Zone-based Clustering for Intrusion Detection Architecture in Ad-Hoc Networks

Transcription

1 Zone-based Clustering for Intrusion Detection Architecture in Ad-Hoc Networks Il-Yong Kim, Yoo-Sung Kim, and Ki-Chang Kim School of Information & Communication Engineering, Inha University 3 Yonghyundong Namgu Incheon, Korea bush@super.inha.ac.kr, {yskim, kchang}@inha.ac.kr Abstract. Setting up an IDS architecture on ad-hoc network is hard because it is not easy to find suitable locations to setup IDS s. One way is to divide the network into a set of clusters and put IDS on each cluster head. However traditional clustering techniques for ad-hoc network have been developed for routing purpose, and they tend to produce duplicate nodes or fragmented clusters as a result of utilizing maximum connectivity for routing. Most of recent clustering algorithm for IDS are also based on them and show similar problems. In this paper, we suggest to divide the network first into zones which are supersets of clusters and to control the clustering process globally within each zone to produce more efficient clusters in terms of connectivity and load balance. The algorithm is explained in detail and shows about 3% less load concentration in cluster heads than traditional techniques. Keywords: Intrusion detection architecture, Ad-hoc Network, Clustering. Introduction Detecting intrusion in ad-hoc networks is harder than in regular networks. In wired or LAN/WAN, we have a gateway where network traffic is concentrated, and an IDS(Intrusion Detection System) can be installed there. In ad-hoc networks, we don t have such a convenient point. A candidate for IDS installation in ad-hoc networks would be a node that has relatively large number of neighboring nodes located within communication range. There should be multiple of them since we have to cover all participating nodes in the network, and these nodes need to communicate with each other to convey the local intrusion-related information. Finding such nodes and allowing them to exchange information efficiently is not easy. To make the situation worse, the nodes are mobile, and the network topology can change frequently: we may have to repeat the hard process of setting up intrusion detection architecture again and again. The problem of computing efficient clusters and maintaining them in spite of frequent changes in network topology is studied in relation with routing in ad-hoc networks. For routing purpose, the most important parameter that determines the

2 efficiency of a cluster is connectivity, and the suggested techniques tend to allow duplicate nodes (nodes belonging to more than one cluster at the same time) and to produce many fragmented clusters (clusters with only one or two members). For intrusion detection point of view, the critical parameter should be the number of nodes since the cluster head is responsible for collecting security-related data from all member nodes. Many researchers studied the above clustering problem for Ad-Hoc IDS[-4]. However the existing clustering techniques for IDS are simple adaptations of ones used in Ad-Hoc routing and still have the similar problem of duplicate nodes and fragmented cluster. We propose a zone-based clustering technique for Ad-Hoc IDS. The aim is to avoid duplicate nodes or fragmented clusters and to control the size of clusters to prevent excessive load in cluster heads. Our technique clusters the given network of nodes in two steps. In the first step, the network is divided into a set of sub-networks, called zones. Clusters are formed within a zone in the second step; that is no cluster is formed across zones. Zoning helps us to group geographically adjacent nodes; clustering within this zone is a much easier problem than clustering for the whole networks. Zoning also helps us to maintain the clusters. The replacement of a cluster head can be handled within the corresponding zone only. The proposed algorithm has been implemented and tested using GloMoSim simulator[5], and the result shows a significant reduction in the cluster header s packet processing load. The rest of the paper is organized as follows: Section examines previous studied on Ad-Hoc IDS clustering, Section 3 explains the proposed clustering techniques in detail, Section 4 describes experimental results, and Section 5 contains the concluding remarks. Related Work [] classifies IDS architectures for Ad-Hoc networks into Stand-Alone, Distributed and Cooperative, and Hierarchical. In Stand-Alone type, all nodes have IDS, but each node performs intrusion detection independently. A watchdog program can be combined with Stand-Alone architecture []. It can monitor the packet exchange between adjacent nodes and prevent communication with suspicious nodes. Distributed and Cooperative type also allows all nodes to have IDS, but they should cooperate in collecting global intrusion-related data []. Hierarchical architecture is one that uses clustering technique [, 3, 4]. Fig. shows an example of Hierarchical architecture. Each cluster has a cluster head, and adjacent clusters share a gateway node as shown in Fig. (a). IDS s are installed in cluster heads as shown in Fig. (b). Various techniques have been developed to build an efficient cluster and to select a cluster head. [3] suggests a technique in which the number of neighboring nodes is computed for all nodes and one with the maximum number becomes a cluster head. Neighboring nodes are computed based on predetermined number of hops: if the number of hops is, all nodes within hops from a node become neighboring nodes for that node. Once a cluster head is determined, the head itself and the surrounding nodes (located within the pre-determined number of hops from the head) form a cluster. The same process to find a cluster head and the

