CLUSTER BASED COST EFFICIENT INTRUSION DETECTION SYSTEM FOR MANET

Transcription

1 CLUSTER BASED COST EFFICIENT INTRUSION DETECTION SYSTEM FOR MANET Saravanan Kumarasamy 1, Hemalatha B 2 and Hashn P 3 1 Asst. Professor/CSE Erode Sengunthar Engneerng College, Erode, Inda 2, 3 B.E. C.S.E. Student, Erode Sengunthar Engneerng College, Erode, Inda Emal:saravanankumarasamy@gmal.com ABSTRACT Moble ad-hoc networks are temporary wreless networks. Network resources are abnormally consumed by ntruders. Anomaly and sgnature based technques are used for ntruson detecton. Classfcaton technques are used n anomaly based technques. Intruson detecton technques are used for the network attack detecton process. Two types of ntruson detecton systems are avalable. They are anomaly detecton and sgnature based detecton model. The anomaly detecton model uses the hstorcal transactons wth attack labels. The sgnature database s used n the sgnature based IDS schemes. The moble ad-hoc networks are nfrastructure less envronment. The ntruson detecton applcatons are placed n a set of nodes under the moble ad-hoc network envronment. The nodes are grouped nto clusters. The leader nodes are assgned for the clusters. The leader node s assgned for the ntruson detecton process. Leader nodes are used to ntate the ntruson detecton process. Resource sharng and lfetme management factors are consdered n the leader electon process. The system optmzes the leader electon and ntruson detecton process. The system s desgned to handle leader electon and ntruson detecton process. The clusterng scheme s optmzed wth coverage and traffc level. Cost and resource utlzaton s controlled under the clusters. Node moblty s managed by the system. 1. INTRODUCTION Unlke tradtonal networks, the Moble Ad hoc Networks (MANETs) have no fxed chokeponts/bottlenecks where Intruson Detecton Systems (IDSs) can be deployed [3]. Hence, a node may need to run ts own IDS [1] and cooperate wth others to ensure securty. Ths s very neffcent n terms of resource consumpton snce moble nodes are energylmted. To overcome ths problem, a common approach s to dvde the MANET nto a set of 1- hop clusters where each node belongs to at least one cluster. The nodes n each cluster elect a leader node (cluster head) to serve as the IDS for the entre cluster. The leader-ids electon process can be ether random or based on the connectvty. Both approaches am to reduce the overall resource consumpton of IDSs n the network. However, we notce that nodes usually have dfferent remanng resources at any gven tme, whch should be taken nto account by an electon scheme. Unfortunately, wth the random model, each node s equally lkely to be elected regardless of ts remanng resources [11]. The connectvty ndex-based approach elects a node wth a hgh degree of connectvty even though the node may have lttle resources left. Wth both electon schemes, some nodes wll de faster than others, leadng to a loss n connectvty and potentally the partton of network. Although t s clearly desrable to balance the resource consumpton of IDSs among nodes, ths objectve s dffcult to acheve snce the resource level s the prvate nformaton of a node. Unless suffcent ncentves are provded, nodes mght msbehave by actng selfshly and lyng about ther resources level to not consume ther resources for servng others whle recevng others servces. Moreover, even when all nodes can truthfully reveal ther resource levels, t remans a challengng ssue to elect an optmal collecton of leaders to balance the overall resource consumpton wthout floodng the network. Next, we motvate further dscussons through a concrete example. The problem of selfshness and energy balancng exsts n many other applcatons to whch our soluton s also applcable. Lke n IDS scheme, leader electon s needed for routng and key dstrbuton [6] n MANET. In key management, a central key dstrbutor s needed to update the keys of nodes. In routng, the nodes are 1

