# A Cross-Layer, Anomaly-Based IDS for WSN and MANET
## 1 Introduction  
The mobile adhoc network (MANET) is a type of wireless network that does not require infrastructure for its operation. This feature makes it very appealing for rapid deployment in harsh and challenging environments. There are many applications for these highly versatile networks. The most important applications of MANETs are in support of military special operations and civil emergencies. MANETs lack a centralized architecture which affects the level of security inside the network and increases vulnerability. Encryption helps to increase network security level but is not sufficient to protect against malicious intruders. The rapid deployment of MANET nodes implies training data sets that are small vis-a-vis the problem dimensionality, which could lead to inaccuracies in the decision process [1]. The dynamic nature of such networks also leads to dataset drift [2]. These causes generally lead to errors made in the determination of malicious MANET nodes, but they also make the use of bilevel detectionschemes of special interest. A bilevel detection scheme is meant to deploy a two-stage detection process, which uses dedicated sniffers to collect data and make decisions locally, while the global detection is performed via a supernode based on the data provided by the dedicated sniffers. The proposed intrusion detection scheme in this work is based on cross-layer feature collection and packet counts (from both the medium access control (MAC) and network layers) and is trained based on the network behavior under normal and malicious activity. To facilitate the understanding of the ideas presented in this paper, we preview the architecture used in the intrusion detection process. It is shown below in Figure 1, where dedicated sniffer nodes, \(S_{i},\ i=1,\ \ldots,\ n\), capture information from several network layers and compute quantities which are referred to as correctly classified instances (CCI). The CCI used here is the ratio of the correctly classified instances obtained by the classifier to the total number of instances for both classes, normal and malicious. These quantities are then aggregated in a supernode which computes what we refer to as accumulated measure of fluctuation (AMoF). A supervised approach to learning is adopted, having datasets labeled for both normal and malicious classes. The labeling was obtained based on the state of the network, that is, based on when there are no malicious nodes, and when some malicious nodes are deployed in the network. This approach will add robustness when compared to labeling based on node level. A node level labelling is prone to a change in the node functionality (different types of nodes). The classical detection measures such as true positive (TP) and true negative (TN), will have inaccurate inference regarding node status; instead, we used the accumulated variation of the CCIs calculated by the dedicated sniffers to generate a more solid inference regarding node status. A detailed discussion for dataset generation, labeling and detection algorithms, is presented in Sections 4 and 5. In this paper, the type of attack used to simulate the malicious activity is a black hole attack, which is network layer-based [3]. A more detailed discussion of the attack is found in Section 2. A non-specification-based IDS is adopted here, so features are collected and processed without taking special consideration of the specification of the attack behavior. We believe that this approach, given the nature of dataset preparation that is based on network behavior, rather than node behavior, and the non-specification-based detection, would lead to an IDS that exhibits robust behavior in the face of a variety of attacks. For example, in a black hole attack, the ratio of packets received to packets forwarded is an attack-specific feature that is not used here. In stage one, the detection process uses a decision tree (C4.5 or random forest) to produce CCIs, at the sniffer level, every reporting time (_Tr_).