Abstract-HADOF is a set of mechanisms to protect mobile ad hoc networks against routing disruption attacks launched by inside attackers. First, each node launches a rouie trafti. ohserver to monitor the behavior of each valid route in its route cache, and to collect the packet forwarding statistics submitted by the nodes on this route. Since malicious nodes may submit false reports, each node also keeps chealing records for other nodes. If a node is detected as dishonest, this node will he excluded from future routes, and the other nodes wiil stop forwarding packets for it. Third, each node will try to huildfifriendship with other nodes to speed up malicious node detection. Route diversiry will be explored by each to discover multiple routes to the destination, which can increase the chance of defeating malicious nodes who aim to prevent good routes from being discovered. In addition, adaprive route rediscovery will be applied to determine when new routes should he discovered. HADOF can handle various attacks and introduces little overhead to the existing protocols. Both analysis and simulation studies have confirmed the effectiveness of HADOF. A mobile ad hoc network is a group of mobile nodes without requiring cenmalized administration or fixed network infrastruciure, in which nodes can communicate with other nodes out of their direct transmission ranges through cooperatively forwarding packets for each other. One underlying assumption is that they communicate through wireless connections. Since ad hoc networks can be easily and inexpensively set up as needed. they have a wide range of applications, such as military exercises, disaster rescue, and mine site operations. Before mobile ad hoc networks can be successfully deployed, security concerns must be addressed first [ l]-[61. However, due to mobility and the ad hoc nature, protecting mobile ad hoc networks is particularly hard: the wireless links are usually fragile with high link broken ratio; nodes lack of enough physical protection can be easily captured, compromised and hijacked; the sporadic nature of connectivity and the dynamically changing topology may cause frequent routes update; the lack of centralized monitoring or management points further deteriorates the situations. Attackers can easily launch a variety of attacks ranging from passive eavesdropping to active interfering. During the last decade, extensive studies have been conducted on routing in mobile ad hoc networks, and have resulted in several mature routing protocols [7]- [10]. However. in order to work properly. these protocols need trusted working environments which are not always available. In many situations, the environments may be adversarial. For example, some nodes may be selfish. malicious, or compromised by attackers. In the literature. many schemes have been proposed to secure ad hoc network routing protocols. However. most schemes focus on preventing attackers from entering the network through secure key distribution/authenticatinn and secure neighbor discovery, such as [51, [61, [111-[15]. These schemes are not effective in the situations where the malicious nodes have entered the network. or some nodes in the network have been compromised. In this paper, we consider the scenario that all nodes in the network belong to the same authority and pursue common goals, and propose a set of integrated mechanisms to defend against routing disruption attacks launched by inside attackers. Under this scenario, we can categorize the nodes into two classes: good and malicious. Good nodes will try their best to forward packets for others, that is. they are fully cooperative, while malicious nodes may manipulate routing messages, (selectively) drop data packets, and frame up other good nodes, with the objective of degrading the network performance and consuming valuable network resources. We use "JL4DOF" (the acronym of Honesty, Adaptivity, Diversity, Observer. and Friendship) to refer to the set of proposed mechanisms to defend against routing disruption attacks, which in brief works in the following way. Each node launches a route rrum observer to monitor the behavior of each valid route in its route cache, and to collect the packet forwarding statistics submitted by the nodes on those routes. Since the proposed reports submission mechanism does not rely on monitoring neighbors' forwarding activities, it is much more energy efficient than the watchdog mechanism. Since malicious nodes may submit false reports, each node also keeps a cheabing record database that indicates whether some nodes are dishonest or have been suspected as dishonest. If a node is detected as cheating, then this node will be 1252 b7803-
In REF , Yu et al. provided a set of mechanisms in which nodes kept a route traffic observer and built friendship with other nodes to monitor the route and detect cheating nodes.
HADOF: defense against routing disruptions in mobile ad hoc networks
Proceedings IEEE 24th Annual Joint Conference of the IEEE Computer and Communications Societies.
Proceedings IEEE 24th Annual Joint Conference of the IEEE Computer and Communications Societies.
Computer Science