2 grouped nto small clusters and each cluster elects a cluster head (leader) to forward the packets of other nodes. Thus, one node can stay alve, whle others can be n the energy-savng mode. The electon of a leader node s done randomly, based on connectvty (nodes degree) or based on a node s weght. We have already ponted out the problems of random model and connectvty model. We beleve that a weghtbased leader electon should be the proper method for electon. Unfortunately, the nformaton regardng the remanng energy s prvate to a node, and thus, not verfable. Snce nodes mght behave selfshly, they mght le about ther resource level to avod beng the leader f there s no mechansm to motvate them. Our method can effectvely address ths ssue. 2. RELATED WORK Ths secton revews related work on ntruson detecton n MANET, the applcaton of mechansm desgn to networks, and the applcaton of leader electon scheme to routng and key dstrbuton INTRUSION DETECTION SYSTEMS IN MANET The dfference between wred nfrastructure networks and moble ad hoc networks rases the need for new IDS models that can handle new securty challenges. Due to the securty needs n MANET, a cooperatve ntruson detecton model has been proposed, where every node partcpates n runnng ts IDS n order to collect and dentfy possble ntrusons. If an anomaly s detected wth weak evdence, then a global detecton process s ntated for further nvestgaton about the ntruson through a secure channel. An extenson of ths model was proposed, where a set of ntrusons can be dentfed wth ther correspondng sources. Moreover, the authors address the problem of runtme resource constrants through modelng a repeatable and random leader electon framework. An elected leader s responsble for detectng ntrusons for a predefned perod of tme. Unlke our work, the random electon scheme does not consder the remanng resources of nodes or the presence of selfsh nodes. A modular IDS system based on moble agents s proposed and the authors pont out the mpact of lmted computatonal and battery power on the network montorng tasks. Agan, the soluton gnores both the dfference n remanng resources and the selfshness ssue. To motvate the selfsh nodes n routng, CONFIDANT proposes a reputaton system where each node keeps track of the msbehavng nodes. The reputaton system s bult on the negatve evaluatons rather than postve mpresson. Whenever a specfc threshold s exceeded, an approprate acton s taken aganst the node. Therefore, nodes are motvated to partcpate by punshng the msbehavng ones through gvng a negatve reputaton. As a consequence of such a desgn, a malcous node can broadcast a negatve mpresson about a node n order to be punshed. On the other hand, CORE [2] s proposed as a cooperatve enforcement mechansm based on montorng and reputaton systems. The goal of ths model s to detect selfsh nodes and enforce them to cooperate. Each node keeps track of other nodes cooperaton usng reputaton as a metrc. CORE ensures that msbehavng nodes are punshed by gradually excludng them from communcaton servces. In ths model, the reputaton s calculated based on data montored by local nodes and nformaton provded by other nodes nvolved n each operaton. In contrast to such passve approaches, our soluton proactvely encourages nodes to behave honestly through computng reputatons based on mechansm desgn. Moreover, t s able to punsh msbehavng leaders through a cooperatve punshment system based on cooperatve game theory. In addton to ths, a noncooperatve game s desgned to help the leader IDS to ncrease the probablty of detecton by dstrbutng the node s samplng over the most crtcal lnks APPLICATION OF MECHANISM DESIGN As a subfeld of mcroeconomcs and game theory, mechansm desgn has receved extensve studes n mcroeconomcs for modelng economcal actvtes. Nsan and Ronen apply mechansm desgn for solvng the least-cost path and task schedulng problem. Dstrbuted mechansm desgn based on VCG s frst ntroduced n a drect extenson of Border Gateway Protocol (BGP) for computng the lowest cost routes. Moreover, the authors outlned the 2

3 bascs of dstrbuted mechansm desgn and revewed the results done on multcast cost sharng and nterdoman routng. Mechansm desgn has been used for routng purposes n MANETs, such as a truthful ad-hoc-vcg mechansm for fndng the most cost-effcent route n the presence of selfsh nodes. In [9], the authors provde an ncentve compatble aucton scheme to enable packet forwardng servces n MANETs usng VCG; a contnuous aucton process s used to determne the dstrbuton of bandwdth, and ncentves are gven as monetary rewards. To our best knowledge, ths work s among the frst efforts n applyng mechansm desgn theory to address the securty ssues n MANETs, n partcular, the leader electon for ntruson detecton. Ths paper s the extenson of [4], where we presented the leader electon mechansm n a statc envronment wthout addressng dfferent performance overhead LEADER ELECTION APPLICATIONS Dstrbuted