Wormhole Detection and Prevention in MANETs

Transcription

1 Womhole Detection and Pevention in MANETs Lija Joy Compute Science and Engineeing KMEA Engineeing College Enakulum, Keala, India Sheena Kuian K Compute Science and Engineeing KMEA Engineeing College Enakulum, Keala, India Abstact Mobile nodes ae esponsible fo oute establishment in MANET using wieless link. MANET is an open entusted envionment so it encountes a numbe of secuity theats with little secuity aangement. Womhole is consideed to be a vey seious secuity theat among othes in MANET. In womhole, a tunnel is made between two selfish nodes which ae geogaphically vey fa away to each othe, in ode to hide thei actual location and ty to believe that they ae tue neighbous and makes convesation though the womhole tunnel. Reseaches ae going on to detect and pevent Womhole attack in efficient manne. Thee ae diffeent techniques to detect and pevent Womhole attack in MANETs, but some of them cause outing ovehead and delays. A model that encapsulate neighbo node and hop count method is consideed in this pape fo the Womhole detection and pevention. Keywods: AODV, MANET, Theshold, Womholes. INTRODUCTION MANET(Mobile Ad-hoc Netwoks) oiginates fom the need of mobile devices communication in wieless without fixed infastuctue pot. Mobile devices have to be the ole of outes to communicate each othe, which maintain outing infomation and fowad packets towad destination. Uneliable wieless media used fo communication between hosts, constantly changing netwok topologies and membeships, lifetime, limited bandwidth, computation powe of nodes etc. ae some special chaacteistic featues of MANETs. Fo the flexibility of MANETs these chaacteistics ae essential, and they intoduce specific secuity concens that ae absent o less sevee in wied netwoks. Wieless netwoks ae geneally implemented with some type of emote infomation tansmission system that uses electomagnetic waves, such as adio waves; fo the caie and this implementation usually takes place at the physical level o "laye" of the netwok. Mobile Adhoc netwok [2] [9] is a pat of wieless netwok which is a self-configuing netwok that is fomed automatically by a set of mobile nodes without the help of a fixed infastuctue o centalized management. To impove the secuity of an ad- hoc netwok Intusion pevention measues such as stong authentication and edundant tansmission can be used. The pevention techniques should be complemented by detection techniques, which monito secuity status of the netwok and identify malicious behavio; this is the equiement of the dynamic natue of ad-hoc netwoks. The secuity poblems ae not seiously consideed, even though thee exists many outing potocols. The attack behavio such as data stolen, modification, and dopping ae done by the malicious nodes when they become the immediate nodes of outing paths. These attack behavio intefee o deny communication between mobile nodes by wasting unnecessay bandwidth esouce. Netwoks may be boken and even cashed in wost cases. So it is vey impotant to potect MANET fom malicious attacks. One such dangeous malicious attack is the Womhole Attack. In a womhole attack, two attacke nodes join togethe. One attacke node eceives packets at one point and tunnels" them to anothe attacke node via a pivate netwok connection, and then eplays them into the netwok. The womhole puts the attacke nodes in a vey poweful position compaed to othe nodes in the netwok. In the eactive outing potocols such as AODV (Ad-hoc On Demanding Vecto) [4] [5], the attackes can tunnel each oute equest packets to anothe attacke that is nea to destination node. When the neighbous of the destination hea this RREQ (Route Request), they will eboadcast this RREQ and then discad all othe eceived RREQs in the same oute discovey pocess. As mention above womhole attack have a best impact on the netwok, it will attact a lage amount of netwok taffic which is done by giving a shotest oute to destination in the netwok. Theefoe, the outes going though the womhole must be shote than altenate outes though valid netwok nodes. Fig1: Womhole Woking Hee Fig 1 [3] shows an example of womhole attack ie, a netwok unde a womhole attack. Intudes A and B ae connected by an off-channel link (i.e. wied o satellite link), which they use to tunnel netwok data fom one end of the netwok to the othe. Without a womhole, nodes 7 and 3 ae 4

