IJATSER. Review: Worm Hole Detection & Prevention in Order to Increase Network Security in Mobile Adhoc

Transcription

1 Review: Worm Hole Detection & Prevention in Order to Increase Network Security in Mobile Adhoc Network VOLUME 1 ISSUE Akansha Panse M.tech scholar, 2 Anurag Jain Assistant Professor (HOD) 1,2 Department of Computer Science & Engineering RITS, Bhopal ABSTRACT Mobile ad-hoc network (MANITs) is one of the most vibrant field among different wireless communication network technologies. MANITs can replace wireless infrastructure network. Self-organization, selfconfiguring and self-healing natures of MANITs dynamically provide solution for high-speed internet access. MANITs are highly cost-effective and provide scalability and flexibility. As a result of its open medium nature, distributed architecture and dynamic topology, it is highly prone to security vulnerability. Wormhole attack is the most vulnerable attack in MANITs, where two malicious nodes at different locations establish a tunnel between them and can selectively drop data packets. Detection and prevention of wormhole attack is very difficult. This paper gives a brief introduction of Mobile ad-hoc network, security challenge and different type of attack over MANET also link wormhole as a serious thread that is successfully isolated from the concerned network. Keywords: Wireless Networks, Mobile Ad-hoc network, Wormhole Attack, Routing I. INTRODUCTION Recently, MANITs has become a very important wireless technology for several new and marketable applications, such as, broadband home networking, community networks, battlefield surveillance, VoIP etc and many others. Most importantly, it helps to provide consistent wireless broadband service access at minimum cost. In MANITs, nodes automatically establish and maintain network connectivity. For the end users the advantages of this feature are many, e.g., low upfront cost, robust, easy network configuration and maintenance, reliable network coverage etc. A MANITs is a communication network made up of radio nodes organized in a mesh topology [1]. It consists of mesh routers, mesh clients and gateways. Mesh routers have very low mobility and perform routing and configuration, which significantly decrease the load of mesh clients and other end nodes, thus preventing congestion. Due to its multi-hop nature, MANITs is prone to various security vulnerabilities such as node compromising, physical disruption etc resulting in Denial of Service (DoS). Most network layer attacks such as sinkhole attacks, Sybil attacks, rushing attacks, wormhole attacks etc. degrades the overall throughput of the network. Among all these attacks wormhole attack is one of the deadliest attack and is considered here for investigation. II. ROUTING PROTOCOLS MANET routing protocols are IP based and may use unicast, multicast or hybrid approaches and should allow for interaction with standard wired IP services rather than being regarded as a completely separate entity. Figure 1 shows the categorization of different routing protocols of MANET. Mobile Ad-hoc Routing protocal Figure 1: Categorization of Routing Protocols in MANET a) Reactive Routing Protocols Proactive Reactive Hybrid DSDV WRP OLSR CSGR FSR ABR AODV DSR DYMO TORA ZRP ALL RIGHTS RESERVED 124

2 In reactive (also known as Demand based) routing protocols, a route is discovered only when it needed. Nodes only maintain routes to active destinations. The communication overhead is reduced at the expense of delay due to route search. These protocols are significant for the Ad hoc environment since battery power is conserved both by not sending the advertisements and by not receiving [3]. All nodes maintain the discovered routes in their routing tables. However, only valid routes are kept and old routes are deleted after an active route timeout. A serious issue for MANETs arises when link failures occur due to high node mobility; at the same time new links may also be established between previously distant nodes. This significantly increases the network broadcast traffic with rapid link make/break effect of intermediate nodes. Figure 2 shows the path discovery process for a reactive routing protocol [4]. There are various attacks can possible in the MANET network. But there are two major classifications in this way. Active and Passive attacks are the most common category. In active attack the attacker or the malicious node takes the part actively in the network. Here the attacker will modify or alter the data packet and send this packer into the network. In spite of altering the data packet attacker can also inject and drop the data packet. So that, such type of attacks very harmful for the end users. Attack Passive Active Eavesdropping Traffic Analysis Dropping Modification Fabrication Figure 2: Route Discovery Process b) Proactive Routing Protocols In proactive schemes, also known as table driven approaches, every node continuously maintains the complete routing information of the network. When a node needs to forward a packet, the root is readily available; thus there is no delay in searching for a root. However for a highly dynamic topology, the proactive schemes spend a significant amount of scarce wireless resources in keeping the complete routing