algorthms for clusterng and leader electon have been addressed n dfferent research work [5]. These algorthms can be classfed nto two categores: Cluster-frst or leader-frst. In the cluster frst approach, a cluster s formed, and then, the nodes belongng to that cluster elect a leader node. In the leader frst approach, a set of leader nodes s elected frst, then the other nodes are assgned to dfferent leader nodes. Some of the methods assume that there exst a weght assocated wth each node or there exst a trusted authorty to certfy each node s metrc (weght) whch s used to elect a leader. We consder these assumptons as qute strong for MANET. Our model s able to run n a clustered and nonclustered network where we are able to perform better results wth respect to dfferent performance metrcs. 3. PROBLEM STATEMENT We consder an MANET where each node has an IDS and a unque dentty. To acheve the goal of electng the most cost-effcent nodes as leaders n the presence of selfsh and malcous nodes, the followng challenges arse: Frst, the resource level that reflects the cost of analyss s consdered as prvate nformaton. As a result, the nodes can reveal fake nformaton about ther resources f that could ncrease ther own benefts. Second, the nodes mght behave normally durng the electon but then devate from normal behavor by not offerng the IDS servce to ther voted nodes. In our model, we consder MANET as an undrected graph G = (N,L), where N s the set of nodes and L s the set of bdrectonal lnks. We denote the cost of analyss vector as C = {c 1, c 2, c n } where n s the number of nodes n N. We denote the electon process as a functon vt k (C, ), where vt k (C, ) = 1 f a node votes for a node k; vt k (C, ) = 0, otherwse. We assume that each elected leader allocates the same budget B for each node that has voted for t. Knowng that the total budget wll be dstrbuted among all the votng nodes accordng to ther reputaton. Ths wll motvate the nodes to cooperate n every electon round that wll be held on every tme T ELECT. Thus, the model wll be repeatable. For example, f B = 25 packet/sec and the leader gets three votes, then the leader s samplng budget s 75 packet/sec. Ths value s dvded among the three nodes based on ther reputaton value. The objectve of mnmzng the global cost of analyss whle servng all the nodes can be expressed by the followng Socal Choce Functon (SCF): SCF = S(C) = mn c. k vtk ( C, ). B. k N N Clearly, n order to mnmze ths SCF, the followng must be acheved. Frst, we need to desgn ncentves for encouragng each node n revealng ts true cost of analyss value c. Second, we need to desgn an electon algorthm that can provably mnmze the above SCF whle not ncurrng too much of the performance overhead. 4. LEADER ELECTION MECHANISM 4.1 MECHANISM DESIGN BACKGROUND Mechansm desgn s a subfeld of mcroeconomcs and game theory. Mechansm desgn uses game theory tools to acheve the desred goals. The man dfference between game theory and mechansm desgn s that the former can be used to study what could happen when ndependent players act selfshly. On the other hand, mechansm desgn allows a game desgner to defne rules n terms of the SCF such that players wll play accordng to these rules. The balance of IDS resource consumpton problem can 3

4 be modeled usng mechansm desgn theory wth an objectve functon that depends on the prvate nformaton of the players. In our case, the prvate nformaton of the player s the cost of analyss whch depends on the player s energy level. Here, the ratonal players select to delver the untruthful or ncomplete nformaton about ther preferences f that leads to ndvdually better outcomes [10]. The man goal of usng mechansm desgn [7] s to address ths problem by: 1) desgnng ncentves for players (nodes) to provde truthful nformaton about ther preferences over dfferent Outcomes and 2) computng the optmal system-wde soluton, whch s defned accordng to (1). A mechansm desgn model conssts of n agents where each agent {1,, n } has a prvate nformaton, φ θ, known as the agent s type. Moreover, t defnes a set of strateges A for each agent. The agent can choose any strategy a A to nput n the mechansm. Accordng to the nputs (a,..., a n ) of all the agents, the mechansm calculates an output o = o(a 1,..., a n ) and payment vector p = (p 1,..., p n ), where p = p (a 1,..., a n ). The preference of each agent from the output s calculated by a valuaton functon v ( θ, o). Ths s a quantfcaton