2 hops apat, thei messages to each othe should go though nodes 2, 6, and 5. When intudes A and B activate a womhole, nodes 7 and 3 ae able to diectly ovehea each othe s messages, and ae lead to believe they ae immediate neighbos. Once this happens, all futhe communications between nodes 3 and 7 will be going though the womhole link intoduced by A and B. The entie wok of the pape is oganized as follows. The motivation fo this wok is descibed in next section. Afte that system envionment is discussed then in next section system evaluation is given and in final section, some concluding emaks ae explained. MOTIVATION Kushwaha et al [12] poposes a simple technique to effectively detect womhole attacks. Special hadwae and/o stict location o synchonization equiements ae not needed thee. The poposed technique makes use of vaiance in outing infomation between neighbous to detect womholes. Finding an altenative path fom souce to second hop and calculating the numbe of hops to detect the womhole is the base of dissetation. Discoveing altenative outes to a taget node T that is one-hop neighbo s nodes that do not go though the womhole is the basic idea of the poposed technique. The length of the altenative path will be geate than the path that have womhole, and othewise the womhole will not attact lage amounts of taffic in this method. The detection of womhole depends on the density of nodes in the netwok, so the theshold value is calculated by checking the aveage numbe of hops between the nodes in the netwok. The poposed appoach attempts to find the numbe of hops on the second shotest oute between two altenate nodes stating fom the souce. Womhole can pesent between the two nodes if numbe of hops in the second shotest path is geate than the pedefined theshold. The detection technique depends on the netwok density. Theshold also depends on the netwok density. Hop count is compaed with the theshold in the poposed technique. A highe value of false negative ate (means it give tue altenative oute as a false oute) will be povided if the theshold value is small than the hop count else it will give false positive ate (means it give highe altenative oute as a tue oute). When the value of theshold inceases the detection atio of womhole shows good esult. Actual esult is fully depended on theshold value. When the numbe of nodes inceases the value of contol packet also inceases. The obsevations shows that the detection technique woks efficiently but having some ovehead when contol packet inceases, but the benefit of this technique is that it detects the womhole, and will seve as an advantage when added to the existing AODV potocol. Mahajan et al [13] gives a paticula fom of the womhole attack called the self-contained in-band womhole attack. In an out-of-band womhole, the collude nodes establish a diect link between the two end-points of the womhole tunnel in the netwok. A wied link o a long-ange wieless tansmission is used to establish this link. The womhole attacke then eceives packets at one end and diects the packets to be fowaded to the othe end though the established link. The attacke can thus analyze and tampe a lage amount of taffic though this link. An in-band womhole does not use an extenal communication medium to develop the link between the colluding nodes. Instead it develops a covet ovelay tunnel ove the existing wieless medium. It can be a pefeed choice of attackes and can be potentially moe hamful as it does not equie any additional hadwae infastuctue and consumes existing communication medium capacity fo outing the tunneled taffic. An illusion of being neighbos is ceated by in-band womholes, by sending false outing advetisements of a 1-hop symmetic link between the two nodes without the actual exchange of HELLO messages. This false link infomation is popagated to othe nodes acoss the netwok via a boadcast of OLSR Topology Contol (TC) messages. This false link infomation thus undemines the shotest path outing calculations attacting many end-to end flows by advetising incoect shotest paths. With the help of a thid collude node the attacted taffic is then fowaded though a tunnel. This collude node acts as an