information correct [10]. However, when frequency of link breakage is high, the proactive routing protocols need a higher rate routing table updates, which lower the network performance. c) Hybrid Routing Protocols Hybrid routing is the third category of routing scheme, in which proactive and reactive, both approaches are combined. An example of such a protocol is Zone Routing Protocol (ZRP). III. ATTACKS Figure 2 Classifications of On other hand the passive attack can happen without the tempering the data packet. In this type of attack the attacker only analyze the data. The main goal of this type of attack is to break the confidentiality. Here the attacker tries to know the activities of the network. It focuses on the pattern to send in the network on the basis of which the attacker will take illegal action. Detection of passive attacks is very difficult since the operation of the network itself does not get affected. The figure 2 shows the basic classification of the attacking approaches. As it shows the active and passive attack are the first criteria. It is possible to classify this by some other criteria. Timing IV. ATTACKS ON PROTOCOL STACK The characteristics of WSNs make them susceptible to many new attacks. These attacks can occur in different layers of the network protocol stack. Layer Application Layer Transport Layer Network Layer Data Link Layer Physical Layer Viruses and Worms TCP,UDP Black hole, Wormhole Traffic Monitoring, Eaves Dropping ALL RIGHTS RESERVED 125

3 V. ATTACKS ON NETWORK LAYEAR A process in the network for trying to damage or defeat the things using illegal activity in the wireless environment called attack. The person or an object who will do this thing is called the attacker. There are many types of attacks in network layer like Blackhole Attack Rushing Attack Wormhole Attack Sinkhole Attack Link Withholding & Link Spoofing Replay Resource Consumption Attack Sybil Attack In all these attacks the wormhole is a famous and dangers attack. Wormhole attack is a severe attack in which two attackers placed themselves strategically in the network. The attackers then keep on hearing the network, record the wireless data. VI. WORMHOLE ATTACK Wormhole attack happens when two or more malicious nodes collude together by establishing a tunnel using an efficient communication medium (wired connection or high-speed wireless connection, etc.)[2]. It is also same as the rushing attack as it attacks the ondemand routing protocol but the technique is different. A wormhole attack attempts to convince the nodes to use a malicious path through legitimate means during the route discovery phase of on-demand routing protocol and then forward the Route Request messages between the malicious nodes using the tunnel. Therefore, the first RREQ message that comes to the destination node is the one which was forwarded by the malicious node. In this way, the malicious nodes are introduced in the path from original source to destination. If the malicious nodes are included in the routing path, the malicious nodes can drop all the passing packets, i.e. resulting complete denial of service(dos), or drop the packets selectively to avoid detection. As shown in Fig 1, during wormhole attack two malicious nodes of different network link together via some physical link and creates a tunnel and introduces an illusion that node X of network A should be a neighbour of node Y of network B. Normally, wormhole installs their malicious nodes at topologically important positions within the network as compared to other general nodes for attracting maximum traffic of network. It also prevent other routes from being discovered, and thus creates a permanent DoS attack by dropping all the packets, or selectively dropping or modifying certain packets as needed. The tunnel can be established by two ways: inband and out-of-band channel [4].In encapsulation-based wormhole attacks, several nodes exist between two malicious nodes and the data packets are encapsulated between the malicious nodes. The malicious node receiving the data packets draws the routing message out of the packet payload and further broadcast or propagates it. As the encapsulated data packets are sent between the malicious nodes, if there are several nodes between the two malicious nodes the actual hop count does not increase in the time of traversal. Therefore, using hop count for path selection in routing protocols may invite encapsulation-based wormhole attacks. In out-of-band channel, the wormhole attack is introduced by having a single-hop, high quality, out-of-band link (called tunnel) between the malicious nodes. This tunnel may be accomplished with the help of a direct-wired connection or a long-range directional wireless connection. But, this method of attacking needs specialized hardware capability and therefore, it is more difficult to introduce than the packet encapsulation method. VII. Figure 3: Wormholes [3] RELATED METHODS The detection methods are working based on three different techniques[5] namely hop count, decision anomaly and neighbour list, which are discussed here briefly. A. Hop counting method Delay and hop count in transmitting RREQ and RREP through the path is recorded. Average time taken by each hop is calculated. In case of wormhole nodes, the delay would be obviously longer than the normal path with the same hop count. Path with longer delay would not be selected to transmit packet and wormhole nodes are avoided. B. Decision Anomaly based detection Here, neighbouring nodes of a wormhole node are allowed to notice that the wormhole node may have high capacity of competition in path discovery. In this detection method, a route will be created by an intermediate node ALL RIGHTS RESERVED 126