3 corresponding cluster, then, repeats for the rest of nodes. [4] suggests to build cliques first. A clique is a set of nodes that are within hop from each other and corresponds to a cluster in general term. A random cluster head, then, is elected from the clique. To protect the identity of a cluster head (for security reason), all nodes within a clique have the same probability to be elected. Fig.. Clustering for IDS Clustering for the purpose of intrusion detection is reported to be effective in reducing the load on CPU. To achieve the same detection rate, clustering technique helps to reduce the CPU usage by % compared to the case when no clustering is performed [4]. However, we still observe unnecessary monitoring overhead in previous techniques such as duplicate nodes and excessive number of small cluster fragments. Duplicate nodes happen in the gateway nodes existing in the overlapped area between two adjacent clusters, and they increase the overhead on cluster heads because of multiple monitoring by at least two neighboring cluster heads. Fragmented clusters are generated since the clustering algorithm prefers a set of well-connected nodes as a cluster and tends to leave boundary nodes not belonging to any cluster as single-node clusters. 3 Zone-Based Clustering Technique We prevent cluster fragmentation by first dividing the network of nodes into zones. A zone is a set of nodes that are located close to each other. Clusters are built within each zone not allowing inter-zone clusters. Node sharing between clusters is prohibited to prevent duplicate nodes. 3. Zoning Zoning process is distributed: seed nodes that are located at the boundary of the network announce themselves as initiators and start to build zones at the same time. We assume all nodes in the network know their neighbor nodes within one hop before starting the zoning process. A node becomes a seed node if it has or neighbors; we prefer lonely nodes as starting points to avoid the formation of fragmented clusters. The seed nodes start to form zones following the algorithm shown in Fig..

4 . Send to all neighbor nodes belonging to different zones other than the current one.. Collect from them for a pre-determined time. Each message has the zone size the sender belongs to. This and the arrival time of message will be used to compute its priority. The messages are inserted to a message queue in the priority order. 3. Pop a message from the queue, and mark all the nodes in the zone the sender belongs to as a new member of the current zone. Repeat this process until the pre-determined zone size is reached. If the maximum zone size has been reached, exit the zoning algorithm, and start the clustering algorithm. 4. Send to all members in the current zone. 5. Collect from them for some pre-determined time. Each message includes a number for neighbor nodes that are not in the current zone.. Elect one with the maximum such number. Report this node as a new coordinator to all members. Fig.. Zoning algorithm performed by the coordinator In the beginning all nodes are themselves zones, a one-member zone. A node can be in several states; initially all nodes are in SLEEP state as shown in Fig. 3. A zone must have a coordinator which determines whether to merge or not with neighbor zones. A coordinator that actively starts the zone-merging process is called an initiator; one that passively responds to this merging request is called a participant. So, zoning process is a negotiation process between two coordinators that represent two neighboring zones: one of them is an initiator, the other a participant. The state changes of these two nodes are shown in Fig. 3. SLEEP : message flow : state transit INIT SEND_INIT AWAKEN REQUEST PERMIT JOIN ACCEPTED INIT or COMPLETE SLEEP or COMPLETE Fig. 3. State transition of a node When zoning process begins, the seed nodes send setup_init messages to their neighbors. The seed nodes in this case act as initiators, and the neighbors become participant. The participants send back the size of the zone they belong to. The initiator examines the size and determines whether to merge or not. The basic

5 criterion is zone size after merging; if it becomes greater than some threshold, the merging is abandoned. Merging decision may be made for several neighbor zones at the same time. The setup_init messages are sent to all neighboring coordinators, and if multiple responses arrive within the same time period the initiator would consider all the corresponding participants as possible candidates for merging. The response from the participant is a setup_request message, and it contains the responder s zone size. The initiator use this information to give a preference to smaller participants: it is again to deter the formation of fragmented clusters. The participant does a similar selection based on the size of a zone. The setup_init message also contains the zone size of the initiator, and when the participant has received a number of setup_init messages, it prefers the initiator with the smallest zone size and sends setup_request to it. The merging process is shown in Fig. 4(a), and the preference of the smaller zone is shown in Fig. 4(b). Fig. 4. Zone building When a new zone is formed through merging, a new coordinator has to be elected. For this purpose, the old coordinator broadcasts a coordinator_election_request message to all zone members. Each zone member responds with the neighbor node table it has. The old coordinator counts only the neighbor nodes that do not belonging to the current zone, and the member with the largest neighbor node number (excluding ones within the current zone) will be elected as the new coordinator. The node number of the new coordinator will be notified to all zone members, and this new coordinator will start the next phase of zone merging process. Merging process stops when all the neighbor zones are merged to the initiator s zone or when the size of zone has reached the maximum. When the maximum size is reached, we have a final zone, and the state of all nodes within this zone becomes COMPLETE. When the maximum size is not yet reached, we repeat the process of zone merging again. 3. Zone building example Fig. 5 shows an example of zone building process. Initially there are nodes in m 4m area. All of them are coordinators and form a zone by themselves as explained in Section 3.. When the zoning process begins, node, 3,, and