applicationlaye elay fo womhole taffic between the womholes endpoints. Extended in-band womhole and self-contained inband womhole ae the two foms of in-band womholes. An extended womhole ceates a womhole that extends beyond the attackes foming the tunnel endpoints. A false link is advetised between two nodes that ae not the attacke nodes. On the othe hand a potentially stealthie self-contained womhole, advetises a false link between the attacke nodes themselves. The effectiveness of a womhole attack is based on the amount of taffic that can be attacted by a womhole. The lage the amount of attacted taffic, stonge can be the womhole attack on the netwok taffic. The stength of a womhole attack can be defined as the numbe of end-to-end paths attacted by the false link advetisement sent by the attackes. In othe wods, the stength of a womhole is the numbe of end-to-end paths passing though the womhole tunnel. The ability of the womhole to pesist without significant decease in the stength even in the pesence of mino topology changes in the netwok is efeed to as obustness of a womhole. The esilience of the womhole to small changes of topology is based on the amount of attaction offeed by the womhole. Small impovements in nomal paths can esult in nodes choosing altenative paths that do not pass though the womhole link when the attaction is small, thus deceasing the stength of the womhole. The decease in the path length offeed by the womhole is efeed to as attaction. To mitigate the womhole attack [8] [10] [11] in mobile Adhoc netwok, cluste based technique is poposed. Clustes ae fomed to detect the womhole attack. The whole netwok is divided into clustes ovelapped o disjoint. Membe nodes of cluste pass the infomation to the cluste head and cluste head is elected dynamically. This cluste heads maintains the 2

3 outing infomation and sends aggegated infomation to all membes within cluste. Thee is a node at the intesection of two clustes named as guad node. The guad node has equipped with powe to monito the activity of any node and guad the cluste fom possible attack. The netwok is also divided into oute laye and inne laye. Oute laye cluste head is having the esponsibility of infoming all nodes of the inne laye about the pesence of the malicious node. SYSTEM ENVIRONMENT The system envionment includes, Basic MANET AODV Envionment Ceation using simulation in Java [14]. Womhole Attack Model Ceation Detection of Womhole using Womhole detection Algoithm and Theshold Calculation Algoithm. Pefomance Analysis and Detection of Womhole using time synchonization fo educing Routing Ovehead. Basic MANET AODV Envionment Ceation in Java Simulato includes Nodes ceation, Movement of nodes, Routing of nodes using AODV. Adhoc on demanding vecto (AODV) [7] is one of popula outing potocol. It can be applied in high mobility devices, in which the netwok topology changes fequently. Routing path fo communication may get disupted due to mobility of nodes. When data communication is needed, fistly the mobile nodes have to discove and setup a outing path. In such case, malicious nodes have diffeent oppotunities to join the pocess of setting up a outing path. So that, moe attention should be paid to secuity poblems. Womhole attack ecods packets at one end-point in the netwok and tunnels them to othe endpoint. These attacks ae sevee theats to MANET outing potocols. Fo example, when a womhole attack is used against an on-demand outing potocol such as AODV/ DSR, the attack could pevent the discovey of any outes othe than though the womhole. Womhole attacks put sevee theats to MANETs. This attack is vey much dangeous because it can also still be pefomed even if the netwok communication povides authentication and confidentiality. Womhole attack can also affect the netwok even if the attacke has no cyptogaphic keys. The womhole attack is especially hamful against many ad-hoc outing potocols [6] [7] fo example, Adhoc on-demand distance vecto (AODV), dynamic souce outing (DSR), the hop count of a path effects the choice of outes, cluste head gateway switch outing potocol (CGSR), hieachical state outing potocol (HSR) and adaptive outing using clustes (ARC). The womhole attack is able to confuse the clusteing pocedue and lead to a wong topology and it can