n terms of a real number to evaluate the output for an agent. Thus, the utlty of a node s calculated as u = p - v ( θ, o). Ths means that the utlty s the combnaton of output measured by valuaton functon and the payment t receves from the mechansm. In drect revelaton mechansm, every agent has a type θ. Each agent gves an nput a ( θ ) to the mechansm. The agent chooses the strategy accordng to ts type, where a ( θ ) = _, whch s chosen from the strategy set θ = {Selfsh; Normal}. We assume that normal agents follow the protocol, whereas selfsh agents devate from the defned protocol f the devaton leads to a hgher utlty. Although the prme objectve of these agents s not to actvely harm others but ther presence can passvely harm others. Last but not least, the mechansm provdes a global output from the nput vector and also computes a specfc payment for each agent. The goal s to desgn a strategy proof mechansm where each agent gves an nput based on ts real type θ such that t maxmzes ts utlty regardless of the strateges of others. A strategy s domnated by another strategy f the second strategy s at least as good as the other one regardless of the other players strategy. Ths s expressed as follows: p - v ( θ, o) = where * * u u = p - v ( θ, o), * θ denotes nonselfshness and denotes selfshness. Note that u s maxmzed only when p s gven by the mechansm. The queston s: How to desgn the payments n a way that makes truth-tellng the domnant strategy? In other words, how to motvate nodes to reveal truthfully ther valuaton functon v ( θ, o)? The VCG mechansm answers ths queston by gvng the nodes a fxed payment ndependent of the nodes valuaton, whch s equal to the second best valuaton. The desgn of the payment, accordng to our scenaros, s gven n the followng sectons. A general overvew of mechansm desgn can be found n [8] THE MECHANISM MODEL We treat the IDS resource consumpton problem as a game where the N moble nodes are the agents/players. Each node plays by revealng ts own prvate nformaton whch s based on the node s type θ. The type * θ θ s drawn from each player s avalable type set θ = {Normal, Selfsh}. Each player selects hs own strategy/type accordng to how much the node values the outcome. If the player s strategy s normal, then the node reveals the true cost of analyss. We assume that each player has a utlty functon: u ( θ ) = p - v ( θ, o( θ, θ )), - (2) where. θ s the type of all the other nodes except. v s the valuaton of player of the output o O, knowng that O s the set of possble outcomes. In our case, f the node s elected, then v s the cost of analyss c. Otherwse, v s 0 snce the node wll not be the leader, and hence, there wll be no cost to run the IDS. p R s the payment gven by the mechansm to the elected node. Payment s 4

5 gven n the form of reputaton. Nodes that are not elected receve no payment. Note that u ( θ ) s what the player usually seeks to maxmze. It reflects the amount of benefts ganed by player f he follows a specfc type θ. Players mght devate from revealng the truthful valuaton for the cost of analyss f that could lead to a better payoff. Therefore, our mechansm must be strategy-proof where truthtellng s the domnant strategy. To play the game, every node declares ts correspondng cost of analyss where the cost vector C s the nput of our mechansm. For each nput vector, the mechansm calculates ts correspondng output o = o( θ,..., θ n ) and a payment vector p = (p 1,...,p n ). Payments are used to motvate players to behave n accordance wth the mechansm goals. In the followng sectons, we wll formulate the followng components: 1. Cost of analyss functon: It s needed by the nodes to compute the valuaton functon. 2. Reputaton system: It s needed to show how: a. Incentves are used once they are granted. b. Msbehavng nodes are catched and punshed. 