6 become the initiators because they have less than or equal to neighboring nodes as shown in Fig. 5(a). These nodes send setup_init messages to their neighbors (or participants) and merge them. The initiators are shown in shaded circles. They are also shown in the tables of nodes in the right side of the figure. For each table, the shaded entry is the initiator and other entries are the participants for the initiator. The result is shown in Fig. 5(b). In the figure, 4 new zones and the corresponding new coordinators of them (in shaded circle) are shown. The new coordinators tend to exist at the boundary of the zone since they have a more number of neighbor nodes (neighbors belonging to the same zone are excluded when computing the number of neighbor nodes). These new coordinators act as initiators to start the next merging process. This process of merging and selecting a new coordinator is repeated again and again until the size of all zones reach the maximum or there is no more neighbor zone to merge. The final zones are shown in Fig. 5(f) (a) (b) (c) (d) (e) (f) Fig. 5. An example of zone building process 3. Clustering Clustering is the process of selecting a cluster head and including the neighbor nodes of this head into the cluster. For security reason, an outsider should have no clue about who will be and is the cluster head, and, therefore, all nodes should have an equal chance of becoming a cluster head. Once the head is elected, the neighbor nodes are included to the corresponding cluster until the maximum size is reached. Sharing of nodes between clusters is prohibited, and collecting nodes from other zone is also prohibited.

7 Clustering is performed at each zone independently. The coordinator at each zone at the time of completion of the zone will act as the zone manager. This manager performs the algorithm in Fig.. Fig.. An algorithm performed by the zone manager Basically it repeats the process of selecting a cluster head and building a cluster. In the beginning, it sends cluster_init message to all zone members. All members respond with a random number as shown in Fig.. The node which sent the biggest random number will be chosen as a cluster head. In Fig., there are 5 nodes in the zone, and node 4 has the largest random number. Since it has neighbor node 3 and 5 as shown in figure, the first cluster will be node 3, 4, and 5 with node 4 being the head. The clustering manager repeats the same process for the rest of nodes. The second table in Fig. shows node and become the second cluster with node being cluster head. Fig.. Clustering process 3.3 Zone/cluster maintenance The zones and clusters are dynamic entities. Their members may move out of them, or new members come and join. More seriously, the zone manager or the cluster head

8 may move out of the region, or we may need to replace them for security reasons. All these events may require rebuilding of the zone or the cluster. Rebuilding is processed in the form of merge or split a zone or cluster whose size is below some minimum threshold will be merged to the neighbor zone or cluster while one whose size becomes greater than some maximum threshold will be split. The moving-out or moving-in of a node is detected by short-term or long-term hello message. A shortterm message is a one-hop broadcast. All nodes issue short-term messages regularly to detect the membership change. Upon receiving, it all nodes respond with their zone and cluster identifiers. A long-term message is issued by the zone manager to all cluster heads in the corresponding zone periodically. The cluster heads responds with a message containing updating information such as membership change. The merging of a cluster is initiated by the cluster head whose cluster size has shrunk below some threshold. It sends a merge request to its neighbor cluster head. When two clusters are merged successfully, a report about this change will be sent to the zone manager by the combined cluster head. The split of a cluster is also initiated by the corresponding cluster head. The cluster head sends a split request to the zone manager, and the manager will start the cluster-forming algorithm in Fig., but in this case only for the members in the corresponding cluster. The merge or split of a zone is initiated by the corresponding zone manager. Merging is essentially the same process as the zone building process in Fig.. The moving of a cluster head or a zone manager is dealt with a new election. A new cluster head is elected when the members do not hear a short-term message from the head for some time period. They broadcast a random number to each other, and one issued the largest number will become the new head. Similar election is performed at zone level when the current zone manager disappears; again this absence of a manager is detected by the silence of the long-term message. 4 Experiments We have implemented our zone-based clustering technique in simulated network of mobile nodes using GloMoSim [5]. On the same network we also have implemented two previous clustering techniques for IDS in mobile network proposed in [4] and [8]. The aims of experiments are two folds. First we compare the cluster size, and secondly we compare the load in cluster heads. Cluster size is an important parameter to evaluate the performance of IDS. To avoid traffic concentration on a few cluster heads, the size should be evenly distributed among the cluster heads. Also to reduce inter-cluster-head traffic, the number of clusters should be controlled, and for this reason fragmented clusters (that has only one or two members) should be avoided as much as possible. Finally to avoid unnecessary traffic monitoring, node sharing between clusters should be prevented. The result for cluster size comparison is shown in Table. In the table, WCL and CIDS represent the clustering technique in [8] and [4] respectively, and ZIDS our technique. Three figures are compared: number of clusters, average cluster size, and In fact, we replace the zone manager and the cluster head periodically to avoid their exposure to persistent packet observers.