4 .This route will not go through a hot neighbour node, which is having a higher route-building rate than the threshold. As a result, wormhole nodes are gradually identified and isolated by their normal neighbouring nodes. C. Neighbour List Based Detection Neighbour list provides the secure neighbour discovery from source to destination and also detect the anomaly if attack is present. The steps to do this are[5]: single-hop neighbour discovery, Initial route discovery, data dissemination and wormhole detection, and Secure route discovery against a wormhole attack. Till date, researchers had proposed several methods for the purpose. Some effective methods are discussed here. Hu et al.[6] proposed packet leashes mechanism, which limits the distance moved by a packet in the network. They explained two approaches for achieving this goal; one is a space-based approach, called as Geographical Leashes that establishes a limit on the distance that a packet can travel. The drawback of this scheme is that, each node should know its own location and moreover, all nodes must be having loosely synchronized clocks. As clock synchronization requires some resources, therefore, packet leashes applicability is limited in wireless sensor networks. Other approach called temporal leashes uses a tightly synchronized clock to add its transmission time to the packet. The receiver is able to detect the distance using the claimed transmission time and the speed of light. In one approach, use of directional antennas are made to prevent wormhole attacks[7]. Here, a cooperative protocol is used on which nodes share directional information to prevent wormhole endpoints to cover-up as false neighbours that needs to be confirmed free from wormhole attack. Here, each node shares a secret key with other nodes and keeps the updated neighbour record. However, it is only capable of partially mitigating the wormhole problem. Specifically, it is successful in those scenarios where malicious nodes can mislead two nodes to believe that they are neighbours. The Delay per Hop Indicator (DelPHI) [8], can detect both hidden and exposed wormhole attacks. In DelPHI method, all the available disjoint routes between a sender and a receiver are tried to be explored. Next, the delay and distance of each route are calculated from which the average delay per hop through each route calculated. A greater Delay per Hop (DPH) value indicates that the route may have a wormhole link. Transmission time based mechanism (TTM) [9] is another method to detect wormhole attack. TTM computes the transmission time between the neighbours of an established path. Transmission time between two bogus neighbours which are created by wormhole is supposed to be significantly more than that between two real neighbours within radio range of each other. In TTM no special hardware is required and it gives good performance with little overhead. In order to avoid the problem of using special hardware a Round Trip Time (RTT) mechanism is proposed [10]. The RTT is the total time between sending the RREQ message from node A and receipt of RREP message from a node B. Every node will calculate the RTT for all their neighbours. As, the RTT between two real neighbours has to be lower than two fake neighbours, node A can easily identify both kinds of neighbours. Any special hardware is not needed in this method and it is also easy to implement; but, it fails to detect exposed attacks in which fake neighbours are created. Huayiu et al.[11] proposed a high efficiency wormhole detection algorithm called Wormhole Detection based on Neighbour s Neighbour scheme (WDNN).It is based on 2-hop neighbour in WMNs. To prevent routes from wormholes, they propose a simple Random Walk Route scheme (RWR). The WDNN scheme may detect the fake network topology by increasing the transmission range of the 2-hop neighbour. The RWR scheme removes the wormhole link by choosing the high latency link. Rakesh et al.[12] proposed WRSR, a wormholeresistant secure routing algorithm based on HWMP. It detects the presence of wormhole by allowing a node to monitor and identifies route request traversing a wormhole and prevent such route from being established. For identifying a wormhole free path it uses unit disk graph model. WRSR can detect both hidden as well as byzantine wormhole without using any special hardware. Cell-based Open Tunnel Avoidance (COTA) was proposed to address this problem, which consisted in a mechanism for detecting and classifying the wormhole attacks in the network. In this paper [13], the COTA mechanism is implemented on the location aided routing protocol (LAR1), leading to the so-called COTALAR1 scheme. Simulation results are provided, showing that the COTA-LAR1 scheme is an improved secured routing scheme against wormhole attacks in MANETs, in terms of packet delivery ratio, throughput, and end-to-end delay, chosen as performance metrics. VIII. PROBLEM ANALYSIS Ad hoc networks typically work in an open un-trusted environment with little physical security, and are vulnerable for different type of security attacks. One attack in ad hoc networks is the wormhole attack that has ALL RIGHTS RESERVED 127