3.Payment desgn: It s needed to desgn the amount of ncentves that wll be gven to the nodes based on VCG. 4.3 COST OF ANALYSIS FUNCTION Durng the desgn of the cost of analyss functon, the followng two problems arse: Frst, the energy level s consdered as prvate and senstve nformaton and should not be dsclosed publcly. Such a dsclosure of nformaton can be used malcously for attackng the node wth the least resources level. Second, f the cost of analyss functon s desgned only n terms of nodes energy level, then the nodes wth the low energy level wll not be able to contrbute and ncrease ther reputaton values. To solve the above problems, we desgn the cost of analyss functon wth the followng two propertes: Farness and Prvacy. The former s to allow nodes wth ntally less resources to contrbute and serve as leaders n order to ncrease ther reputaton. On the other hand, the latter s needed to avod the malcous use of the resources level, whch s consdered as the most senstve nformaton. To avod such attacks and provde farness, the cost of analyss s desgned based on the reputaton value, the expected number of tme slots that a node wants to stay alve n a cluster, and energy level. Note that the expected number of slots and energy level are consdered as the nodes prvate nformaton. Fg Reputaton system model REPUTATION SYSTEM MODEL Before we desgn the payment, we need to show how the payment n the form of reputaton can be used to: 1) motvate nodes to behave normally and 2) punsh the msbehavng nodes. Moreover, t can be used to determne whom to trust. To motvate the nodes n behavng normally n every electon round, we relate the cluster s servces to nodes reputaton. Ths wll create a competton envronment that motvates the nodes to behave normally by sayng the truth. To enforce our mechansm, a punshment system s needed to prevent nodes from behavng selfshly after the electon. Msbehavng nodes are punshed by decreasng ther reputaton, and consequently, are excluded from the cluster servces f the reputaton s less than a predefned threshold. As an extenson to our model, we can extend our reputaton system to nclude dfferent sources of nformaton such as routng and key dstrbuton wth dfferent assgned weghts CILE PAYMENT DESIGN In CILE, each node must be montored by a leader node that wll analyze the packets for other ordnary nodes. Based on the cost of analyss vector C, nodes wll cooperate to elect a set of leader nodes that wll be able to analyze the traffc across the whole network and handle the montorng process. Ths ncreases the effcency and balances the resource consumpton of an IDS n the network. Our mechansm provdes 5

6 payments to the elected leaders for servng others. The payment s based on a per-packet prce that depends on the number of votes the elected nodes get. The nodes that do not get any vote from others wll not receve any payment. The payment s n the form of reputatons, whch are then used to allocate the leader s samplng budget for each node. Hence, any node wll strve to ncrease ts reputaton n order to receve more IDS servces from ts correspondng leader. Fg An example of leader electon CDLE PAYMENT DESIGN In CDLE, the whole network s dvded nto a set of clusters where a set of 1-hop neghbor nodes forms a cluster. Here, we use the scheme to cluster the nodes nto 1-hop clusters. Each cluster then ndependently elects a leader among all the nodes to handle the montorng process based on nodes analyss cost. Our objectve s to fnd the most cost-effcent set of leaders that handle the detecton process for the whole network. Hence, our socal choce functon s stll as n (1). To acheve the desred goal, payments are computed usng the VCG mechansm where truth-tellng s proved to be domnant. Lke CILE, CDLE provdes payment to the elected node and the payment s based on a per-packet prce that depends on the number of votes the elected node gets. 5. LEADER ELECTION ALGORITHM To run the electon mechansm, we propose a leader electon algorthm that helps to elect the most cost-effcent leaders wth less performance overhead compared to the network floodng model. We devse all the needed messages to establsh the electon mechansm takng nto consderaton cheatng and presence of malcous nodes. Moreover, we consder the addton and removal of nodes to/from the network due to moblty reasons. Fnally, the performance overhead s consdered durng the desgn of the gven algorthm where computaton, communcaton, and storage overhead are derved OBJECTIVES AND ASSUMPTIONS To desgn the leader electon algorthm, the followng requrements are needed: 1) To protect all the nodes n a network, every node should be montored by a leader and 2) to balance the resource consumpton of IDS servce, the overall cost of analyss for protectng the whole network s mnmzed. In other words, every node has to be afflated wth the most cost-effcent leader among ts neghbors. Our algorthm s executed n each node takng nto consderaton the followng assumptons about the nodes and the network archtecture: Every node knows ts (2-hop) neghbors, whch s reasonable snce nodes