distributed. A detailed analysis of these various approaches can be found in [6]. In a perfect world, every node in a network would share information with every other node in a fully distributed system. Unfortunately, as a network grows larger, the overhead required to implement such a system can become unmanageable (connections between nodes