patition the netwok though contol links between two cluste heads of the outing hieachy. The womhole attack is dangeous against the secuity in MANETs in which the nodes that hea a packet tansmission diectly fom some node conside themselves to be in ange of that node. It is one of the most the poweful attacks that ae faced by many Adhoc netwok outing potocols. The womhole attack does not equie exploiting the featue of nodes in the netwok and it can intefee while executing the outing pocess. Attacke uses these attacks to gain unauthoized access to compomise systems o pefom denial-of-sevice (DoS) attacks. Womhole attacks ae vey difficult to detect, because pass infomation path it used is often not a pat of the actual netwok, and it is paticulaly dangeous, because they can damage without knowing the netwok potocols and sevices povided unde cetain situation. Womhole could be a useful netwoking sevice as this simply pesents a long netwok link to the link laye and up, the attacke may use this link to its advantage. Afte the attacke attacts a lot of data taffic though the womhole, it can disupt the data flow by selectively dopping o modifying data packets, geneating unnecessay outing activities by tuning off the womhole link peiodically. The attacke can also simply ecod the taffic fo late analysis. Using womholes an attacke can also beak any potocol that diectly o indiectly elies on geogaphic poximity. Fo example, taget tacking applications in senso netwoks can be easily confused in the pesence of womholes. In this methodology evey node is esponsible to find out whethe thee is any wom hole between those nodes to it s next to successo node. Fo detection evey node find altenate oute fo it s next to successo node as suggested by AODV, if numbe of hop count in any of altenate oute is geate than theshold then that node eply womhole detection signal between itself and it s next to successo node. Algoithm fo womhole detection is descibed below in algoithm 1. Exisitng Algoithm fo Womhole Detection Algoithm 1 (S i,t i+2 ) Step 1 if (S i = D-1) Then no womhole in whole path P SD Else go to step 2 Step 2 S i boadcast HELLO message to all neighbo Node(NS) except P i+1 S,D. Step 3 All NS eply to S i egading to HELLO message. Step 4 Evey NS find a oute to T i+2 (NS, T) = l NS,T step5 and eply in tem of hops to souce s i. NS (NS,T) Whee (P i NS,T) = S whee i = 1,2,3, Then discad l NS,T Step6 souce (S) select minimum l NS,T among all l NS,T Step7 If(minimum l NS,T <= T) Then i=i+1 Goto step 1 Else Exit womhole 3

4 Pocess fo evaluating the value of theshold is based on a model that encompasses both hop count and neighbou node algoithm. In this appoach value of theshold is calculated on the basis of hop count methodology with the help of neighbou node infomation. Fo calculating theshold each and evey node of netwok find the path having the lagest numbe of node ove the entie possible path between it and it s next to successo node and conside aveage value highest hop count of the entie node as theshold ove the netwok as descibe in algoithm 2 [1]. Algoithm 2 (Theshold of Netwok) { Assumption 1. N total numbe of node in netwok 2. HP numbe of Hop count in any oute initialed with HP=0 3. SHP sum of maximum hop count fo all pai of node in netwok Fo (I=1; J<=N ; I++) { Fo (J=1; J<=X ; J++) { Step 1. Si send an oute equest message to all its neighbo node fo its next to successo node NNjSi Step 2. All the neighbo node eply the Route though oute Reply packet to Si in tem of numbe of hop count Y Step 3. if (Y>HP) HP=Y } SHP= SHP+ HP } Theshold = SHP/N } In ode to identify the womhole link the existing algoithm needs outing in each step of data tansmission. That is at fist a oute is identified using nomal method and data sending is initialized though that oute. Then befoe each hop the algoithm equie a outing to the next to next hop. This involves all the steps of outing such as equest boadcast and eply eception. Afte a numbe of eplies, outes ae obtained, the node matches the longest eply oute length to theshold and if found geate it identifies as womhole link. ISSN In poposed wok the pime concen is to avoid this additional In this algoithm all decision will take on the basis of value of outing equiement and in tun educe the time taken fo each