usually mantan a table about ther neghbors for routng purposes. Loosely synchronzed clocks are avalable between nodes. Each node has a key par for establshng a secure communcaton between nodes. Each node s aware of the presence of a new node or removal of a node. For secure communcaton, we can use a combnaton of TESLA and publc key nfrastructure. Wth the help of TESLA, loosely synchronzed clocks can be avalable. Nodes can use publc key nfrastructure durng electon and TESLA n other cases. Recent nvestgatons showed that computatonally lmted moble nodes can also perform publc key operatons LEADER ELECTION To start a new electon, the electon algorthm uses four types of messages. Hello, used by every node to ntate the electon process; Begn-Electon, used to announce the cost of a node; Vote, sent by every node to elect a leader; and Acknowledge, sent by the leader to broadcast ts payment, and also as a confrmaton of ts leadershp. For descrbng the algorthm, we use the followng notaton: servce-table(k): The lst of all ordnary nodes, those voted for the leader node k. 6

7 reputaton-table(k): The reputaton table of node k. Each node keeps the record of reputaton of all other nodes. neghbors(k): The set of node k s neghbors. leadernode(k): The ID of node k s leader. If node k s runnng ts own IDS, then the varable contans k. leader(k): A boolean varable that sets to TRUE f node k s a leader and FALSE otherwse. Intally, each node k starts the electon procedure by broadcastng a Hello message to all the nodes that are 1 hop from node k and starts a tmer T 1. Ths message contans the hash value of the node s cost of analyss and ts unque dentfer (ID). Ths message s needed to avod cheatng where further analyss s conducted. Algorthm 1 (Executed by every node) /* On recevng Hello, all nodes reply wth ther cost */ 1. f (receved Hello from all neghbors) then 2. Send Begn-Electon (ID k ; cost k ); 3. else f(neghbors(k) = φ ) then 4. Launch IDS. 5. end f On expraton of T 1, each node k checks whether t has receved all the hash values from ts neghbors. Nodes from whom the Hello message have not receved are excluded from the electon. On recevng the Hello from all neghbors, each node sends Begn-Electon as n Algorthm 1, whch contans the cost of analyss of the node, and then, starts tmer T 2. If node k s the only node n the network or t does not have any neghbors, then t launches ts own IDS. Algorthm 2 (Executed by every node) /* Each node votes for one node among the neghbors */ 1. f ( n ε neghbor(k), 9 ε n : c c n ) then 2. send Vote(ID k, ID, cost j ); 3. leadernode(k) := ; 5. end f On expraton of T 2, the node k compares the hash value of Hello to the value receved by the Begn-Electon to verfy the cost of analyss for all the nodes. Then, node k calculates the leastcost value among ts neghbors and sends Vote for node as n Algorthm 2. The Vote message contans the ID k of the source node, the ID of the proposed leader, and second least cost among the neghbors of the source node cost j. Then, node k sets node as ts leader n order to update later on ts reputaton. Note that the second least cost of analyss s needed by the leader node to calculate the payment. If node k has the least cost among all ts neghbors, then t votes for tself and starts tmer T 3. Algorthm 3 (Executed by Elected leader node) /* Send Acknowledge message to the neghbor nodes */ 1. Leader() := TRUE; 2. Compute Payment, P ; 3. update servce-table (); 4. update reputaton-table (); 5. Acknowledge = P + all the votes; 6. Send Acknowledge (); 7. Launch IDS. On expraton of T 3, the elected node calculates ts payment usng (5) and sends an Acknowledge message to all the servng nodes as n Algorthm 3. The Acknowledge message contans the payment and all the votes the leader receved. The leader then launches ts IDS. Each ordnary node verfes the payment and updates ts reputaton table accordng to the payment. All the messages are sgned by the respectve source nodes to avod any knd of cheatng. At the end of the electon, nodes are dvded nto two types: Leader and ordnary nodes. Leader nodes run the IDS for nspectng packets, durng an nterval T ELECT, based on the relatve reputatons of the ordnary nodes. We enforce reelecton every perod T ELECT snce t s unfar and unsafe for one node to be a leader forever. Even f the topology remans same after T ELECT tme, all the nodes go back to ntal stage and elect a new leader accordng to the above algorthms. 6. ENERGY EFFICIENT LEADER ELECTION MODEL The system s desgned to handle leader electon and ntruson detecton process. The clusterng scheme s optmzed wth coverage and traffc level. Cost and resource utlzaton s controlled under the clusters. Node moblty s managed by the system. The system s desgned to perform ntruson detecton on MANET 7

