## 5 Attacks and Countermeasures
### MANET Countermeasures
#### 5.4.1 Countermeasures for Attacks during Routing and Data Transmission Phase  
Reliable routes and correct data transmission are crucial for a MANET. Most countermeasures introduced in this chapter are capable of preventing malicious behavior during both routing and data transmission phases. The countermeasures can be categorized into intrusion prevention, intrusion detection, and intrusion response mechanisms. Preventive mechanisms are mostly based on cryptographically secured routing protocols. The _Authenticated Routing for Ad hoc Networks_ (ARAN) [35] is one of the first proposed crypto-based intrusion prevention algorithms for MANETs. _ARAN_ uses a Public Key Infrastructure (PKI) to authenticate routing messages. Both route request and route reply messages are signed by the originatingnode. Each intermediate node validates received messages before these messages are again signed and forwarded. This way, ARAN can prevent attacks that are based on altering routing messages. Yet, on the other hand, a trusted entity that provides cryptographic certificates is required. Further, private key cryptography is computationally expensive. Therefore, further approaches as, e.g., the _Secure Efficient Ad hoc Distance vector (SEAD)_[36] routing protocol, the _Secure Routing Protocol (SRP)_[37], and the _Secure AODV (SAODV)_[38] routing protocol were proposed to overcome or reduce the impact of those drawbacks. By using one-way hash chains instead of asymmetric cryptography, _SEAD_ reduces computational resources required for authentication. _SRP_ is based on a similar approach by using message authentication codes (_i.e._, symmetric cryptography and a shared key) instead of asymmetric cryptography for authentication of routing messages. On the other hand, _SAODV_ combines asymmetric cryptography with hash chains. _SAODV_ distinguishes between mutable fields (as, e.g., the hop count) and static fields (as, e.g., source and destination addresses) of routing messages. As mutable fields have to be modified on each hop from source to destination, computationally cheap hash chains are used for authentication. As static fields have to be signed only at the source, asymmetric cryptography is used. Besides cryptographic approaches, [PERSON] _et al_. [39] introduced a trust-based and less costly approach to prevent malicious behavior. By mapping predefined real-world relations to the network, trusted nodes can be identified. Those trusted nodes are assumed to behave benignly. As long as sufficient trusted nodes are available, no malicious node is involved in routing or data forwarding. [PERSON] _et al_. motivated their work with a military scenario where the military rank is defined as a trust level that is mapped directly to nodes. Nodes with high trust level are preferred for routing to ensure that messages are delivered correctly. Although the trust-based approach is less costly compared to previously presented cryptographic intrusion prevention mechanisms, it can only be used in scenarios where trust-relationships between nodes exist. As intrusion prevention can fail, a network has to be capable of detecting ongoing malicious behavior. Therefore, intrusion detection is required. One of the first Intrusion Detection Systems (IDS) for MANETs is the _Watchdog_ IDS introduced by [PERSON] _et al_. [40]. Assuming bidirectional wireless links, each node in a wireless network receives all messages sent by nodes in transmission range. The _Watchdog_ algorithm is based on analyzing these overheard messages to verify the behavior of nodes in the neighborhood. Whenever a malicious node drops a received message, the predecessor on the route can detect this misbehavior as the malicious node has received but not forwarded a message. This information can be used to exclude the malicious node from routes. Furthermore, as long as the data is not encrypted, neighbor nodes are able to detect forged or modified messages. In order to operate correctly, _Watchdog_ requires bidirectional links and wireless interfaces operating in promiscuous mode.