theshold ie,minimum numbe of node in altenate oute message to tansmit and avoid the huge ovehead caused by between evey pai of node to next to successo node with the the outings in each step of tansmission. An effective and path discove by AODV is geate than o not. If it s geate entiely new algoithm is implemented which is based on the than theshold, then it s declaed thee is womhole between fact that the womhole link is consideably lengthie than its next node and next to successo node, elsewhee not. nomal links and womhole data pocessing is diffeent fom nomal nodes with espect to the time it consumes. Time synchonization is done to all the nodes in the system which can be easily done in MANET envionment by the available times. With time sync all nodes now has the ability to tack the tavelling time of each packets which contains the time which it has been oiginally tansmitted. When a oute eply eaches the souce, the souce will calculate the time taken fo the packet to aive by simply subtacting the tansmitted time fom cuent time. Fom this pe-hop delay is calculated fom the equation total tavelling time by no: of hops. (If the packet is taveled though 5 nodes in 5secs each link took 5/5=1s ie, Pe-hop delay). This pe-hop delay will be appoximately same fo all genuine links. When the oute includes a womhole link the pe-hop delay vaies significantly. That is how the womhole link is identified. Theshold is the nomal maximum pe-hop delay calculated fom the oute. Delay is diectly popotional to the tavelling distance. When distance inceases delay also inceases. Maximum delay can thus calculated using the effective ange of nodes. A successful genuine link will have a maximum distance equal to the ange of paticipating nodes. But fo a womhole this will be significantly lage. The algoithm fo both theshold calculation and womhole detection used in poposed method is given below. Poposed Algoithm fo Theshold Calculation Step 1: Identify send time fom eceived RREP (Route Reply). Step 2: Identify cuent time fom system clock. Step 3: Fo each oute calculate the delay using the fomula Route Delay = Received Time - Send Time Step 4: Identify hop count fo each oute. Step 5: Find Individual pe hop theshold using the fomula Theshold = delay/hop count Step 6: Calculate the oveall theshold using the fomula : Oveall Theshold = Poposed Algoithm fo Womhole Detection Step 1: Select Route to send data as pe Routing Algoithm. Step 2: Fo each hop in the Route. Identify pe hop delay. Step 3: If (pe hop delay >theshold) Then beak as womhole detected Else Successful Message sending. 4

5 SYSTEM EVALUATION Table 2: Delay Compaison A system evaluation pocess based on both existing and No: of No: of Existing Poposed poposed algoithm is descibed hee. The envionment Nodes Womholes Avg. Delay Avg. Delay paametes used in Java Simulato is shown in Table 1. (ms) (ms) Table 1: System Paamete s used. Routing Potocol AODV Expeiment Aea (x-axis, y-axis) Mobile Nodes Deployment 650m*650m Random Numbe of Nodes 5 ~ 60 Numbe of Womholes 2 ~ 5 Node Speed(m/s) 10 ~ 50 Type of Data Communication Constant Bit Rate (CBR) Mbps MAC Laye Potocol b The paametes used fo the evaluation is Delay, Routing Ovehead and Enegy. A delay gaph compaison[15] fo both existing and poposed wok is made against the numbe of nodes pesent in the netwok. When numbe of nodes and numbe of malicious node incease in the netwok, coesponding changes also will happen in delay, outing ovehead and enegy. But the delay, outing ovehead and enegy used will be consideably less fo the poposed wok. Routing ovehead efes to the no. of exta packets equied to successfully tansmit the data apat fom the outing netwok packets. The existing needs exta outing packets send in each step of the data tansmission. This eflects in a high Routing ovehead. Meanwhile poposed system needs mino modification in the existing packets and exta time synchonizing. This esult in vey little exta bits so ovehead is consideably lowe in poposed wok. This esult eflects in the gaph obtained. Each packet equies some enegy to tansmit. So total enegy used by the system is diectly popotional to the no. of packets send including both netwok packets and secuity packets. Existing system shoots a consideable amount of secuity packets and use up a