8 envronment wth energy management. Intruson detecton operatons are ntated by the leader nodes. The anomaly based model s used for the ntruson detecton process. The system s dvded nto fve major modules. They are Network analyss, Clusterng process, Leader Electon, Detector assgnment and Intruson Detecton. The network analyss module s desgned to fnd out the neghbor detals. Clusterng process module s desgned to group up the nodes. Cluster leader node s selected wth resource levels. Detector assgnment module s desgned to place ntruson detector applcaton. The ntruson detecton process s performed wth network transactons. The neghborhood nodes are grouped nto clusters. The clusters are formed wth coverage and traffc nformaton. The cluster detals are updated n ntervals. The cluster resources are shared by the nodes LEADER ELECTION The leader s elected for each cluster. The resource and energy detals are consdered n the leader selecton process. The leader nodes are assgned wth ncentves. Reputaton s provded wth reference to ncentves NETWORK ANALYSIS The network node status nformaton are collected n ths module. Neghbor nodes and ther resource levels are collected and updated. Computatonal and storage detals are also collected from the nodes. Network status detals are perodcally updated. MANE T Node Neghbo r Dscover MA NET Nod Servce Request / Response Cluster ng Process Resource Analyss Leader Electo n Intruso n Servce Fg Intruson Detecton System for MANET 6.2. CLUSTERING PROCESS Servce Request / Response Fg An MANET after addng a new node DETECTOR ASSIGNMENT The detector responds for the ntruson detecton process. The detector s placed wth reference to the resource levels. The leader node s assgned wth detector module. The detector collects all transactons for ntruson detecton process INTRUSION DETECTION The ntruson detecton process s ntated n ntervals. Dynamc nterval estmaton s used n the system. The Bayesan classfcaton technque s used for ntruson detecton process. The ntruson detecton results are passed to the requested node. 7. CONCLUSION The moble ad-hoc networks are nfrastructure less envronment. Leader nodes are used to ntate the ntruson detecton process. Resource sharng and lfetme management factors 8

9 are consdered n the leader electon process. The system optmzes the leader electon and ntruson detecton process. The system reduces the energy consumpton. Network traffc s reduced by the system. Dynamc nterval s assgned for ntruson detecton process. Electon Model for Intruson Detecton n MANET IEEE Transactons On Dependable And Secure Computng, Vol. 8, No. 1, January- February REFERENCES [1] T. Anantvalee and J. Wu, A Survey on Intruson Detecton n Moble Ad Hoc Networks, Wreless/Moble Network Securty, Sprnger, [2] P. Mchard and R. Molva, Analyss of Coalton Formaton and Cooperaton Strateges n Moble Adhoc Networks, J. Ad Hoc Networks, vol. 3, no. 2, pp , [3] F. Anjum and P. Mouchtars, Securty for Wreless Ad Hoc Networks. John Wley and Sons, Inc., [4] N. Mohammed, H. Otrok, L. Wang, M. Debbab, and P. Bhattacharya, A Mechansm Desgn-Based Mult-Leader Electon Scheme for Intruson Detecton n Manet, Proc. IEEE Wreless Comm. and Networkng Conf. (WCNC), [5] K. Sun, P. Peng, P. Nng, and C. Wang, Secure Dstrbuted Cluster Formaton n Wreless Sensor Networks, Proc. IEEE Computer Securty Applcatons Conf. (ACSAC), [6] M. Bechler, H. Hof, D. Kraft, F. Pahlke, and L. Wolf, A Cluster-Based Securty Archtecture for Ad Hoc Networks, Proc. IEEE INFOCOM, [7] L. Hurwcz and S. Reter, Desgnng Economc Mechansms, frst ed. Cambrdge Unv. Press, [8] N. Nsan, T. Roughgarden, E. Tardos, and V.V. Vazran, Algorthmc Game Theory, frst ed. Cambrdge Unv. Press, [9] K. Chen and K. Nahrstedt, Pass: An Incentve Compatble Aucton Scheme to Enable Packet Forwardng Servce n MANET, Proc. Int l Conf. Dstrbuted Computng Systems, [10] J. Shnedman and D. Parkes, Specfcaton Fathfulness n Networks wth Ratonal Nodes, Proc. ACM Symp. Prncples of Dstrbuted Computng, [11] Noman Mohammed, Had Otrok, Lngyu Wang, Mourad Debbab and Prabr Bhattacharya, Mechansm Desgn-Based Secure Leader 9