9 number of single cluster. For each category, we varied the number of participating nodes by 3, 5, and. The first column in the table shows the number of clusters produced by each technique. "n" shows the number of nodes in the network. As can be seen in the table, ZIDS is producing the least number of clusters. The next column shows the average cluster size. This data becomes meaningful when combined with that in the third column, which shows the number of fragmented clusters produced by each technique. For example CIDS is producing lots of fragmented clusters, but the average size is between those of WCL and ZIDS. This means that CIDS is producing two kinds of clusters most of time very large ones and very small ones. Very large clusters will penalize the cluster head; very small ones will increase traffic between cluster heads. On the other hand WCL produces almost no fragmented clusters as shown in the third column. However its average cluster size is relatively high. Table. Result for cluster size comparison Number of Clusters Avg. Cluster Size Number of Single Clusters n=3 n=5 n= n=3 n=5 n= n=3 n=5 n= WCL CIDS ZIDS Fig. 8 shows the numbers of packets monitored by cluster heads in CIDS and ZIDS. The traffic was generated using CBR(Constant Bit Rate) application. We defined a pattern file that contain 5 CBR traffic pattern, generated such files, and applied them to 5 and node network respectively. As can be seen in figure, ZIDS shows the minimum packet monitoring load: the amount of packets in ZIDS is about 3% less than that in CIDS. 5 nodes nodes 3 cids zids 4 cids zids 35 3 observed packets 5 observed packets p p p 3 p 4 p 5 p p p 8 p p p p p 3 p 4 p 5 p p p 8 p p traffic patterns traffic patterns Fig. 8. Number of monitored packets for 5 and node network 5 Conclusion In this paper, we have proposed a zone based clustering technique for intrusion detection in Ad-Hoc network. Clustering process is essentially a distributed process since it is hard to control all the nodes in a mobile network. However, by dividing the network into a set of zones that contain geographically close nodes, we can control

10 the clustering process globally within each zone and produce more efficient clusters. This zoning helps to produce clusters with evenly distributed size; it also facilitates better management of clusters when the nodes move across the cluster boundary. We have measured the performance of our technique in terms of traffic load on cluster heads which was about 3% lighter than that in traditional clustering techniques. References. Y. Zhang and W. Lee: Intrusion Detection in Wireless Ad-Hoc Networks. In: Proceedings of the th Annual International Conference on Mobile Computing and Networks (MobiCom), Boston, USA (). D. Sterne, P. Balasubramanyam, D. Carman, B. Wilson, R. Talpade, C. Ko, R. Balupari, C-Y. Tseng, T. Bowen, K. Levitt and J. Rowe: A General Cooperative Intrusion Detection Architecture for MANETs. In: Proceedings of the third IEEE International Workshop on Information Assurance (IWIA), College Park, MD, USA () 3. O. Kachirski and R. Guha: Effective Intrusion Detection Using Multiple Sensors in Wireless Ad Hoc Networks. In: Proceedings of the 3th Hawaii International Conference on System Science (HICSS), Hawaii () 4. Y. Huang and W. Lee: A Cooperative Intrusion Detection System for Ad Hoc Networks. In: Proceedings of the ACM Workshop on Security in Ad Hoc and Sensor Networks (SASN), Fairfax, VA, USA () 5. GloMoSim Simulator s web site: P. Brutch and C. Ko: Challenges in Intrusion Detection for Wireless Ad-hoc Networks. In: Symposium on Applications and the Internet Workshops (SAINT), Orlando, Florida, USA (). S. Marti, T. Giuli, K. Lai, and M. Barker: Mitigating Routing Misbehavior in Mobile Ad Hoc Networks. In: Proceedings of th International Conference on Mobile Computing and Networking (MobiCom), Boston, USA () 8. M. Chatterjee, S. K. Das, and D. Turgut: WCA: A Weighted Clustering Algorithm for Mobile Ad Hoc Networks. Journal of Cluster Computing, 5(), (). L. Zhou and L. J. Hass: Securing ad hoc networks. In: IEEE Networks, (), (). Li. Y and J. Wei: Guidelines on Selecting Intrusion Detection Methods in MANET. In: The Proceedings of ISECON, Newport, (). M. Bechler, H.-J. Hof, D. Kraft, F. Pählke, and L. Wolf: A Cluster-Based Security Architecture of Ad Hoc Networks. In: Twenty-third Annual Joint Conference of the IEEE Computer and Communications Societies (INFOCOM), Hong Kong, China (). C.-K. Toh: Ad Hoc Mobile Wireless Networks: Protocols and Systems. Prentice Hall PTR, ()