## 5 Attacks and Countermeasures
### MANET Countermeasures
#### 5.4.2 Countermeasures for Sybil Attacks  
As MANETs are decentralized and, therefore, a central trusted entity is (most probably) not available, detecting _Sybil_ attacks is very challenging. The countermeasures for Sybil attacks proposed by [PERSON] [28] can also be used in the context of MANETs. Yet, as resources in a MANET are strongly limited and as network nodes differ strongly in the availability of resources (from mobile phones to high-performance computers), those countermeasure may not be efficient. [PERSON] _et al_. analyzed _Sybil_ attacks in sensor networks. They proposed multiple countermeasures [44] to prevent or, at least, limit _Sybil attacks_. [PERSON] _et al_. assumed that each node in a network has a single network card and, therefore, is only capable of transmitting and receiving data at a single channel simultaneously. The _Radio Resource Testing_ was proposed as a countermeasure that is based on this assumption. Each node detects _Sybil_ nodes in transmission range by assigning each neighbor to a specific channel. Each neighbor has to transmit a message at a specific time on this channel. Whenever a neighbor does not transmit the message on the assigned channel at the expected time, a potential _Sybil_ node is detected. This test has to be repeated multiple times to detect as many _Sybil_ nodes as possible in the neighborhood. The approach is simple to implement but requires bandwidth for the active probing for malicious nodes. Further, _Radio Resource Testing_ has to be repeated by each node in the network as no collaboration is performed. [PERSON] _et al._ additionally introduced the _Code Attestation_ and the _Registration_ countermeasures. As the code deployed on malicious and benign nodes differs, verifying the memory of a node provides information on whether this node behaves benignly. Also, registering and authenticating each node in the network at a central entity and using a list of known benign nodes may prevent _Sybil_ nodes. Another promising approach uses the mobility of nodes in MANETs to detect _Sybil_ attacks. For this, [PERSON] _et al_. introduced the _Passive Ad hoc Sybil Identity Detection (PASID)_[45]. Each node of the network has to keep track of all nodes in transmission range by overhearing sent messages. This way, the sender of a transmitted message can be identified and, thus, neighbors can be detected. As _Sybil_ nodes share the same physical location, nodes which always appear together are suspicious to be a single malicious node. Nodes in transmission range have to be monitored for a sufficiently long time until a node can be accused to be malicious. The specific amount of required time differs due to the mobility of nodes and the scenario size. In order to optimize the efficiency of the detection system, [PERSON] _et al_. proposed a collaboration of nodes during monitoring. By exchanging collected data, malicious nodes can be detected more efficiently and faster. Yet, [PERSON] _et al_. lack to provide a mechanism to identify trustworthy nodes that can be used for a collaborative monitoring. As _PASID_ may falsely suspect benign nodes that travel in a group, [PERSON] _et al_. introduced an extension to their algorithm. The _PASID with Group Detection (PASID-GD)_ algorithm is capable of distinguishing between malicious and benign nodes that travel together in close proximity by monitoring collisions on the Medium Access (MAC) Layer. Whenever multiple benign nodes are in transmission range, collisions occur since nodes eventually start transmitting at the same time. In contrast, as _Sybil_ nodes share the same network card, data has to be sent in a serial way and, thus, no collisions occur. This results in a strongly reduced probability of false positives during _Sybil_ detection. [PERSON] _et al_. [46] followed a similar approach to identify neighbors by overheard messages. In contrast to [PERSON] _et al_, [PERSON] _et al_. suggested an approach on how to prevent a misuse of the collaboration scheme for the detection of _Sybil_ attacks.