lot of enegy. In poposed it is shown that it uses fewe packets to delive the data. So enegy is educed. Oveall enegy use also depends on no of nodes in system No: of Nodes Table 3: Routing Ovehead Compaison No: of Womholes Existing Avg. Routing Ovehead (pkts) Poposed Avg. Routing Ovehead (pkts) No: of Nodes Table 4: Enegy Compaison No: of Existing Womholes Avg. Enegy (ma) Poposed Avg. Enegy (ma) Fig 2, Fig 3, Fig 4 shows a Compaison gaph in which the aveage delay, aveage outing ovehead and aveage enegy is compaed with the numbe of nodes espectively in both existing and poposed wok and it is based on the paamete value compaison in Table II, Table III and Table IV. Fig 2: Delay Compaison Gaph

6 efficiency by educing oute delay, outing ovehead and enegy fo sending packets. REFERENCES CONCLUSION Fig 3: Routing Ovehead Gaph Fig 4: Enegy Gaph Womhole attack is one of the most seious attacks in MANETs. These attacks can be easily set up in mobile ad-hoc netwoks and it vey poweful to make seious consequences. Many solutions have been poposed to detect and emove the attack but ae not pefect in tems of efficiency o any special hadwae. The poposed appoach simulates the womhole nodes and povides a solution fo the detection of womhole attacks. The poposed technique povides a bette solution fo detecting womhole attack in the netwok. The detection method is mainly based on the pehop delay values between nomal paths and the paths unde womhole attack. A simulation is done hee with the paametes delay, outing ovehead and enegy with espect to the numbe of nodes in the netwok and the esults shows that the poposed appoach is successful in detecting womhole attack, poviding bette [1] Ankit Mehto, Pof.Hitesh Gupta A Dynamic Hybid Appoach fo Womhole Detection and Pevention 4th ICCCNT July 4-6, [2] Yudhvi Singh, AvniKhatka, Pabha Rani, Deepika, DheeDhwaj Baak Womhole Attack Avoidance Technique in Mobile Adhoc Netwoks Thid Intenational Confeence on Advanced Computing & Communication Technologies, [3] Xiangyang Li Wieless Adhoc and Senso Netwoks: Theoy and Applications Cambidge Univesity Pess, July [4] C. Pekins, E. Belding-Roye, Adhoc On-Demand Distance Vecto (AODV) Routing, The Intenet Society [5] Sang-min Lee, Keecheon Kim An Effective Path Recovey Mechanism fo AODV Using Candidate Node spinge link, vol. 4331/2006, [6] Rutvij H. Jhavei, Ashish D. Patel, Jatin D. Pama, Bhavin I. Shah MANET Routing Potocols and Womhole Attack against AODV, IJCSNS Intenational Jounal of Compute Science and Netwok Secuity, VOL.10 No.4, Apil [7] Kanika Lakhani, Himani bathla, Rajesh Yadav A Simulation Model to Secue the Routing Potocol AODV against Black- Hole Attack in MANET IJCSNS Intenational Jounal of Compute Science and Netwok Secuity, vol. 10 No.5, May [8] Kee, S. ;Suyavanshi, A., "To pevent womhole attacks using wieless potocol in MANET" IEEE 2010, Page [9] O. Kachiski and R. Guha, Effective Intusion Detection using Multiple Sensos in Wieless Adhoc Netwoks, in Poc. 36th Annual Hawaii Int l. Conf. on System Sciences (HICSS 03), pp.57.1, [10] L. Hu and D. Evans, Using Diectional Antennas to Pevent Womhole Attacks, in poceedings of the 11th Netwok and Distibuted System Secuity Symposium, pp , [11] Debdutta Baman Roy, Ritupana Chaki and Nabendu Chaki, New Cluste based womhole intusion detection algoithm fo mobile adhoc netwok, Intenational Jounal of Netwok Secuity & Its Applications (IJNSA), vol. 1, no. 1, pp , [12] Vien Mahajan, MaiteyaNatu, And AdashpalSethi Analysis Of Womhole Intusion Attacks In MANETs IEEE 2008, Page1-7. [13] N. Satheesh, D. K. Pasadh Analysis and Paameteized Evaluation of Impact of Womhole Attack Using AODV Potocol in MANET, Intenational Jounal of Advanced Reseach in Compute Science and Softwae Engineeing, Volume 3, Issue 9, Septembe [14] Lija Joy, Sheena Kuian K, Black Holes Detection in MANETs In the Poceedings of the C Sponsoed National Confeence on Infomation and Communication Technologies (NCICT 2014), 4 th and 5 th Mach, [15] Thasneem Abdul Jaleel, DA.Neela Madheswai, RCD based detection of Distibuted Reflection Denial of Sevice attacks with a compaative analysis of DDoS ove DRDoS In the Poceedings of the UGC Sponsoed National Confeence on Infomation and Communication Technologies (NCICT 2014), 4 th and 5 th Mach, 2014.