5 received a great deal of recent attention. In wormhole attack, an attacker captures the packets from one point in the network and tunnels them to a distant location where they are replayed, typically without modification. Thus, the detection of wormhole is a very important in the network. For wormhole attack to have a side impact on the network, it must attract a large amount of network traffic which is done by giving a shortest route to destination in the network. Therefore, the routes going through the wormhole must be shorter than alternate routes through valid network nodes. After the attacker attracts a lot of data traffic through the wormhole, it can disrupt the data flow by selectively dropping or modifying data packets, generating unnecessary routing activities by turning off the wormhole link periodically, etc. The attacker can also simply record the traffic for later analysis. Therefore it becomes very necessary to develop a technique, which can successfully defend against wormhole attacks. The objective of this dissertation is to develop a new approach, which can successfully defend against wormhole attacks. Problem with wormhole deduction and prevention as Existing technique[6] having lower true positive rate,higher False Negative Rate, Larger Power Consumption Of Battery,Higher Routing Overhead [6,7],Efficiently manage control packet [7] IX. CONCLUSION Mobile ad hoc network based on the cooperation of nodes to provide the fundamental operation such as routing. For commercial deployment of these networks, it is important that they consider adequate security measures. Selfish behavior of ad hoc network nodes such as wormhole attack is a serious threat to mobile ad-hoc network as it cannot be detected easily could greatly degrade the performance of network. Such behavior should be identified and isolated. X. REFERENCES [1] Ian F. Akyildiz, Xudong Wang, Weilin Wang, "Wireless mesh networks: a survey," Computer Networks, vol. 47, no. 4, pp , March [2] Aggeliki Sgora, Dimitrios D. Vergados and P. Chatzimisios. A Survey on Security and Privacy Issues in Wireless Mesh Networks. Security and Communication Networks September 2013 [3] Pratima Singh, Ashish Srivastava, Nitesh Gupta, A Novel Approach to Detect & Prevent Wormhole Attack over MANET & Sensor n/w towards Lower Battery Power Consumption,IOSR Journal Volume 15, Issue 1 (Sep. - Oct. 2013), PP [4] Sushant S. Bahekar, Prashant Panse,A Comparative Analysis of Detection andprevention of Wormhole in Mobile Ad-hoc Networks. International Journal of Science and Research (IJSR). [5] A.Vani, D. Sreenivasa Rao,A Simple Algorithm for Detection andremoval of Wormhole for Secure Routing In Ad Hoc Wireless Networks. International Journal on Computer Science and Engineering. Vol 3,no.6,,pp , June,2011 [6] Y. Hu, A. Perrig, and D. Johnson, Packet Leashes: A Defense against Wormhole in Wireless AdHoc Networks, in proceedings of INFOCOM, [7] L. Qian, N. Song, and X.-F. Li, Detecting and locating wormhole attacks in wireless ad hoc networks through statistical analysis of multipath, in IEEE WCNC, [8] H. S. Chiu, K. S. Lui, DelPHI: Wormhole detection mechanism for Ad Hoc wireless networks, in Proc. ISWPC 06, (Phuket, Thailand), Jan [9] Tran Van Phuong, Ngo Trong Canh, Young-Koo Lee, Sungyoung Lee, Heejo Lee, Transmission Time-based Mechanism to Detect wormhole,ieee Asia-Pacific Services Computing Conference,2007 [10] S. Kurosawa, H. Nakayama, N. Kato, A. Jamalipour, and Y. Nemoto, Detecting blackhole attack on AODV-based mobile ad hoc networks by dynamic learning method, International Journal of Network Security,vol. 5, no. 3, pp , November [11] Huaiyu Wen, Guangchun Luo,Wormhole Detection and Prevention Based on 2-Hop Neighbour in Wireless Mesh Networks, Journal of Information & Computational Science, September 2013, [12] L. Shrivastava, B.K. Chaurasia, GS Tomar, S.S. Bhadoria, Secure Congestion Adaptive Routing using Group Signature Scheme, Springer s Trans. on Comput. Sci. Vol.17, LNCS 7420, pp , [13] Teotia, V.; Dhurandher, S.K.; Woungang, I.; Obaidat, M.S., "Wormhole prevention using COTA mechanism in position based environment over MANETs," in Communications (ICC), 2015 IEEE International Conference on, vol., no., pp , 8-12 June 2015 [14] Rakesh Matam, Somanath Tripathy, WRSR: wormhole-resistant secure routing forwireless mesh networks, EURASIP Journal on Wireless Communications and Networking 2013, 2013:180 [15] Rajneesh Kumar, Shekhar Verma, G S Tomar, Thwarting Address Resolution Protocol Poisoning using Man In The Middle Attack in WLAN, International Journal of Reliable Information and Assurance Vol.1, No.1, pp.8-19, 2013 [16] A.A.Pirzada and M.Portmann, High performance AODV routing Protocol for hybrid Wireless Mesh Networks,in Proc of fourth Annual international conference of Mobile and Ubiquitous Systems:Networking and Services,2007,pp1-5 ALL RIGHTS RESERVED 128